# articles

feed_id: https://krebsonsecurity.com/?p=55199
title: ParkMobile Breach Exposes License Plate Data, Mobile Numbers of 21M Users
uri: ParkMobile-Breach-Exposes-License-Plate-Data-Mobile-Numbers-of-21M-Us
url:
https://krebsonsecurity.com/2021/04/parkmobile-breach-exposes-license-plate-data-mobile-numbers-of-21m-users/

content:
<p>Someone is selling account information for 21 million customers of <a href="https://www.parkmobile.io" target="_blank" rel="noopener">ParkMobile</a>, a mobile parking app that&#8217;s popular in North America. The stolen data includes customer email addresses, dates of birth, phone numbers, license plate numbers, hashed passwords and mailing addresses.</p>
<p><img loading="lazy" class="aligncenter wp-image-55209" src="media/d2aae7f2.parkmobile-ad.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/parkmobile-ad.png" alt="" width="703" height="457" /></p>
<p>KrebsOnSecurity first heard about the breach from <a href="https://www.geminiadvisory.io" target="_blank" rel="noopener">Gemini Advisory</a>, a New York City based threat intelligence firm that keeps a close eye on the cybercrime forums. Gemini shared a new sales thread on a Russian-language crime forum that included my ParkMobile account information in the accompanying screenshot of the stolen data.</p>
<p>Included in the data were my email address and phone number, as well as license plate numbers for four different vehicles we have used over the past decade.</p>
<p>Asked about the sales thread, Atlanta-based ParkMobile said the company <a href="https://support.parkmobile.io/hc/en-us/articles/360058639032-Security-Notification-March-2021" target="_blank" rel="noopener">published a notification on Mar. 26</a> about &#8220;a cybersecurity incident linked to a vulnerability in a third-party software that we use.&#8221;</p>
<p>&#8220;In response, we immediately launched an investigation with the assistance of a leading cybersecurity firm to address the incident,&#8221; the notice reads. &#8220;Out of an abundance of caution, we have also notified the appropriate law enforcement authorities. The investigation is ongoing, and we are limited in the details we can provide at this time.&#8221;</p>
<p>The statement continues: &#8220;Our investigation indicates that no sensitive data or Payment Card Information, which we encrypt, was affected. Meanwhile, we have taken additional precautionary steps since learning of the incident, including eliminating the third-party vulnerability, maintaining our security, and continuing to monitor our systems.&#8221;</p>
<p>Asked for clarification on what the attackers did access, ParkMobile confirmed it included basic account information – license plate numbers, and if provided, email addresses and/or phone numbers, and vehicle nickname.</p>
<p>&#8220;In a small percentage of cases, there may be mailing addresses,&#8221; spokesman Jeff Perkins said.<br />
<span id="more-55199"></span></p>
<p>ParkMobile doesn&#8217;t store user passwords, but rather it stores the output of a fairly robust one-way password hashing algorithm called <a href="https://en.wikipedia.org/wiki/Bcrypt" target="_blank" rel="noopener">bcrypt</a>, which is far more resource-intensive and expensive to crack than common alternatives like MD5. The database stolen from ParkMobile and put up for sale includes each user&#8217;s bcrypt hash.</p>
<p>&#8220;You are correct that bcrypt hashed and salted passwords were obtained,&#8221; Perkins said when asked about the screenshot in the database sales thread.</p>
<p>&#8220;Note, we do not keep the salt values in our system,&#8221; he said. &#8220;Additionally, the compromised data does not include parking history, location history, or any other sensitive information. Note, we do not collect social security numbers or driver’s license numbers from our users.&#8221;</p>
<p>ParkMobile says it is finalizing an update to its support site confirming the conclusion of its investigation. But I wonder how many of its users were even aware of this security incident. The <a href="https://support.parkmobile.io/hc/en-us/articles/360058639032-Security-Notification-March-2021" target="_blank" rel="noopener">Mar. 26 security notice</a> does not appear to be linked to other portions of the ParkMobile site, and it is absent from the company&#8217;s list of recent press releases.</p>
<p>It&#8217;s also curious that ParkMobile hasn&#8217;t asked or forced its users to change their passwords as a precautionary measure. I used the ParkMobile app to reset my password, but there was no messaging in the app that suggested this was a timely thing to do.</p>
<p>So if you&#8217;re a ParkMobile user, changing your account password might be a pro move. If it&#8217;s any consolation, whoever is selling this data is doing so for an insanely high starting price ($125,000) that is unlikely to be paid by any cybercriminal to a new user with no reputation on the forum.</p>
<p>More importantly, if you used your ParkMobile password at any other site tied to the same email address, it&#8217;s time to change those credentials as well (and <a href="https://krebsonsecurity.com/2019/08/forced-password-reset-check-your-assumptions/" target="_blank" rel="noopener">stop re-using passwords</a>).</p>
<p>The breach comes at a tricky time for ParkMobile. On March 9, the European parking group <strong>EasyPark</strong> <a href="https://parkmobile.io/newsroom/easypark-group-announces-intent-to-acquire-parkmobile/" rel="noopener" target="_blank">announced its plans to acquire the company</a>, which operates in more than 450 cities in North America. </p>


feed_id: https://krebsonsecurity.com/?p=55225
title: Microsoft Patch Tuesday, April 2021 Edition
uri: Microsoft-Patch-Tuesday-April-2021-Edition
url: https://krebsonsecurity.com/2021/04/microsoft-patch-tuesday-april-2021-edition/
content:
<p><strong>Microsoft </strong>today released updates to plug at least 110 security holes in its <strong>Windows</strong> operating systems and other products. The patches include four security fixes for <strong>Microsoft Exchange Server</strong> &#8212; the same systems that have been <a href="https://krebsonsecurity.com/?s=microsoft+exchange+attack" target="_blank" rel="noopener">besieged by attacks on four separate (and zero-day) bugs in the email software</a> over the past month. Redmond also patched a Windows flaw that is actively being exploited in the wild.</p>
<p><img loading="lazy" class="aligncenter wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="719" height="528" /></p>
<p>Nineteen of the vulnerabilities fixed this month earned Microsoft&#8217;s most-dire &#8220;Critical&#8221; label, meaning they could be used by malware or malcontents to seize remote control over vulnerable Windows systems without any help from users.</p>
<p>Microsoft released updates to fix four more flaws in Exchange Server versions 2013-2019 (<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-28480" target="_blank" rel="noopener">CVE-2021-28480</a>, <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-28481" target="_blank" rel="noopener">CVE-2021-28481</a>, <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-28482" target="_blank" rel="noopener">CVE-2021-28482</a>, <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-28483" target="_blank" rel="noopener">CVE-2021-28483</a>). Interestingly, all four were reported by the <strong>U.S. National Security Agency</strong>, although Microsoft says it also found two of the bugs internally. A <a href="https://msrc-blog.microsoft.com/2021/04/13/april-2021-update-tuesday-packages-now-available/" target="_blank" rel="noopener">Microsoft blog post</a> published along with today&#8217;s patches urges Exchange Server users to make patching their systems a top priority.</p>
<p><strong>Satnam Narang</strong>, staff research engineer at <strong>Tenable</strong>, said these vulnerabilities have been rated &#8216;Exploitation More Likely&#8217; using Microsoft’s Exploitability Index.</p>
<p>&#8220;Two of the four vulnerabilities (CVE-2021-28480, CVE-2021-28481) are pre-authentication, meaning an attacker does not need to authenticate to the vulnerable Exchange server to exploit the flaw,&#8221; Narang said. &#8220;With the intense interest in Exchange Server since last month, it is crucial that organizations apply these Exchange Server patches immediately.&#8221;</p>
<p>Also patched today was a vulnerability in Windows (<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-28310" target="_blank" rel="noopener">CVE-2021-28310</a>) that&#8217;s being exploited in active attacks already. The flaw allows an attacker to elevate their privileges on a target system.</p>
<p>&#8220;This does mean that they will either need to log on to a system or trick a legitimate user into running the code on their behalf,&#8221; said <strong>Dustin Childs</strong> of <strong>Trend Micro</strong>. &#8220;Considering who is listed as discovering this bug, it is probably being used in malware. Bugs of this nature are typically combined with other bugs, such as browser bug of PDF exploit, to take over a system.&#8221;</p>
<p>In a technical writeup on what they&#8217;ve observed since finding and reporting attacks on CVE-2021-28310, researchers at <strong>Kaspersky Lab</strong> <a href="https://securelist.com/zero-day-vulnerability-in-desktop-window-manager-cve-2021-28310-used-in-the-wild/101898/" target="_blank" rel="noopener">noted</a> the exploit they saw was likely used together with other browser exploits to escape &#8220;sandbox&#8221; protections of the browser.</p>
<p>&#8220;Unfortunately, we weren’t able to capture a full chain, so we don’t know if the exploit is used with another browser zero-day, or coupled with known, patched vulnerabilities,&#8221; Kaspersky&#8217;s researchers wrote.<span id="more-55225"></span></p>
<p><strong>Allan Laska</strong>, senior security architect at <strong>Recorded Future</strong>, notes that there are several remote code execution vulnerabilities in <strong>Microsoft Office</strong> products released this month as well. <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-28454" target="_blank" rel="noopener">CVE-2021-28454</a> and <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-28451" target="_blank" rel="noopener">CVE-2021-28451</a> involve Excel, while <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-28453" target="_blank" rel="noopener">CVE-2021-28453</a> is in <strong>Microsoft Word</strong> and CVE-2021-28449 is in Microsoft Office. All four vulnerabilities are labeled by Microsoft as &#8220;Important&#8221; (not quite as bad as &#8220;Critical&#8221;). These vulnerabilities impact all versions of their respective products, including <strong>Office 365</strong>.</p>
<p>Other Microsoft products that got security updates this month include <strong>Edge</strong> (Chromium-based), <strong>Azure</strong> and <strong>Azure DevOps Server</strong>, <strong>SharePoint Server</strong>, <strong>Hyper-V</strong>, <strong>Team Foundation Server</strong>, and <strong>Visual Studio</strong>.</p>
<p>Separately, <strong>Adobe</strong> has <a href="https://helpx.adobe.com/security.html" target="_blank" rel="noopener">released security updates</a> for <strong>Photoshop</strong>, <strong>Digital Editions</strong>, <strong>RoboHelp</strong>, and <strong>Bridge</strong>.</p>
<p>It’s a good idea for Windows users to get in the habit of updating at least once a month, but for regular users (read: not enterprises) it’s usually safe to wait a few days until after the patches are released, so that Microsoft has time to iron out any kinks in the new armor.</p>
<p>But before you update, <em>please</em> make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates have been known to erase or corrupt files.</p>
<p>So do yourself a favor and backup before installing any patches. Windows 10 even has some <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">see this guide</a>.</p>
<p>As always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips.</p>


feed_id: https://krebsonsecurity.com/?p=55234
title: Did Someone at the Commerce Dept. Find a SolarWinds Backdoor in Aug. 2020?
uri: Did-Someone-at-the-Commerce-Dept-Find-a-SolarWinds-Backdoor-in-Aug-2
url:
https://krebsonsecurity.com/2021/04/did-someone-at-the-commerce-dept-find-a-solarwinds-backdoor-in-aug-2020/

content:
<p>On Aug. 13, 2020, someone uploaded a suspected malicious file to <a href="https://www.virustotal.com" target="_blank" rel="noopener">VirusTotal</a>, a service that scans submitted files against more than five dozen antivirus and security products. Last month, <strong>Microsoft</strong> and <strong>FireEye</strong> identified that file as a newly-discovered fourth malware backdoor used in <a href="https://krebsonsecurity.com/?s=solar+winds+hack" target="_blank" rel="noopener">the sprawling SolarWinds supply chain hack</a>. An analysis of the malicious file and other submissions by the same VirusTotal user suggest the account that initially flagged the backdoor as suspicious belongs to IT personnel at the <strong>National Telecommunications and Information Administration</strong> (NTIA), a division of the <strong>U.S. Commerce Department</strong> that handles telecommunications and Internet policy.</p>
<p><img loading="lazy" class="aligncenter wp-image-55246" src="media/dc4b6535.ntia.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/ntia.png" alt="" width="588" height="584" /></p>
<p>Both Microsoft and FireEye published blog posts on Mar. 4 concerning a new backdoor found on high-value targets that were compromised by the SolarWinds attackers. FireEye refers to the backdoor as &#8220;<a href="https://www.fireeye.com/blog/threat-research/2021/03/sunshuttle-second-stage-backdoor-targeting-us-based-entity.html" target="_blank" rel="noopener">Sunshuttle</a>,&#8221; whereas Microsoft calls it &#8220;<a href="https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/" target="_blank" rel="noopener">GoldMax</a>.&#8221; FireEye <a href="https://www.fireeye.com/blog/threat-research/2021/03/sunshuttle-second-stage-backdoor-targeting-us-based-entity.html" target="_blank" rel="noopener">says</a> the Sunshuttle backdoor was named &#8220;<strong>Lexicon.exe</strong>,&#8221; and had the unique file signatures or &#8220;hashes&#8221; of &#8220;<strong>9466c865f7498a35e4e1a8f48ef1dffd</strong>&#8221; (MD5) and <strong>b9a2c986b6ad1eb4cfb0303baede906936fe96396f3cf490b0984a4798d741d8</strong> (SHA-1).</p>
<p>&#8220;In August 2020, a U.S.-based entity uploaded a new backdoor that we have named SUNSHUTTLE to a public malware repository,&#8221; FireEye wrote.</p>
<div id="attachment_55237" style="width: 778px" class="wp-caption aligncenter"><a href="media/d2ad321c.sunshuttle-vt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/sunshuttle-vt.png"><img aria-describedby="caption-attachment-55237" loading="lazy" class="wp-image-55237" src="media/d2ad321c.sunshuttle-vt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/sunshuttle-vt.png" alt="" width="768" height="485" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/04/sunshuttle-vt.png 1187w, https://krebsonsecurity.com/wp-content/uploads/2021/04/sunshuttle-vt-768x485.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/04/sunshuttle-vt-782x494.png 782w" sizes="(max-width: 768px) 100vw, 768px" /></a><p id="caption-attachment-55237" class="wp-caption-text">The &#8220;Sunshuttle&#8221; or &#8220;GoldMax&#8221; backdoor, as identified by FireEye and Microsoft, respectively. Image: VirusTotal.com.</p></div>
<p>A search in VirusTotal&#8217;s malware repository <a href="https://www.virustotal.com/gui/file/b9a2c986b6ad1eb4cfb0303baede906936fe96396f3cf490b0984a4798d741d8/details" target="_blank" rel="noopener">shows</a> that on Aug. 13, 2020 someone uploaded a file with that same name and file hashes. Premium VirusTotal users can see other files submitted by specific users, and several of those submitted by the same user over nearly two years include messages and files sent to email addresses for people currently working in NTIA&#8217;s information technology department.</p>
<div id="attachment_55241" style="width: 777px" class="wp-caption aligncenter"><a href="media/2483482e.vtntiared.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/vtntiared.png"><img aria-describedby="caption-attachment-55241" loading="lazy" class="wp-image-55241" src="media/2483482e.vtntiared.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/vtntiared.png" alt="" width="767" height="510" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/04/vtntiared.png 1170w, https://krebsonsecurity.com/wp-content/uploads/2021/04/vtntiared-768x511.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/04/vtntiared-782x520.png 782w" sizes="(max-width: 767px) 100vw, 767px" /></a><p id="caption-attachment-55241" class="wp-caption-text">An apparently internal email that got uploaded to VirusTotal in Feb. 2020 by the same account that uploaded the Sunshuttle backdoor malware to VirusTotal in August 2020.</p></div>
<p>The NTIA did not respond to requests for comment. But in December 2020, <em>The Wall Street Journal</em> <a href="https://www.wsj.com/articles/barr-points-finger-at-russia-for-solarwinds-hack-11608573971" target="_blank" rel="noopener">reported</a> that the NTIA was among multiple federal agencies that had email and files plundered by the SolarWinds attackers. &#8220;The hackers broke into about three dozen email accounts since June at the NTIA, including accounts belonging to the agency’s senior leadership, according to a U.S. official familiar with the matter,&#8221; The Journal wrote.</p>
<p>It&#8217;s unclear what, if anything, NTIA&#8217;s IT staff did in response to scanning the backdoor file back in Aug. 2020. But the world would not find out about the SolarWinds debacle until early December 2020, when FireEye first <a href="https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html" target="_blank" rel="noopener">disclosed the extent of its own compromise from the SolarWinds malware</a> and <a href="https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html" target="_blank" rel="noopener">published details about the tools and techniques</a> used by the perpetrators.</p>
<p>The SolarWinds attack involved malicious code being surreptitiously inserted into updates shipped by SolarWinds for some 18,000 users of its <strong>Orion</strong> network management software. Beginning in March 2020, the attackers then used the access afforded by the compromised SolarWinds software to push additional backdoors and tools to targets when they wanted deeper access to email and network communications.<span id="more-55234"></span></p>
<p>U.S. intelligence agencies have attributed the SolarWinds hack to an arm of the Russian state intelligence known as the <a href="https://en.wikipedia.org/wiki/Foreign_Intelligence_Service_(Russia)" target="_blank" rel="noopener">SVR</a>, which also was determined to have been involved in the hacking of the <strong>Democratic National Committee</strong> six years ago. On Thursday, the White House issued <a href="https://www.nytimes.com/2021/04/15/world/europe/us-russia-sanctions.html" target="_blank" rel="noopener">long-expected sanctions</a> against Russia in response to the SolarWinds attack and other malicious cyber activity, leveling economic sanctions against 32 entities and individuals for disinformation efforts and for carrying out the Russian government&#8217;s interference in the 2020 presidential election.</p>
<p><strong>The U.S. Treasury Department</strong> (which also was hit with second-stage malware that let the SolarWinds attackers read Treasury email communications) has <a href="https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20210415" target="_blank" rel="noopener">posted a full list of those targeted</a>, including six Russian companies for providing support to the cyber activities of the Russian intelligence service.</p>
<p>Also on Thursday, the <strong>FBI</strong>, <strong>National Security Agency</strong> (NSA), and the <strong>Cybersecurity Infrastructure Security Administration</strong> (CISA) issued <a href="https://www.fbi.gov/news/pressrel/press-releases/russian-foreign-intelligence-service-exploiting-five-publicly-known-vulnerabilities-to-compromise-us-and-allied-networks" target="_blank" rel="noopener">a joint advisory</a> on several vulnerabilities in widely-used software products that the same Russian intelligence units have been attacking to further their exploits in the SolarWinds hack. Among those is <strong>CVE-2020-4006</strong>, a security hole in <strong>VMWare Workspace One Access</strong> that VMware patched in December 2020 after hearing about it from the NSA.</p>
<p>On December 18, VMWare saw its stock price <a href="https://www.barrons.com/articles/vmware-stock-falls-as-report-links-its-software-to-solarwinds-hack-51608327990" target="_blank" rel="noopener">dip 5.5 percent</a> after KrebsOnSecurity <a href="https://krebsonsecurity.com/2020/12/vmware-flaw-a-vector-in-solarwinds-breach/" target="_blank" rel="noopener">published a report</a> linking the flaw to NSA reports about the Russian cyberspies behind the SolarWinds attack. At the time, VMWare was saying it had received &#8220;no notification or indication that CVE-2020-4006 was used in conjunction with the SolarWinds supply chain compromise.&#8221; As a result, a number of readers responded that making this connection was tenuous, circumstantial and speculative.</p>
<p>But the joint advisory makes clear the VMWare flaw was in fact used by SolarWinds attackers to further their exploits.</p>
<p>&#8220;Recent Russian SVR activities include compromising SolarWinds Orion software updates, targeting COVID-19 research facilities through deploying WellMess malware, and leveraging a VMware vulnerability that was a zero-day at the time for follow-on Security Assertion Markup Language (SAML) authentication abuse,&#8221; the <a href="media/c5a6c751.CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF" data-original-source="https://media.defense.gov/2021/Apr/15/2002621240/-1/-1/0/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF" target="_blank" rel="noopener">NSA&#8217;s advisory</a> (PDF) reads. &#8220;SVR cyber actors also used authentication abuse tactics following SolarWinds-based breaches.&#8221;</p>
<p>Officials within the Biden administration have told media outlets that a portion of the United States&#8217; response to the SolarWinds hack would not be discussed publicly. But some security experts are concerned that Russian intelligence officials may still have access to networks that ran the backdoored SolarWinds software, and that the Russians could use that access to affect a destructive or disruptive network response of their own, <em>The New York Times</em> reports.</p>
<p>&#8220;Inside American intelligence agencies, there have been warnings that the SolarWinds attack — which enabled the SVR to place &#8216;back doors&#8217; in the computer networks — could give Russia a pathway for malicious activity against government agencies and corporations,&#8221; The Times observed.</p>


feed_id: https://krebsonsecurity.com/?p=55197
title: Note to Self: Create Non-Exhaustive List of Competitors
uri: Note-to-Self-Create-Non-Exhaustive-List-of-Competitors
url: https://krebsonsecurity.com/2021/04/note-to-self-create-non-exhaustive-list-of-competitors/
content:
<p>What was the best news you heard so far this month? Mine was learning that KrebsOnSecurity is listed as a restricted competitor by <strong>Gartner Inc.</strong> [<a href="https://www.marketwatch.com/investing/stock/it" target="_blank" rel="noopener">NYSE:IT</a>] &#8212; a $4 billion technology goliath whose analyst reports can move markets and shape the IT industry.</p>
<p>Earlier this month, a reader pointed my attention to the following notice from Gartner to clients who are seeking to promote Gartner reports about technology products and services:</p>
<p><a href="media/464b6752.gartner.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/gartner.png"><img loading="lazy" class="aligncenter wp-image-55275" src="media/464b6752.gartner.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/gartner.png" alt="" width="768" height="589" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/04/gartner.png 1023w, https://krebsonsecurity.com/wp-content/uploads/2021/04/gartner-768x589.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/04/gartner-782x600.png 782w" sizes="(max-width: 768px) 100vw, 768px" /></a></p>
<p>What that notice says is that KrebsOnSecurity is somehow on Gartner&#8217;s &#8220;non exhaustive list of competitors,&#8221; i.e., online venues where technology companies are not allowed to promote Gartner reports about their products and services.</p>
<p>The bulk of Gartner&#8217;s revenue comes from subscription-based IT market research. As the largest organization dedicated to the analysis of software, Gartner&#8217;s network of analysts are well connected to the technology and software industries. Some <a href="https://www.brightworkresearch.com/best-understand-gartners-business-model/" target="_blank" rel="noopener">have argued</a> that Gartner is a kind of private social network, in that a significant portion of Gartner&#8217;s competitive position is based on its interaction with an extensive network of software vendors and buyers.</p>
<p>Either way, the company regularly serves as a virtual kingmaker with their trademark &#8220;<a href="https://en.wikipedia.org/wiki/Magic_Quadrant" target="_blank" rel="noopener">Magic Quandrant</a>&#8221; designations, which rate technology vendors and industries &#8220;based on proprietary <a title="Qualitative research" href="https://en.wikipedia.org/wiki/Qualitative_research" data-ss1618934228="1">qualitative</a> <a title="Data analysis" href="https://en.wikipedia.org/wiki/Data_analysis" data-ss1618934228="1">data analysis</a> methods to demonstrate market trends, such as direction, maturity and participants.&#8221;</p>
<p>The two main subjective criteria upon which Gartner bases those rankings are &#8220;the ability to execute&#8221; and &#8220;completeness of vision.&#8221; They also break companies out into categories such as &#8220;challengers,&#8221; &#8220;leaders,&#8221; &#8220;visionaries&#8221; and &#8220;niche players.&#8221;</p>
<div id="attachment_55273" style="width: 746px" class="wp-caption aligncenter"><a href="media/66a8999b.gmq.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/gmq.png"><img aria-describedby="caption-attachment-55273" loading="lazy" class="wp-image-55273" src="media/66a8999b.gmq.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/gmq.png" alt="" width="736" height="779" /></a><p id="caption-attachment-55273" class="wp-caption-text">Gartner&#8217;s 2020 &#8220;Magic Quadrant&#8221; for companies that provide &#8220;contact center as a service&#8221; offerings.</p></div>
<p>So when Gartner issues a public report forecasting that worldwide semiconductor revenue will fall, or that worldwide public cloud revenue will grow, those reports very often move markets.</p>
<p>Being listed by Gartner as a competitor has had no discernable financial impact on KrebsOnSecurity, or on its reporting. But I find this designation both flattering and remarkable given that this site seldom promotes technological solutions.<span id="more-55197"></span></p>
<p>Nor have I ever offered paid consulting or custom market research (although I did give <a href="https://www.wsj.com/articles/BL-CIOB-8148" target="_blank" rel="noopener">a paid keynote speech at Gartner&#8217;s 2015 conference in Orlando</a>, which is still by far the largest crowd I&#8217;ve ever addressed).</p>
<p>Rather, KrebsOnSecurity has sought to spread cybersecurity awareness primarily by highlighting the &#8220;who&#8221; of cybercrime &#8212; stories told from the perspectives of both attackers and victims. What&#8217;s more, my research and content is available to everyone at the same time, and for free.</p>
<p>I rarely do market predictions (or prognostications of any kind), but in deference to Gartner allow me to posit a scenario in which major analyst firms start to become a less exclusive and perhaps less relevant voice as both an influencer and social network.</p>
<p>For years I have tried to <a href="https://www.youtube.com/watch?v=hDrFgbLu8UE" target="_blank" rel="noopener">corrupt more of my journalist colleagues into going it alone,</a> noting that solo blogs and newsletters can not only provide a hefty boost from newsroom income, but they also can produce journalism that is just as timely, relevant and impactful.</p>
<p>Those enticements have mostly fallen on deaf ears. Recently, however, an increasing number of journalists from major publications have struck out on their own, some in reportorial roles, others as professional researchers and analysts in their own right.</p>
<p>If Gartner considers a one-man blogging operation as competition, I wonder what they&#8217;ll think of the coming collective output from an entire industry of newly emancipated reporters seeking more remuneration and freedom offered by independent publishing platforms like <a href="https://www.nytimes.com/2021/04/11/business/media/substack-newsletter-competition.html" target="_blank" rel="noopener">Substack,</a> <a href="https://www.howtogeek.com/675800/what-is-patreon-and-how-does-it-work/" target="_blank" rel="noopener">Patreon</a> and <a href="https://medium.com/about" target="_blank" rel="noopener">Medium</a>.</p>
<p>Oh, I doubt any group of independent journalists would seek to promulgate their own Non-Exclusive List of Competitors at Whom Thou Shalt Not Publish. But why should they? One&#8217;s ability to execute does not impair another&#8217;s completeness of vision, nor vice versa. According to Gartner, it takes all kinds, including visionaries, niche players, leaders and challengers.</p>


feed_id: https://krebsonsecurity.com/?p=55329
title: Experian’s Credit Freeze Security is Still a Joke
uri: Experian-s-Credit-Freeze-Security-is-Still-a-Joke
url: https://krebsonsecurity.com/2021/04/experians-credit-freeze-security-is-still-a-joke/
content:
<p>In 2017, KrebsOnSecurity showed how easy it is for identity thieves to <a href="https://krebsonsecurity.com/2017/09/experian-site-can-give-anyone-your-credit-freeze-pin/" target="_blank" rel="noopener">undo a consumer&#8217;s request to freeze their credit file at <strong>Experian</strong></a>, one of the big three consumer credit bureaus in the United States.  Last week, KrebsOnSecurity heard from a reader who had his freeze thawed without authorization through Experian&#8217;s website, and it reminded me of how truly broken authentication and security remains in the credit bureau space.</p>
<div id="attachment_40829" style="width: 775px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-40829" loading="lazy" class=" wp-image-40829" src="media/02d42073.experianunfreeze.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/09/experianunfreeze.png" alt="" width="765" height="675" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/09/experianunfreeze.png 1450w, https://krebsonsecurity.com/wp-content/uploads/2017/09/experianunfreeze-580x511.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/09/experianunfreeze-768x677.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/09/experianunfreeze-940x828.png 940w" sizes="(max-width: 765px) 100vw, 765px" /><p id="caption-attachment-40829" class="wp-caption-text">Experian&#8217;s page for retrieving someone&#8217;s credit freeze PIN requires little more information than has already been leaked by big-three bureau Equifax and a myriad other breaches.</p></div>
<p><strong>Dune Thomas</strong> is a software engineer from Sacramento, Calif. who put a freeze on his credit files last year at Experian, <strong>Equifax</strong> and <strong>TransUnion</strong> after thieves tried to open multiple new payment accounts in his name using an address in Washington state that was tied to a vacant home for sale.</p>
<p>But the crooks were persistent: Earlier this month, someone unfroze Thomas&#8217; account at Experian and promptly applied for new lines of credit in his name, again using the same Washington street address. Thomas said he only learned about the activity because he&#8217;d taken advantage of a free credit monitoring service offered by his credit card company.</p>
<p>Thomas said after several days on the phone with Experian, a company representative acknowledged that someone had used the <a href="https://www.experian.com/ncaconline/freezepin" target="_blank" rel="noopener">&#8220;request your PIN&#8221; feature</a> on Experian&#8217;s site to obtain his PIN and then unfreeze his file.</p>
<p>Thomas said he and a friend both walked through the process of recovering their freeze PIN at Experian, and were surprised to find that just one of the five multiple-guess questions they were asked after entering their address, Social Security Number and date of birth had anything to do with information only the credit bureau might know.</p>
<p>KrebsOnSecurity stepped through the same process and found similar results. The first question asked about a new mortgage I supposedly took out in 2019 (I didn&#8217;t), and the answer was none of the above. The answer to the second question also was none of the above.</p>
<p>The next two questions were useless for authentication purposes because they&#8217;d already been asked and answered; one was &#8220;which of the following is the last four digits of your SSN,&#8221; and the other was &#8220;I was born within a year or on the year of the date below.&#8221; Only one question mattered and was relevant to my credit history (it concerned the last four digits of a checking account number).</p>
<p>The best part about this lax authentication process is that <em>one can enter any email address to retrieve the PIN</em> &#8212; it doesn&#8217;t need to be tied to an existing account at Equifax. Also, when the PIN is retrieved, Equifax doesn&#8217;t bother notifying any other email addresses already on file for that consumer.</p>
<p>Finally, your basic consumer (read: free) account at Experian does not give users the option to enable any sort of multi-factor authentication that might help stymie some of these PIN retrieval attacks on credit freezes.</p>
<p>Unless, that is, you subscribe to Experian&#8217;s heavily-marketed and confusingly-worded &#8220;<strong>CreditLock</strong>&#8221; service, which charges between $14.99 and $24.99 a month for the ability to &#8220;lock and unlock your file easily and quickly, without delaying the application process.&#8221; CreditLock users can both enable multifactor authentication and get alerts when someone tries to access their account.</p>
<p>Thomas said he&#8217;s furious that Experian only provides added account security for consumer who pay for monthly plans.</p>
<p>&#8220;Experian had the ability to give people way better protection through added authentication of some kind, but instead they don&#8217;t because they can charge $25 a month for it,&#8221; Thomas said. &#8220;They&#8217;re allowing this huge security gap so they can make a profit. And this has been going on for at least four years.&#8221;</p>
<p>Experian has not yet responded to requests for comment.</p>
<p>When a consumer with a freeze logs in to Experian&#8217;s site, they are immediately directed to a message for one of Experian&#8217;s paid services, such as its CreditLock service. The message I saw upon logging in confirmed that while I had a freeze in place with Experian, my current &#8220;protection level&#8221; was &#8220;low&#8221; because my credit file was unlocked.</p>
<p>&#8220;When your file is unlocked, you&#8217;re more vulnerable to identity theft and fraud,&#8221; Experian warns, untruthfully. &#8220;You won&#8217;t see alerts if someone tries to access your file. Banks can check your file if you apply for credit or loans. Utility and service providers can see your credit file.&#8221;</p>
<div id="attachment_55333" style="width: 776px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55333" loading="lazy" class=" wp-image-55333" src="media/79bb164b.experianprotection.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/experianprotection.png" alt="" width="766" height="316" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/04/experianprotection.png 1125w, https://krebsonsecurity.com/wp-content/uploads/2021/04/experianprotection-768x317.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/04/experianprotection-782x323.png 782w" sizes="(max-width: 766px) 100vw, 766px" /><p id="caption-attachment-55333" class="wp-caption-text">Experian says my security is low because while I have a freeze in place, I haven&#8217;t bought into their questionable &#8220;lock service.&#8221;</p></div>
<p>Sounds scary, right? The thing is &#8212; except for the part about not seeing alerts &#8212; none of the above statement is true if you already have a freeze on your file. A security freeze essentially blocks any potential creditors from being able to view your credit file, unless you affirmatively unfreeze or thaw your file beforehand.<span id="more-55329"></span></p>
<p>With a freeze in place on your credit file, ID thieves can apply for credit in your name all they want, but they will not succeed in getting new lines of credit in your name because few if any creditors will extend that credit without first being able to gauge how risky it is to loan to you (i.e., view your credit file). It is now free to freeze your credit in all U.S. states and territories.</p>
<p>Experian, like the other consumer credit bureaus, uses their intentionally confusing &#8220;lock&#8221; terminology to frighten consumers into paying for monthly subscription services. A key selling point for these lock services is they can be a faster way to let creditors peek at your file when you wish to apply for new credit. That may or may not be true in practice, but consider why it&#8217;s so important for Experian to get consumers to sign up for their lock programs.</p>
<p>The real reason is that Experian makes money every time someone makes a credit inquiry in your name, and it does not want to do anything to hinder those inquiries. Signing up for a lock service lets Experian continue selling credit report information to a variety of third parties. According to Experian&#8217;s FAQ, when locked your Experian credit file remains accessible to a host of companies, including:</p>
<p>-Potential employers or insurance companies</p>
<p>-Collection agencies acting on behalf of companies you may owe</p>
<p>-Companies providing pre-screened credit card offers</p>
<p>-Companies that have an existing credit relationship with you (this is true for frozen files also)</p>
<p>-Personalized offers from Experian, if you choose to receive them</p>
<p>It is annoying that Experian can get away with offering additional account security only to people who pay the company a hefty sum each month to sell their information. It&#8217;s also amazing that this sloppy security I wrote about back in 2017 is still just as prevalent in 2021.</p>
<p>But Experian is hardly alone. In 2019, I wrote about how Equifax&#8217;s new MyEquifax site <a href="https://krebsonsecurity.com/2019/03/myequifax-com-bypasses-credit-freeze-pin/" target="_blank" rel="noopener">made it simple for thieves to lift an existing credit freeze at Equifax</a> and bypass the PIN if they were armed with just your name, Social Security number and birthday.</p>
<p>Also in 2019, identity thieves were able to get a copy of my credit report from TransUnion after successfully guessing the answers to multiple-guess questions like the ones Experian asks. I only found out after hearing from a detective in Washington state, who informed me that a copy of the report was found on a removable drive seized from a local man who was arrested on suspicion of being part of an ID theft gang.</p>
<p>TransUnion investigated and found it was indeed at fault for giving my credit report to ID thieves, but that on the bright side its systems blocked another fraudulent attempt at getting my report in 2020.</p>
<p>&#8220;In our investigation, we determined that a similar attempt to fraudulently obtain your report occurred in April 2020, and was successfully blocked by enhanced controls <span class="il">TransUnion</span> has implemented since last year,&#8221; the company said. &#8220;<span class="il">TransUnion</span> deploys a multi-layered security program to combat the ongoing and increasing threat of fraud, cyber-attacks and malicious activity.  In today’s dynamic threat environment, <span class="il">TransUnion</span> is constantly enhancing and refining our controls to address the latest security threats, while still allowing consumers access to their information.&#8221;</p>
<p>For more information on credit freezes (also called a &#8220;security freezes&#8221;), how to request one, and other tips on preventing identity fraud, check out <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener">this story</a>.</p>
<p>If you haven’t done so lately, it might be a good time to order a free copy of your credit report from <a href="https://www.annualcreditreport.com" target="_blank" rel="noopener">annualcreditreport.com</a>. This service entitles each consumer one free copy of their credit report annually from each of the three credit bureaus — either all at once or spread out over the year.</p>


feed_id: https://krebsonsecurity.com/?p=55295
title: Experian API Exposed Credit Scores of Most Americans
uri: Experian-API-Exposed-Credit-Scores-of-Most-Americans
url: https://krebsonsecurity.com/2021/04/experian-api-exposed-credit-scores-of-most-americans/
content:
<p>Big-three consumer credit bureau <strong>Experian</strong> just fixed a weakness with a partner website that let anyone look up the credit score of tens of millions of Americans just by supplying their name and mailing address, KrebsOnSecurity has learned. Experian says it has plugged the data leak, but the researcher who reported the finding says he fears the same weakness may be present at countless other lending websites that work with the credit bureau.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-55370" src="media/c5c3373b.exp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/exp.png" alt="" width="760" height="399" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/04/exp.png 760w, https://krebsonsecurity.com/wp-content/uploads/2021/04/exp-267x140.png 267w" sizes="(max-width: 760px) 100vw, 760px" /></p>
<p><strong>Bill Demirkapi</strong>, an independent security researcher who&#8217;s currently a sophomore at the <strong>Rochester Institute of Technology</strong>, said he discovered the data exposure while shopping around for student loan vendors online.</p>
<p>Demirkapi encountered one lender&#8217;s site that offered to check his loan eligibility by entering his name, address and date of birth. Peering at the code behind this lookup page, he was able to see it invoked an Experian <strong>Application Programming Interface</strong> or API &#8212; a capability that allows lenders to automate queries for <a href="https://en.wikipedia.org/wiki/FICO" target="_blank" rel="noopener">FICO credit scores</a> from the credit bureau.</p>
<p>&#8220;No one should be able to perform an Experian credit check with only publicly available information,&#8221; Demirkapi said. &#8220;Experian should mandate non-public information for promotional inquiries, otherwise an attacker who found a single vulnerability in a vendor could easily abuse Experian&#8217;s system.&#8221;</p>
<p>Demirkapi found the Experian API could be accessed directly without any sort of authentication, and that entering all zeros in the &#8220;date of birth&#8221; field let him then pull a person&#8217;s credit score. He even built a handy command-line tool to automate the lookups, which he dubbed &#8220;Bill&#8217;s Cool Credit Score Lookup Utility.&#8221;</p>
<div id="attachment_55376" style="width: 778px" class="wp-caption aligncenter"><a href="media/0a284c28.tool.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/tool.png"><img aria-describedby="caption-attachment-55376" loading="lazy" class="wp-image-55376" src="media/0a284c28.tool.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/tool.png" alt="" width="768" height="156" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/04/tool.png 1132w, https://krebsonsecurity.com/wp-content/uploads/2021/04/tool-768x156.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/04/tool-782x159.png 782w" sizes="(max-width: 768px) 100vw, 768px" /></a><p id="caption-attachment-55376" class="wp-caption-text">Demirkapi’s Experian credit score lookup tool.</p></div>
<p>KrebsOnSecurity put that tool to the test, asking permission from a friend to have Demirkapi look up their credit score. The friend agreed and said he would pull his score from Experian (at this point I hadn&#8217;t told him that Experian was involved). The score he provided matched the score returned by Demirkapi&#8217;s lookup tool.</p>
<p>In addition to credit scores, the Experian API returns for each consumer up to four &#8220;risk factors,&#8221; indicators that might help explain why a person&#8217;s score is not higher.</p>
<p>For example, in my friend&#8217;s case Bill&#8217;s tool said his mid-700s score could be better if the proportion of balances to credit limits was lower, and if he didn&#8217;t owe so much on revolving credit accounts.</p>
<p>&#8220;Too many consumer finance company accounts,&#8221; the API concluded about my friend&#8217;s score.</p>
<p>The reason I could not test Demirkapi&#8217;s findings on my own credit score is that we have <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener">a security freeze on our files at the three major consumer credit reporting bureaus</a>, and a freeze blocks this particular API from pulling the information.<span id="more-55295"></span></p>
<p>Demirkapi declined to share with Experian the name of the lender or the website where the API was exposed. He refused because he said he suspects there may be hundreds or even thousands of companies using the same API, and that many of those lenders could be similarly leaking access to Experian&#8217;s consumer data.</p>
<p>&#8220;If we let them know about the specific endpoint, they can just ban/work with the loan vendor to block these requests on this one case, which doesn&#8217;t fix the systemic problem,&#8221; he explained.</p>
<p>Nevertheless, after being contacted by this reporter Experian figured out on its own which lender was exposing their API; Demirkapi said that vendor&#8217;s site now indicates the API access has been disabled.</p>
<p>&#8220;We have been able to confirm a single instance of where this situation has occurred and have taken steps to alert our partner and resolve the matter,&#8221; Experian said in a written statement. &#8220;While the situation did not implicate or compromise any of Experian’s systems, we take this matter very seriously. Data security has always been, and always will be, our highest priority.&#8221;</p>
<p>Demirkapi said he&#8217;s disappointed that Experian did exactly what he feared they would do.</p>
<p>&#8220;They found one endpoint I was using and sent it into maintenance mode,&#8221; he said. &#8220;But this doesn&#8217;t address the systemic issue at all.&#8221;</p>
<p>Leaky and poorly-secured APIs like the one Demirkapi found are the source of much mischief in the hands of identity thieves. Earlier this month, auto insurance giant <strong>Geico</strong> <a href="https://threatpost.com/geico-alerts-hackers-stole-driver-license-data/165493/" target="_blank" rel="noopener">disclosed</a> that fraudsters abused a bug in its site <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener">to steal drivers license numbers from Americans</a>.</p>
<p>Geico said the data was used by thieves involved in <a href="https://krebsonsecurity.com/?s=unemployment+insurance" target="_blank" rel="noopener">fraudulently applying for unemployment insurance benefits</a>. Many states now require drivers license numbers as a way of verifying an applicant&#8217;s identity.</p>
<p>In 2013, KrebsOnSecurity <a href="https://krebsonsecurity.com/?s=experian+id+theft+service" target="_blank" rel="noopener">broke the news</a> about an identity theft service in the underground that programmatically pulled sensitive consumer credit data directly from a subsidiary of Experian. That service was run by a Vietnamese hacker who&#8217;d told the Experian subsidiary he was a private investigator. The <strong>U.S. Secret Service</strong> later said the ID theft service &#8220;<a href="https://krebsonsecurity.com/2020/08/confessions-of-an-id-theft-kingpin-part-i/" target="_blank" rel="noopener">caused more material financial harm to more Americans than any other</a>.&#8221;</p>
<p>Additional reading: <a href="https://krebsonsecurity.com/2021/04/experians-credit-freeze-security-is-still-a-joke/" target="_blank" rel="noopener">Experian&#8217;s Credit Freeze Security is Still a Joke</a> (Apr. 27, 2021)</p>


feed_id: https://krebsonsecurity.com/?p=55321
title: Task Force Seeks to Disrupt Ransomware Payments
uri: Task-Force-Seeks-to-Disrupt-Ransomware-Payments
url: https://krebsonsecurity.com/2021/04/task-force-seeks-to-disrupt-ransomware-payments/
content:
<p>Some of the world&#8217;s top tech firms are backing a new industry task force focused on disrupting cybercriminal ransomware gangs by limiting their ability to get paid, and targeting the individuals and finances of the organized thieves behind these crimes.</p>
<p><img loading="lazy" class="aligncenter wp-image-53514" src="media/0df06f89.ransomware.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware.png" alt="" width="774" height="580" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware.png 1016w, https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware-768x575.png 768w" sizes="(max-width: 774px) 100vw, 774px" /></p>
<p>In a 50-page report delivered to the Biden administration this week, top executives from <strong>Amazon</strong>, <strong>Cisco</strong>, <strong>FireEye</strong>, <strong>McAfee</strong>, <strong>Microsoft</strong> and dozens of other firms joined the <strong>U.S. Department of Justice</strong> (DOJ), <strong>Europol</strong> and the <strong>U.K. National Crime Agency</strong> in calling for an international coalition to combat ransomware criminals, and for a global network of ransomware investigation hubs.</p>
<p>The Ransomware Task Force urged the White House to make finding, frustrating and apprehending ransomware crooks a priority within the U.S. intelligence community, and to designate the current scourge of digital extortion as a national security threat.</p>
<p>The formation of the industry partnership comes just days after <em>The Wall Street Journal</em> <a href="https://www.wsj.com/articles/ransomware-targeted-by-new-justice-department-task-force-11619014158" target="_blank" rel="noopener">broke the news</a> that the DOJ was forming its own task force to deal with the &#8220;root causes&#8221; of ransomware. An internal DOJ memo reportedly &#8220;calls for developing a strategy that targets the entire criminal ecosystem around ransomware, including prosecutions, disruptions of ongoing attacks and curbs on services that support the attacks, such as online forums that advertise the sale of ransomware or hosting services that facilitate ransomware campaigns.&#8221;</p>
<p>According to security firm <a href="https://www.emsisoft.com" target="_blank" rel="noopener">Emsisoft</a>, almost 2,400 U.S.-based governments, healthcare facilities and schools were victims of ransomware in 2020.</p>
<p>&#8220;The costs of ransomware go far beyond the ransom payments themselves,&#8221; the task force report observes. &#8220;Cybercrime is typically seen as a white-collar crime, but while ransomware is profit-driven and &#8216;non-violent&#8217; in the traditional sense, that has not stopped ransomware attackers from routinely imperiling lives.&#8221;</p>
<div id="attachment_55382" style="width: 826px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55382" loading="lazy" class="size-full wp-image-55382" src="media/1c501c7f.rtf-framework.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/rtf-framework.png" alt="" width="816" height="512" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/04/rtf-framework.png 816w, https://krebsonsecurity.com/wp-content/uploads/2021/04/rtf-framework-768x482.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/04/rtf-framework-782x491.png 782w" sizes="(max-width: 816px) 100vw, 816px" /><p id="caption-attachment-55382" class="wp-caption-text">A proposed framework for a public-private operational ransomware campaign. Image: IST.</p></div>
<p>It is difficult to gauge the true cost and size of the ransomware problem because many victims never come forward to report the crimes. As such, a number of the task force&#8217;s recommendations focus on ways to encourage more victims to report the crimes to their national authorities, such as requiring victims and incident response firms who pay a ransomware demand to report the matter to law enforcement and possibly regulators at the <strong>U.S. Treasury Department</strong>.</p>
<p>Last year, <a href="https://krebsonsecurity.com/2020/10/ransomware-victims-that-pay-up-could-incur-steep-fines-from-uncle-sam/" target="_blank" rel="noopener">Treasury issued a controversial memo</a> warning that ransomware victims who end up sending digital payments to people already being sanctioned by the U.S. government for money laundering and other illegal activities could result in hefty fines.</p>
<p><strong>Philip Reiner</strong>, executive director of the <a href="https://securityandtechnology.org/" target="_blank" rel="noopener">Institute for Security and Technology</a>, said the reporting recommendations are one of several areas where federal agencies will likely need to dedicate more employees. For example, he said, expecting victims to clear ransomware payments with the Treasury Department first assumes the agency has the staff to respond in any kind of timeframe that might be useful for a victim undergoing a ransomware attack.</p>
<p>&#8220;That&#8217;s why we were so dead set in putting forward comprehensive framework,&#8221; Reiner said. &#8220;That way, Department of Homeland Security can do what they need to do, the State Department, Treasury gets involved, and it all needs to be synchronized for going after the bad guys with the same alacrity.&#8221;<span id="more-55321"></span></p>
<p>Some have argued that making it illegal to pay a ransom is one way to decrease the number of victims who acquiesce to their tormentors&#8217; demands. But the task force report says we&#8217;re nowhere near ready for that yet.</p>
<p>&#8220;Ransomware attackers require little risk or effort to launch attacks, so a prohibition on ransom payments would not necessarily lead them to move into other areas,&#8221; the report observes. &#8220;Rather, they would likely continue to mount attacks and test the resolve of both victim organizations and their regulatory authorities. To apply additional pressure, they would target organizations considered more essential to society, such as healthcare providers, local governments, and other custodians of critical infrastructure.&#8221;</p>
<p>&#8220;As such, any intent to prohibit payments must first consider how to build organizational cybersecurity maturity, and how to provide an appropriate backstop to enable organizations to weather the initial period of extreme testing,&#8221; the authors concluded in the report. &#8220;Ideally, such an approach would also be coordinated internationally to avoid giving ransomware attackers other avenues to pursue.&#8221;</p>
<p>The task force&#8217;s report comes as federal agencies have been under increased pressure to respond to a series of ransomware attacks that were mass-deployed as attackers began <a href="https://krebsonsecurity.com/?s=exchange+server+attack" target="_blank" rel="noopener">exploiting four zero-day vulnerabilities in Microsoft Exchange Server email products to install malicious backdoors</a>. Earlier this month, the DOJ <a href="https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-effort-disrupt-exploitation-microsoft-exchange" target="_blank" rel="noopener">announced</a> the FBI had conducted a first-of-its-kind operation to remove those backdoors from hundreds of Exchange servers at state and local government facilities.</p>
<p>Many of the recommendations in the Ransomware Task Force report are what you might expect, such as encouraging voluntary information sharing on ransomware attacks; launching public awareness campaigns on ransomware threats; exerting pressure on countries that operate as safe havens for ransomware operators; and incentivizing the adoption of security best practices through tax breaks.</p>
<p>A few of the more interesting recommendations (at least to me) included:</p>
<p>-Limit legal liability for ISPs that act in good faith trying to help clients secure their systems.</p>
<p>-Create a federal &#8220;cyber response and recovery fund&#8221; to help state and local governments or critical infrastructure companies respond to ransomware attacks.</p>
<p>-Require cryptocurrency exchanges to follow the same &#8220;know your customer&#8221; (KYC) and anti-money laundering rules as financial institutions, and aggressively targeting exchanges that do not.</p>
<p>-Have insurance companies measure and assert their aggregated ransomware losses and establish a common “war chest” <a href="https://www.investopedia.com/terms/s/subrogation.asp" target="_blank" rel="noopener">subrogation fund</a> &#8220;to evaluate and pursue strategies aimed at restitution, recovery, or civil asset seizures, on behalf of victims and in conjunction with law enforcement efforts.&#8221;</p>
<p>-Centralize expertise in cryptocurrency seizure, and scaling criminal seizure processes.</p>
<p>-Create a standard format for reporting ransomware incidents.</p>
<p>-Establish a ransomware incident response network.</p>


feed_id: https://krebsonsecurity.com/?p=54793
title: The Wages of Password Re-use: Your Money or Your Life
uri: The-Wages-of-Password-Re-use-Your-Money-or-Your-Life
url: https://krebsonsecurity.com/2021/05/the-wages-of-password-re-use-your-money-or-your-life/
content:
<p>When normal computer users fall into the nasty habit of recycling passwords, the result is most often some type of financial loss. When cybercriminals develop the same habit, it can eventually cost them their freedom.</p>
<p><img loading="lazy" class="aligncenter wp-image-55426" src="media/f8ea2294.moneylife.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/moneylife.png" alt="" width="767" height="525" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/05/moneylife.png 988w, https://krebsonsecurity.com/wp-content/uploads/2021/05/moneylife-768x525.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/05/moneylife-782x535.png 782w" sizes="(max-width: 767px) 100vw, 767px" /></p>
<p>Our passwords can say a lot about us, and much of what they have to say is unflattering. In a world in which all databases &#8212; including hacker forums &#8212; are eventually compromised and leaked online, it can be tough for cybercriminals to maintain their anonymity if they&#8217;re in the habit of re-using the same unusual passwords across multiple accounts associated with different email addresses.</p>
<p>The long-running <a href="https://krebsonsecurity.com/?s=breadcrumbs" target="_blank" rel="noopener">Breadcrumbs series here</a> tracks how cybercriminals get caught, and it&#8217;s mostly through odd connections between their online and offline selves scattered across the Internet. Interestingly, one of the more common connections involves re-using or recycling passwords across multiple accounts.</p>
<p>And yes, hackers get their passwords compromised at the same rate as the rest of us. Which means when a cybercrime forum gets hacked and its user databases posted online, it is often possible to work backwards from some of the more unique passwords for each account and see where else that password was used.<span id="more-54793"></span></p>
<p><H2>SWATTING THE FLY</H2></p>
<p>Of all the stories I&#8217;ve written here over the last 11 years, probably the piece I get asked most to recount is the one about <strong>Sergey &#8220;Fly&#8221; Vovnenko</strong>, a Ukrainian man who in 2013 <a href="https://krebsonsecurity.com/2013/07/mail-from-the-velvet-cybercrime-underground/" target="_blank" rel="noopener">hatched and executed a plan to buy heroin off the dark web</a>, ship it to our house and then spoof a call to the police from one of our neighbors saying we were dealing drugs.</p>
<p>Fly was the administrator of a Russian-language identity theft forum at the time, and as a secret lurker on his forum KrebsOnSecurity watched his plan unfold in real time. As I described in <a href="https://krebsonsecurity.com/2019/09/interview-with-the-guy-who-tried-to-frame-me-for-heroin-possession/" target="_blank" rel="noopener">a 2019 story about an interview Fly gave to a Russian publication</a> upon his release from a U.S. prison, his propensity for password re-use ultimately landed him in Italy&#8217;s worst prison for more than a year before he was extradited to face charges in America.</p>
<p>Around the same time Fly was taking bitcoin donations for a fund to purchase heroin on my behalf, he was also engaged to be married to a young woman. But Fly apparently did not fully trust his bride-to-be, so he had malware installed on her system that forwarded him copies of all email that she sent and received.</p>
<p>But Fly would make at least two big operational security mistakes in this spying effort: First, he had his fiancée’s messages forwarded to an email account he’d used for plenty of cybercriminal stuff related to his various “Fly” identities.</p>
<p>Mistake number two was the password for his email account was the same as his cybercrime forum admin account. And unbeknownst to him at the time, that forum was hacked, with all email addresses and hashed passwords exposed.</p>
<p>Soon enough, investigators were reading Fly’s email, including the messages forwarded from his wife’s account that had details about their upcoming nuptials, such as shipping addresses for their wedding-related items and the full name of Fly’s fiancée. It didn’t take long <a href="https://krebsonsecurity.com/2014/06/the-fly-has-been-swatted/" target="_blank" rel="noopener">to zero in on Fly’s location in Naples</a>.</p>
<p><H2>POOR PASSWORDS AS GOOD OPSEC?</H2></p>
<p>While it may sound unlikely that a guy so enmeshed in the cybercrime space could make such rookie security mistakes, I have found that a great many cybercriminals actually have worse operational security than the average Internet user.</p>
<p>Countless times over the years I&#8217;ve encountered huge tranches of valuable, dangerous data &#8212; like a botnet control panel or admin credentials for cybercrime forums &#8212; that were full of bad passwords, like password1 or 123qweasd (an incredibly common keyboard pattern password).</p>
<p>I suspect this may be because the nature of illicit activity online requires cybercrooks to create vast numbers of single- or brief-use accounts, and as such they tend to re-use credentials across multiple sites, or else pick very poor passwords — even for critical resources.</p>
<p>Regardless of their reasons or lack thereof for choosing poor passwords, it is fascinating that in terms of maintaining one&#8217;s operational security it actually benefits cybercriminals to use poor passwords in many situations.</p>
<p>For example, it is often the denizens of the cybercrime underground who pick crappy passwords for their forum accounts who end up doing their future selves a favor when the forum eventually gets hacked and its user database is posted online.</p>
<p><H2>SOME ADVICE FOR EVERYONE</H2></p>
<p>It really stinks that it&#8217;s mid-2021 and we&#8217;re still so reliant on passwords. But as long as that&#8217;s the case, I hope it&#8217;s clear that the smartest choice for all Internet users is to pick unique passwords for every site. The major Web browsers will now auto-suggest long, complex and unique passwords when users go to set up a new account somewhere online, and this is obviously the simplest way to achieve that goal.</p>
<p>Password managers are ideal for people who can&#8217;t break the habit of re-using passwords, because you only have to remember one (strong) master password to access all of your stored credentials.</p>
<p>If you don&#8217;t trust password managers and have trouble remembering complex passwords, consider relying instead on password length, which is a far more important determiner of whether a given password can be cracked by available tools in any timeframe that might be reasonably useful to an attacker.</p>
<p>In that vein, it’s safer and wiser to focus on picking passphrases instead of passwords. Passphrases are collections of multiple (ideally unrelated) words mushed together. Passphrases are not only generally more secure, they also have the added benefit of being easier to remember. Their main limitation is that countless sites still force you to add </p>
<p>Finally, there’s absolutely nothing wrong with writing down your passwords, provided a) you do not store them in a file on your computer or taped to your laptop, and b) that your password notebook is stored somewhere relatively secure, i.e. not in your purse or car, but something like a locked drawer or safe.</p>
<p>Further reading: <a href="https://krebsonsecurity.com/2019/07/whos-behind-the-gandcrab-ransomware/" target="_blank" rel="noopener">Who&#8217;s Behind the GandCrab Ransomware?</a></p>


feed_id: https://krebsonsecurity.com/?p=55441
title: Malicious Office 365 Apps Are the Ultimate Insiders
uri: Malicious-Office-365-Apps-Are-the-Ultimate-Insiders
url: https://krebsonsecurity.com/2021/05/malicious-office-365-apps-are-the-ultimate-insiders/
content:
<p>Phishers targeting <strong>Microsoft Office 365</strong> users increasingly are turning to specialized links that take users to their organization&#8217;s own email login page. After a user logs in, the link prompts them to install a malicious but innocuously-named app that gives the attacker persistent, password-free access to any of the user&#8217;s emails and files, both of which are then plundered to launch malware and phishing scams against others.</p>
<p>These attacks begin with an emailed link that when clicked loads not a phishing site but the user&#8217;s actual Office 365 login page &#8212; whether that be at microsoft.com or their employer&#8217;s domain. After logging in, the user might see a prompt that looks something like this:</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-55445" src="media/44252a85.permissionsrequested.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/permissionsrequested.png" alt="" width="537" height="638" /></p>
<p>These malicious apps allow attackers to bypass multi-factor authentication, because they are approved by the user after that user has already logged in. Also, the apps will persist in a user&#8217;s Office 365 account indefinitely until removed, and will survive even after an account password reset.</p>
<p>This week, messaging security vendor <strong>Proofpoint</strong> <a href="https://www.proofpoint.com/us/blog/email-and-cloud-threats/how-attackers-use-compromised-accounts-create-and-distribute-malicious" target="_blank" rel="noopener">published some new data</a> on the rise of these malicious Office 365 apps, noting that a high percentage of Office users will fall for this scheme [full disclosure: Proofpoint is an advertiser on this website].</p>
<p><strong>Ryan Kalember</strong>, Proofpoint&#8217;s executive vice president of cybersecurity strategy, said 55 percent of the company&#8217;s customers have faced these malicious app attacks at one point or another.</p>
<p>&#8220;Of those who got attacked, about 22 percent &#8212; or one in five &#8212; were successfully compromised,&#8221; Kalember said.</p>
<p>Kalember said Microsoft last year sought to limit the spread of these malicious Office apps by creating an app publisher verification system, which requires the publisher to be a valid Microsoft Partner Network member.</p>
<p>That approval process is cumbersome for attackers, so they&#8217;ve devised a simple work around. &#8220;Now, they’re compromising accounts in credible tenants first,&#8221; Proofpoint explains. &#8220;Then, they&#8217;re creating, hosting and spreading cloud malware from within.&#8221;<span id="more-55441"></span></p>
<p>The attackers responsible for deploying these malicious Office apps aren&#8217;t after passwords, and in this scenario they can&#8217;t even see them. Rather, they&#8217;re hoping that after logging in users will click yes to a approve the installation of a malicious but innocuously-named app into their Office365 account.</p>
<p>Kalember said the crooks behind these malicious apps typically use any compromised email accounts to conduct &#8220;business email compromise&#8221; or BEC fraud, which involves spoofing an email from someone in authority at an organization and requesting the payment of a fictitious invoice. Other uses have included the sending of malware-laced emails from the victim&#8217;s email account.</p>
<p>Last year, Proofpoint wrote about a service in the cybercriminal underground where customers could access various Office 365 accounts without a username or password. The service also advertised the ability to extract and filter emails and files based on selected keywords, as well as attach malicious macros to all documents in a user&#8217;s Microsoft OneDrive.</p>
<div id="attachment_55448" style="width: 661px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55448" loading="lazy" class="size-full wp-image-55448" src="media/95acfe88.officeappservice.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/officeappservice.png" alt="" width="651" height="715" /><p id="caption-attachment-55448" class="wp-caption-text">A cybercriminal service advertising the sale of access to hacked Office365 accounts. Image: Proofpoint.</p></div>
<p>&#8220;You don&#8217;t need a botnet if you have Office 365, and you don&#8217;t need malware if you have these [malicious] apps,&#8221; Kalember said. &#8220;It&#8217;s just easier, and it&#8217;s a good way to bypass multi-factor authentication.&#8221;</p>
<p>KrebsOnSecurity <a href="https://krebsonsecurity.com/2020/01/tricky-phish-angles-for-persistence-not-passwords/" target="_blank" rel="noopener">first warned about this trend in January 2020</a>. That story cited Microsoft saying that while organizations running Office 365 could restrict users from installing apps, doing so was a &#8220;drastic step&#8221; that &#8220;severely impairs your users&#8217; ability to be productive with third-party applications.&#8221;</p>
<p>Since then, Microsoft added a policy that allows Office 365 administrators to block users from consenting to an application from a non-verified publisher. Also, applications published after November 8, 2020, are coupled with a consent screen warning in case the publisher is not verified, and the tenant policy allows the consent.</p>
<p>Proofpoint says O365 administrators should limit or block which non-administrators can create applications, and enable Microsoft&#8217;s verified publisher policy &#8212; as a majority of cloud malware is still coming from Office 365 tenants that are not part of Microsoft&#8217;s partner network.</p>


feed_id: https://krebsonsecurity.com/?p=55201
title: Investment Scammer John Davies Reinvents Himself?
uri: Investment-Scammer-John-Davies-Reinvents-Himself
url: https://krebsonsecurity.com/2021/05/investment-scammer-john-davies-reinvents-himself/
content:
<p><strong>John Bernard</strong>, a pseudonym used by a convicted thief and con artist named <strong>John Clifton Davies</strong> who’s fleeced dozens of technology startups out of an estimated $30 million, appears to have reinvented himself again after being exposed in a recent investigative series published here. Sources tell KrebsOnSecurity that Davies/Bernard is now posing as <strong>John Cavendish</strong> and head of a new &#8220;private office&#8221; called <strong>Hempton Business Management LLP</strong>.</p>
<p><img loading="lazy" class="aligncenter wp-image-52977" src="media/7aaab735.investmoney.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/investmoney.png" alt="" width="767" height="546" /></p>
<p>John Davies is a U.K. man who absconded from justice before being convicted on multiple counts of fraud in 2015. Prior to his conviction, Davies served 16 months in jail before <a href="https://www.bbc.com/news/uk-wales-21850549" target="_blank" rel="noopener">being cleared of murdering his wife on their honeymoon in India</a>.</p>
<p>Davies&#8217; fraud convictions stemmed from a series of U.K. companies he set up supposedly to help troubled companies reorganize their debt and turn things around. Davies ended up looting what little money his clients had left and spending it on lavish cars, home furnishings, vacations and luxury watches.</p>
<p>In <a href="https://krebsonsecurity.com/?s=john+bernard" target="_blank" rel="noopener">a three-part series published last year</a>, KrebsOnSecurity exposed how Davies &#8212; wanted by authorities in the U.K. &#8212; had fled the country, taken on the surname Bernard, remarried, and moved to his new (and fourth) wife&#8217;s hometown in Ukraine.</p>
<div id="attachment_53032" style="width: 771px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53032" loading="lazy" class=" wp-image-53032" src="media/c95e44e6.Bernard-sbs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/Bernard-sbs.png" alt="" width="761" height="403" /><p id="caption-attachment-53032" class="wp-caption-text">The scam artist John Bernard (left) in a recent Zoom call, and a photo of John Clifton Davies from 2015.</p></div>
<p>After eluding justice in the U.K., Davies reinvented himself as <strong>The Private Office of John Bernard</strong>, pretending to be a billionaire Swiss investor who made his fortunes in the dot-com boom 20 years ago and who was seeking private equity investment opportunities.</p>
<p>In case after case, Bernard would promise to invest millions in hi-tech startups, only to insist that companies pay tens of thousands of dollars worth of due diligence fees up front. However, the due diligence company he insisted on using — another Swiss firm called <strong>Inside Knowledge</strong> — also was secretly owned by Bernard, who would invariably pull out of the deal after receiving the due diligence money.</p>
<p>Bernard found a constant stream of new marks by offering extraordinarily generous finders fees to investment brokers who could introduce him to companies seeking an infusion of cash. Inside Knowledge and The Private Office both closed up shop not long after their exploits were detailed here late last year.</p>
<p>But it appears Davies has just assumed a new name. KrebsOnSecurity recently heard from an investment broker who previously represented multiple clients that got fleeced by Mr. Bernard/Davies over the years. That broker said he was blown away to hear Davies&#8217; unique British accent on a recent call with a client that had been in investment talks with a Northern Ireland firm called <strong>Hempton Business Management</strong>.</p>
<p>This time, the source said, Davies was introduced by handlers on the call as <strong>John Cavendish</strong>.</p>
<p>&#8220;I just sat in on a call and John’s voice is unmistakable,&#8221; said the broker, who asked to remain anonymous. &#8220;He stumbled on the beginning of the call trying to remember which last name he was supposed to use. Immediately they go back to the standard script about the types of deals they are looking for. They want to be minority investors in private transactions and they are industry agnostic.  Their deal sizes are investments in the $5-20 million range, they prefer to not use big 4 firms for due diligence, and they have some smaller firms they use which are better suited for smaller investment deals.&#8221;</p>
<p><a href="media/79c4f4a8.hempton.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/hempton.png"><img loading="lazy" class="aligncenter wp-image-55304" src="media/79c4f4a8.hempton.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/hempton.png" alt="" width="762" height="330" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/04/hempton.png 1433w, https://krebsonsecurity.com/wp-content/uploads/2021/04/hempton-768x332.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/04/hempton-782x338.png 782w" sizes="(max-width: 762px) 100vw, 762px" /></a></p>
<p>The source forwarded me some correspondence from Hempton Business Management, and I noticed it was sent from a <strong>Mariya Kulykova</strong>. This is interesting because Mr. Bernard&#8217;s personal assistant in Ukraine was a <strong>Mariya Kulikova</strong> (Ms. Kulikova deleted Bernard&#8217;s former companies from her LinkedIn profile shortly after last year&#8217;s series).</p>
<p>The company&#8217;s website says Hempton has been around since 2017, but the domain name was only registered in late November 2020. There is no information about who runs or owns the company on its site.</p>
<p><strong> Hemptonllp[.]com</strong> was registered via <a href="https://en.wikipedia.org/wiki/Gandi" target="_blank" rel="noopener">Gandi</a>, the same French registrar John Bernard/Davies has used over the years with his dozens of phantom companies.</p>
<p>Hempton Business Management&#8217;s only presence on LinkedIn appears to be a help wanted ad from a few weeks ago, for <a href="https://www.linkedin.com/jobs/view/marketing-specialist-at-hempton-business-management-llp-2477130915/?originalSubdomain=ua" target="_blank" rel="noopener">a marketing position at an office in Kyiv, Ukraine</a>.</p>
<p>In response to an emailed request for comment on the apparent connections, Mr. Cavendish forwarded the message to a <strong>James Donohoe</strong>, who replied that he was the owner of Hempton. Donohoe said the domain was new because the company recently re-branded, although he declined to discuss the matter further.</p>
<p>&#8220;This sounds like an accusation of a big fraud?,&#8221; Donohoe wrote. &#8220;I have never had any dealings with a John Clifton Davies or John Bernard. You really are a cheeky little bugger aren&#8217;t you!&#8221;</p>
<p>Mr. Donohoe did not respond to further requests for comment.<span id="more-55201"></span></p>
<p>Hempton appears to be part of a network of corporate facades designed to lead any investigators into a labyrinth of entities that exist only on paper. Hempton is what&#8217;s known as a &#8220;<a href="https://en.wikipedia.org/wiki/Shelf_corporation#:~:text=A%20shelf%20corporation%2C%20shelf%20company,shelf%22%20to%20%22age%22." target="_blank" rel="noopener">shelf corporation,</a>&#8221; an aged or seasoned company that was formed but never used as a business. Shelf corporations are registered solely for the purposes of being resold to others at a later date. Simply put, their resale allows new enterprises to appear older, more established, and trusted.</p>
<p>&#8220;Perhaps the leading reason for acquiring an aged entity in general is credibility,&#8221; explains <a href="https://www.tba-associates.com/new-zealand-company-formation" target="_blank" rel="noopener">TBA &amp; Associates</a>, a company co-registered in the UK and New Zealand that has created <a href="media/5f0ae32f.LIST-OF-AVAILABLE-SHELF-AGED-COMPANIES.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/LIST-OF-AVAILABLE-SHELF-AGED-COMPANIES.pdf" target="_blank" rel="noopener">hundreds of shelf companies for sale</a> (PDF), including Hempton Business Management LLP in 2017.</p>
<p>&#8220;Business relationships are frequently influenced by the length of time a company has been in existence,&#8221; TBA continues. &#8220;This is often true when establishing financial and client/vendor relationships.&#8221;</p>
<div id="attachment_55303" style="width: 777px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55303" loading="lazy" class=" wp-image-55303" src="media/b729f0d5.tbaa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/tbaa.png" alt="" width="767" height="583" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/04/tbaa.png 939w, https://krebsonsecurity.com/wp-content/uploads/2021/04/tbaa-768x584.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/04/tbaa-782x595.png 782w" sizes="(max-width: 767px) 100vw, 767px" /><p id="caption-attachment-55303" class="wp-caption-text">Some of the shelf companies created and sold by TBA &amp; Associates.</p></div>
<p>Documents from the UK business record index <a href="https://find-and-update.company-information.service.gov.uk/company/NC001412/officers" target="_blank" rel="noopener">Companies House</a> show two entities as officers in Hempton: <a href="https://find-and-update.company-information.service.gov.uk/officers/V4B9jqYTDG5dVtfYBif4Y3MCBHw/appointments" target="_blank" rel="noopener">ABA Group &amp; Associates LTD</a>, and <a href="https://find-and-update.company-information.service.gov.uk/officers/467Vq4Br0cC14AjvWYP4uc3WVL8/appointments" target="_blank" rel="noopener">Harper &amp; Partners Ltd</a>. Both of these are shelf companies in Hong Kong that are listed for sale in <a href="media/5f0ae32f.LIST-OF-AVAILABLE-SHELF-AGED-COMPANIES.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/LIST-OF-AVAILABLE-SHELF-AGED-COMPANIES.pdf" target="_blank" rel="noopener">the same TBA PDF advertisement linked for Hempton</a>.</p>
<p>Searching Companies House for information on ABA Group and Harper &amp; Partners leads to a dizzying number of other shelf companies in Hong Kong, Belize and the U.K. &#8212; all of which also were recently listed for sale by TBA.</p>
<p>The only person&#8217;s name attached to each of these companies is a <a href="media/d68018fc.PS300038466316_02.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/PS300038466316_02.pdf" target="_blank" rel="noopener"><strong>Joaquim Magro de Almeida</strong></a>, a rather mysterious 72 year-old Portuguese business consultant. <strong>OpenCorporates</strong> says this same guy is <a href="https://opencorporates.com/officers?utf8=%E2%9C%93&amp;q=JOAQUIM+MAGRO+DE+ALMEIDA&amp;commit=Go&amp;utf8=%E2%9C%93&amp;commit=Go&amp;action=search_officers&amp;controller=searches&amp;inactive=false&amp;search_fields%5B%5D=name&amp;search_fields%5B%5D=address" target="_blank" rel="noopener">an officer in 313 active companies</a>. The U.K.&#8217;s Companies House lists Mr. Almeida as one of three officers in <a href="https://find-and-update.company-information.service.gov.uk/company/08266670/officers" target="_blank" rel="noopener">Euro Forex Investments Ltd.</a>, which <strong>Reuters</strong> says <a href="https://www.reuters.com/article/us-china-investment-eurofx-specialreport/special-report-how-british-firms-built-a-pyramid-scheme-in-china-that-lost-millions-idUSKCN10N0WE" target="_blank" rel="noopener">was a sprawling pyramid scheme</a> that stole $1 billion from at least 3,700 victims in China, the United States and elsewhere.</p>
<p><a href="https://www.interest.co.nz/business/91250/misuse-nz-companies-part-iii-backdoor-access-uk-classic-cross-jurisdictional" target="_blank" rel="noopener">This 2017 story from New Zealand financial news site interest.co.nz</a> follows a trail of various other investment scams leading back to TBA shell companies, and to Mr. Almeida, too.</p>
<p>In <a href="https://krebsonsecurity.com/2020/09/due-diligence-that-money-cant-buy/" target="_blank" rel="noopener">my first report on John Davies</a>, I noted that before becoming John Bernard he previously used the pseudonym &#8220;<strong>Jonathan Bibi</strong>&#8221; with an address in the offshore company haven of Seychelles. That identity was tied to a number of fraudulent cryptocurrency and binary options investment schemes.</p>
<p>Fraudsters are drawn to complexity, and they typically incorporate their shell or shelf companies in countries with little to no oversight or background checks tied to the creation and maintenance of corporate entities. As we&#8217;ve seen here, the U.K. is a favorite of fraudsters and money launderers worldwide. In a scathing 2017 report titled <a href="media/8407df1e.HidingInPlainSight_WEB3.pdf" data-original-source="https://www.transparency.org.uk/sites/default/files/pdf/publications/HidingInPlainSight_WEB3.pdf" target="_blank" rel="noopener">Hiding in Plain Sight</a> (PDF), <strong>Transparency International</strong> found some 766 UK corporate vehicles were alleged to have been used in 52 large-scale corruption and money laundering cases approaching £80 billion.</p>


feed_id: https://krebsonsecurity.com/?p=55411
title: Fintech Startup Offers $500 for Payroll Passwords
uri: Fintech-Startup-Offers-500-for-Payroll-Passwords
url: https://krebsonsecurity.com/2021/05/fintech-startup-offers-500-for-payroll-passwords/
content:
<p>How much is your payroll data worth? Probably a lot more than you think. One financial startup that&#8217;s targeting the gig worker market is offering up to $500 to anyone willing to hand over the payroll account username and password given to them by their employer, plus a regular payment for each month afterwards in which those credentials still work.</p>
<div id="attachment_55470" style="width: 774px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55470" loading="lazy" class=" wp-image-55470" src="media/d820300e.workersunite.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/workersunite.png" alt="" width="764" height="327" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/05/workersunite.png 1835w, https://krebsonsecurity.com/wp-content/uploads/2021/05/workersunite-768x329.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/05/workersunite-1536x657.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2021/05/workersunite-782x335.png 782w" sizes="(max-width: 764px) 100vw, 764px" /><p id="caption-attachment-55470" class="wp-caption-text">This ad, from workplaceunited[.]com, promised up to $500 for people who provided their payroll passwords, plus $25 a month for each month those credentials kept working.</p></div>
<p>New York-based <strong>Argyle.com</strong> says it&#8217;s building a platform where people who work multiple jobs and/or side hustles can improve their credit and employment options by pooling all of their gig work data in one place.</p>
<p>&#8220;Consumers’ access to financial security and upward mobility is dependent on their access to and control over their own employment records and how easily they can share those records with financial institutions,&#8221; Argyle explained in <a href="https://argyle.com/blog/democratizing-data" target="_blank" rel="noopener">a May 3 blog post</a>. &#8220;We enable access to a dataset that, for too long, has gone unstandardized, unregulated, and controlled by corporations instead of consumers, contributing to system-wide inequalities.&#8221;</p>
<div id="attachment_55508" style="width: 790px" class="wp-caption aligncenter"><a href="media/4b3ef3dd.argyle-howworks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/argyle-howworks.png"><img aria-describedby="caption-attachment-55508" loading="lazy" class="wp-image-55508" src="media/4b3ef3dd.argyle-howworks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/argyle-howworks.png" alt="" width="780" height="487" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/05/argyle-howworks.png 1348w, https://krebsonsecurity.com/wp-content/uploads/2021/05/argyle-howworks-768x479.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/05/argyle-howworks-782x488.png 782w" sizes="(max-width: 780px) 100vw, 780px" /></a><p id="caption-attachment-55508" class="wp-caption-text">Argyle&#8217;s app flow. Image: Argyle.com.</p></div>
<p>In that sense, Argyle is making a play for a discrete chunk of a much larger employment data market dominated by the major credit bureaus, which have been hoovering up and selling access to employment data for years.</p>
<p>The 800-lb. gorilla there is <strong>Equifax</strong>, whose <a href="https://krebsonsecurity.com/tag/the-work-number/" target="_blank" rel="noopener">The Work Number product</a> has for years purchased employment data flows from some of the world&#8217;s largest companies (employees consent to this sharing as part of their employment contract, and The Work Number <a href="https://krebsonsecurity.com/2017/10/equifax-breach-fallout-your-salary-history/" target="_blank" rel="noopener">makes it fairly easy for anyone to learn how much you earn</a>).</p>
<p>The Work Number is designed to provide automated employment and income verification for prospective employers, and tens of thousands of companies report employee salary data to it. It also allows anyone whose employer uses the service to provide proof of their income when purchasing a home or applying for a loan.</p>
<p>On its blog, Argyle imagines a world in which companies choose to integrate its application platform interface (API) and share their employee payroll data. At the same time, the company appears to be part of an effort in which non-salaried workers are prompted to repay their erstwhile employers&#8217; trust by selling payroll credentials.</p>
<p>If Argyle is worried these two goals might somehow conflict, that is not obvious by looking at some of its direct-to-consumer efforts.</p>
<p>The website pictured below prompts visitors to &#8220;connect payroll,&#8221; and those who proceed agree to have their payroll data shared with a company called <a href="https://www.earnin.com" target="_blank" rel="noopener">Earnin</a>, a mobile payday loan app that lets users get an advance on their upcoming paycheck.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-55478" src="media/61b1cdc5.earnin1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/earnin1.png" alt="" width="564" height="284" /></p>
<p>Clicking &#8220;Connect Payroll&#8221; brings up a list of payroll login pages for brand name companies, including <strong>Walmart</strong>, <strong>Starbucks</strong>, <strong>Amazon</strong>, <strong>Uber</strong>, <strong>Chipotle</strong>, etc., with a search feature that reveals login pages for everyone from the <strong>Federal Bureau of Investigation</strong> (FBI) to the <strong>Federal Reserve</strong> and <strong>Federal Trade Commission</strong> (FTC).</p>
<div id="attachment_55472" style="width: 724px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55472" loading="lazy" class=" wp-image-55472" src="media/91642145.earnin-companies.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/earnin-companies.png" alt="" width="714" height="715" /><p id="caption-attachment-55472" class="wp-caption-text">The default Argyle list of payroll login pages for major companies.</p></div>
<p>Here&#8217;s what comes up when you search by &#8220;Department of&#8221; at this site:</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-55480" src="media/9591fd45.argyle-department.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/argyle-department.png" alt="" width="358" height="592" /></p>
<p>Drilling down into individual companies listed here produces a username and password form that in some cases is modified to request an employee identifier other than a username, such as a employee ID, associate or partner number instead. Here&#8217;s the login page for Starbucks employees:</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-55474" src="media/d61034ac.argyle-starbucks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/argyle-starbucks.png" alt="" width="547" height="572" /></p>
<p>The site pictured above actively checks if any submitted credentials are working, by submitting them directly to the employer in question. <a href="https://status.argyle.io/" target="_blank" rel="noopener">This Argyle status page</a> indicates the system&#8217;s &#8220;data connection status&#8221; to countless employers.</p>
<p>Some of you may be thinking, &#8220;How many of us actually know or have our payroll passwords?&#8221; According to Argyle, plenty of people do.</p>
<p>&#8220;At Argyle, we are intimately familiar with how likely someone is to know the password for their employment account or payroll system, because we&#8217;ve seen hundreds of thousands of users successfully (and unsuccessfully) provide their credentials,&#8221; Argyle&#8217;s <strong>Billy Mardsen</strong> <a href="https://argyle.com/blog/payroll-passwords" target="_blank" rel="noopener">wrote on Apr. 1</a>. &#8220;We closely monitor their success rate—what we call <i>conversion</i>—because it drives the performance of the products and applications that our clients build on top of Argyle.&#8221;</p>
<p><div id="attachment_55510" style="width: 532px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55510" loading="lazy" class="size-full wp-image-55510" src="media/9dc925a1.argyleconversion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/argyleconversion.png" alt="" width="522" height="676" /><p id="caption-attachment-55510" class="wp-caption-text">Argyle&#8217;s &#8220;conversion&#8221; numbers by employer. Image: Argyle.com</p></div><span id="more-55411"></span></p>
<h2>UNCOMMON GROUNDS</h2>
<p>KrebsOnSecurity first heard about this company via Twitter from security researcher <a href="https://twitter.com/gossithedog?lang=en" target="_blank" rel="noopener">Kevin Beaumont</a>, who pointed to <a href="media/f544f339.workers-argyleapi.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/workers-argyleapi.png" target="_blank" rel="noopener">a nest of domains associated with Argyle&#8217;s API</a> &#8212; nearly all of which are offline now. At the time, Beaumont and others digging into this suspected the sites were part of an elaborate phishing scam.</p>
<p>These sites, which seemed to be grouped around a recent recruitment effort variously called &#8220;<a href="https://web.archive.org/web/20201217225930/https://www.workersunited.site/?acid=040bca6d-f6a0-42d2-820b-9f1513f8dd0e&amp;utm_source=adcritter&amp;utm_medium=programmatic" target="_blank" rel="noopener">Workers United</a>,&#8221; &#8220;<a href="https://urlscan.io/result/27779535-a54f-4c4b-bdf1-c51bb401a43c/#indicators" target="_blank" rel="noopener">UniteAtWork</a>,&#8221; &#8220;<a href="https://urlscan.io/result/5620cb7d-5d46-4bac-8048-fb5587c70e71/" target="_blank" rel="noopener">WageCompete</a>&#8221; and &#8220;<a href="https://urlscan.io/result/2b13a2b0-4fba-4af3-8b2f-5e7451ba9a95/#summary" target="_blank" rel="noopener">CommonGrounds</a>,&#8221; indicate that Argyle&#8217;s platform has been pivotal in a slew of campaigns paying employees at specific companies up to $100 for their payroll account passwords. Here&#8217;s one seeking <strong>T-Mobile</strong> employees:</p>
<div id="attachment_55469" style="width: 742px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55469" loading="lazy" class=" wp-image-55469" src="media/0808ba87.common-tmobile.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/common-tmobile.png" alt="" width="732" height="831" /><p id="caption-attachment-55469" class="wp-caption-text">A promotion offering T-Mobile employees $100 to give up their T-Mobile payroll account passwords.</p></div>
<p>Another recent promotion targeted employees at <strong>J.P. Morgan Chase</strong>, the largest financial institution in the United States:</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-55493" src="media/4e2943ba.JPMC.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/JPMC.png" alt="" width="620" height="746" /></p>
<p>Argyle declined multiple interview requests for this story, so it&#8217;s not clear how much of a role &#8212; if any &#8212; the company may have played in these various sites. But <a href="https://github.com/Argyle-Prebuilds/wage-compete" target="_blank" rel="noopener">code prebuilds and instructions published in the company&#8217;s name on Github</a> strongly suggest Argyle was instrumental in <a href="https://urlscan.io/result/5620cb7d-5d46-4bac-8048-fb5587c70e71/" target="_blank" rel="noopener">the WageCompete initiative</a>.</p>
<p>Also, <a href="https://www.scopeinc.com/packages/argyle-wage-compete" target="_blank" rel="noopener">this page over at Scopeinc.com</a> says the WageCompete program is provided by Argyle Expert Services.</p>
<p>Here&#8217;s a graphical look at the various websites mentioned here and their ties to Argyle&#8217;s API (click to enlarge):</p>
<div id="attachment_55492" style="width: 766px" class="wp-caption aligncenter"><a href="media/f544f339.workers-argyleapi.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/workers-argyleapi.png"><img aria-describedby="caption-attachment-55492" loading="lazy" class="wp-image-55492" src="media/f544f339.workers-argyleapi.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/workers-argyleapi.png" alt="" width="756" height="513" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/05/workers-argyleapi.png 1352w, https://krebsonsecurity.com/wp-content/uploads/2021/05/workers-argyleapi-768x521.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/05/workers-argyleapi-782x531.png 782w" sizes="(max-width: 756px) 100vw, 756px" /></a><p id="caption-attachment-55492" class="wp-caption-text">The network of sites paying people for payroll passwords and their connections to Argyle&#8217;s API. Click to enlarge. Image: Virustotal</p></div>
<p>One of the sites in that graphic above that&#8217;s connected to Argyle&#8217;s API &#8212; <strong>workerresearchalliances[.]com</strong> &#8212; is currently live and includes the same verbiage about participants getting paid for their payroll credentials. The terms and conditions of the &#8220;WorkersApp beta program&#8221; were set by a company called <strong>Workers Research Alliances LLC</strong>, <a href="https://www.nycompanyregistry.com/companies/worker-research-alliances-llc/" target="_blank" rel="noopener">incorporated in February</a>. The address for Workers Research Alliances is <a href="https://www.google.com/maps/dir/33+Irving+Place,+New+York,+NY/33+W+19th+St+%231004,+New+York,+NY+10011/@40.7381085,-73.9921037,1288m/data=!3m1!1e3!4m15!4m14!1m5!1m1!1s0x89c2599f450ace29:0xcc9ef4cf79798e7c!2m2!1d-73.9881983!2d40.735083!1m5!1m1!1s0x89c259a316d72a57:0x27591d40f347a380!2m2!1d-73.9929501!2d40.7400139!3e0!5i1" target="_blank" rel="noopener">just a few blocks from Argyle&#8217;s office in New York City</a>.</p>
<h2>&#8216;WE DO THINGS OTHERS DARE NOT DO&#8217;</h2>
<p><strong>Steve Friedl</strong>, an IT consultant in the payroll service bureau industry, said it appears Argyle has been paying people to help them refine their API and data scraping technology. </p>
<p>&#8220;They are not paying this money just to be able to sell people services, they are doing so to maintain their screen-scraping software API,&#8221; Friedl said. &#8220;This is essentially paying employees to help Argyle hack their payroll provider.&#8221;</p>
<p>Last fall Argyle <a href="https://argyle.com/blog/why-argyle-raised-a-20m-series-a" target="_blank" rel="noopener">announced</a> it had landed a $20 million investment from <a href="https://en.wikipedia.org/wiki/Bain_Capital" target="_blank" rel="noopener">Bain Capital</a>, among others. The company&#8217;s co-founder, <strong>Shmulik Fishman</strong>, is <a href="https://medium.com/authority-magazine/meet-the-disruptors-shmulik-fishman-of-argyle-on-the-three-things-you-need-to-shake-up-your-b94c37ac566f" target="_blank" rel="noopener">described</a> as a &#8220;disruptor&#8221; who says he wants to make credit scores obsolete.</p>
<p>&#8220;We’re fearless,&#8221; Fishman told <strong>Authority Magazine</strong>. &#8220;We do things other people dare not do.&#8221;</p>
<p>That much is clear. Hey, I can get behind almost anything that disintermediates the creaky old credit bureaus in a straightforward and consumer-friendly way. And the last time I checked, it&#8217;s not against the law to give someone your password, or to induce someone to do so willingly in exchange for something else (unless maybe you work for a federal agency).</p>
<p>But I wonder how many of the companies listed on all these payroll connect sites will respond to knowing their brands and logos are associated with a site that asks their employees to give away passwords.</p>
<p>KrebsOnSecurity contacted multiple high-level sources at major companies whose login pages are shown in these payroll connect programs running on Argyle&#8217;s platform. None of those sources were authorized to talk to the media, but all seemed fairly horrified at what they were seeing, and each said their employer&#8217;s legal departments were launching their own investigations.</p>
<p>Beaumont said he&#8217;s worried that in some companies, an employee&#8217;s payroll credentials may work to gain access to other parts of the organization &#8212; meaning some employees may be giving away more than they realize.</p>
<p>&#8220;My concern is some companies use single sign-on for payroll,&#8221; Beaumont said. &#8220;That’s a lot of access for a data harvesting company.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=55529
title: A Closer Look at the DarkSide Ransomware Gang
uri: A-Closer-Look-at-the-DarkSide-Ransomware-Gang
url: https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
content:
<p>The <strong>FBI</strong> <a href="https://www.fbi.gov/news/pressrel/press-releases/fbi-statement-on-network-disruption-at-colonial-pipeline" target="_blank" rel="noopener">confirmed</a> this week that a relatively new ransomware group known as <strong>DarkSide</strong> is responsible for an attack that caused <strong>Colonial Pipeline</strong> <a href="https://www.nytimes.com/2021/05/08/us/politics/cyberattack-colonial-pipeline.html" target="_blank" rel="noopener">to shut down 5,550 miles of pipe</a>, stranding countless barrels of gasoline, diesel and jet fuel on the Gulf Coast. Here&#8217;s a closer look at the DarkSide cybercrime gang, as seen through their negotiations with a recent U.S. victim that earns $15 billion in annual revenue.</p>
<div id="attachment_55553" style="width: 743px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55553" loading="lazy" class="size-full wp-image-55553" src="media/78f91412.colonialpipe.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/colonialpipe.png" alt="" width="733" height="569" /><p id="caption-attachment-55553" class="wp-caption-text">Colonial Pipeline has shut down 5,500 miles of fuel pipe in response to a ransomware incident. Image: colpipe.com</p></div>
<p>New York City-based cyber intelligence firm <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a> said its analysts assess with a moderate-strong degree of confidence that the attack was not intended to damage national infrastructure and was simply associated with a target which had the finances to support a large payment.</p>
<p>&#8220;This would be consistent with DarkSide’s earlier activities, which included several &#8216;big game hunting&#8217; attacks, whereby attackers target an organization that likely possesses the financial means to pay the ransom demanded by the attackers,&#8221; Flashpoint observed.</p>
<p>In response to public attention to the Colonial Pipeline attack, the DarkSide group sought to play down fears about widespread infrastructure attacks going forward.</p>
<p>&#8220;We are apolitical, we do not participate in geopolitics, do not need to tie us with a defined government and look for other our motives [sic],&#8221; reads an update to the DarkSide Leaks blog. &#8220;Our goal is to make money, and not creating problems for society. From today we introduce moderation and check each company that our partners want to encrypt to avoid social consequences in the future.&#8221;</p>
<p>First surfacing on Russian language hacking forums in August 2020, DarkSide is a ransomware-as-a-service platform that vetted cybercriminals can use to infect companies with ransomware and carry out negotiations and payments with victims. DarkSide says it targets only big companies, and forbids affiliates from dropping ransomware on organizations in several industries, including healthcare, funeral services, education, public sector and non-profits.</p>
<p>Like other ransomware platforms, DarkSide adheres to the current badguy best practice of double extortion, which involves demanding separate sums for both a digital key needed to unlock any files and servers, and a separate ransom in exchange for promise to destroy any data stolen from the victim.</p>
<p>At its launch, DarkSide sought to woo affiliates from competing ransomware programs by advertising a victim data leak site that gets &#8220;stable visits and media coverage,&#8221; as well as the ability to publish victim data by stages. Under the &#8220;Why choose us?&#8221; heading of the ransomware program thread, the admin answers:</p>
<div id="attachment_55536" style="width: 963px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55536" loading="lazy" class="size-full wp-image-55536" src="media/97d3475c.ds-start.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-start.png" alt="" width="953" height="712" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-start.png 953w, https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-start-768x574.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-start-782x584.png 782w" sizes="(max-width: 953px) 100vw, 953px" /><p id="caption-attachment-55536" class="wp-caption-text">An advertisement for the DarkSide ransomware group.</p></div>
<p>&#8220;High trust level of our targets. They pay us and know that they&#8217;re going to receive decryption tools. They also know that we download data. A lot of data. That&#8217;s why the percent of our victims who pay the ransom is so high and it takes so little time to negotiate.&#8221;</p>
<p>In late March, DarkSide introduced a &#8220;call service&#8221; innovation that was integrated into the affiliate’s management panel, which enabled the affiliates to arrange calls pressuring victims into paying ransoms directly from the management panel.</p>
<p>In mid-April the ransomware program announced new capability for affiliates to launch distributed denial-of-service (DDoS) attacks against targets whenever added pressure is needed during ransom negotiations.</p>
<p>DarkSide also has advertised a willingness to sell information about upcoming victims before their stolen information is published on the DarkSide victim shaming blog, so that enterprising investment scammers can short the company&#8217;s stock in advance of the news.</p>
<p>&#8220;Now our team and partners encrypt many companies that are trading on NASDAQ and other stock exchanges,&#8221; DarkSide explains. &#8220;If the company refuses to pay, we are ready to provide information before the publication, so that it would be possible to earn in the reduction price of shares. Write to us in &#8216;Contact Us&#8217; and we will provide you with detailed information.&#8221;</p>
<p>DarkSide also started recruiting new affiliates again last month &#8212; <a href="https://krebsonsecurity.com/2020/10/amid-an-embarrassment-of-riches-ransom-gangs-increasingly-outsource-their-work/" target="_blank" rel="noopener">mainly seeking network penetration testers who can help turn a single compromised computer into a full-on data breach and ransomware incident.</a></p>
<div id="attachment_55546" style="width: 777px" class="wp-caption aligncenter"><a href="media/8491e3a9.dark-pentesters.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/dark-pentesters.png"><img aria-describedby="caption-attachment-55546" loading="lazy" class="wp-image-55546 " src="media/8491e3a9.dark-pentesters.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/dark-pentesters.png" alt="" width="767" height="165" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/05/dark-pentesters.png 1092w, https://krebsonsecurity.com/wp-content/uploads/2021/05/dark-pentesters-768x165.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/05/dark-pentesters-782x168.png 782w" sizes="(max-width: 767px) 100vw, 767px" /></a><p id="caption-attachment-55546" class="wp-caption-text">Portions of a DarkSide recruitment message, translated from Russian. Image: Intel 471.</p></div>
<p>&#8220;We have grown significantly in terms of the client base and in comparison to other projects (judging by the analysis of publicly available information), so we are ready to grow our team and a number of our affiliates in two fields,&#8221; DarkSide explained. <a href="https://krebsonsecurity.com/wp-content/uploads/2021/05/darkside20.txt" target="_blank" rel="noopener"> The advertisement</a> continued:</p>
<p>&#8220;Network penetration testing. We&#8217;re looking for one person or a team. We&#8217;ll adapt you to the work environment and provide work. High profit cuts, ability to target networks that you can&#8217;t handle on your own. New experience and stable income. When you use our product and the ransom is paid, we guarantee fair distribution of the funds. A panel for monitoring results for your target. We only accept networks where you intend to run our payload.&#8221;</p>
<p>DarkSide has shown itself to be fairly ruthless with victim companies that have deep pockets, but they can be reasoned with. Cybersecurity intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a> observed a negotiation between the DarkSide crew and a $15 billion U.S. victim company that was hit with a $30 million ransom demand in January 2021, and in this incident the victim&#8217;s efforts at negotiating a lower payment ultimately reduce the ransom demand by almost two-thirds.</p>
<div id="attachment_55545" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55545" loading="lazy" class=" wp-image-55545" src="media/62c2ffae.darkside-lock.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/darkside-lock.png" alt="" width="751" height="530" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/05/darkside-lock.png 775w, https://krebsonsecurity.com/wp-content/uploads/2021/05/darkside-lock-768x542.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/05/darkside-lock-100x70.png 100w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-55545" class="wp-caption-text">The DarkSide ransomware note.</p></div>
<p>The first exchange between DarkSide and the victim involved the usual back-and-forth establishing of trust, wherein the victim asks for assurances that stolen data will be deleted after payment.</p>
<div id="attachment_55544" style="width: 777px" class="wp-caption aligncenter"><a href="media/ee8b8569.ds-1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-1.png"><img aria-describedby="caption-attachment-55544" loading="lazy" class="wp-image-55544" src="media/ee8b8569.ds-1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-1.png" alt="" width="767" height="492" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-1.png 809w, https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-1-768x493.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-1-782x502.png 782w" sizes="(max-width: 767px) 100vw, 767px" /></a><p id="caption-attachment-55544" class="wp-caption-text">Image: Intel 471.</p></div>
<p>When the victim counter-offered to pay just $2.25 million, DarkSide responded with a lengthy, derisive reply, ultimately agreeing to lower the ransom demand to $28.7 million.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-55543" src="media/3951bc9e.ds-2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-2.png" alt="" width="544" height="400" /></p>
<p>&#8220;The timer it [sic] ticking and in in next 8 hours your price tag will go up to $60 million,&#8221; the crooks replied. &#8220;So, you this are your options first take our generous offer and pay to us $28,750 million US or invest some monies in quantum computing to expedite a decryption process.&#8221;<span id="more-55529"></span></p>
<div id="attachment_55542" style="width: 449px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55542" loading="lazy" class="size-full wp-image-55542" src="media/056d8e0f.ds-3.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-3.png" alt="" width="439" height="515" /><p id="caption-attachment-55542" class="wp-caption-text">Image: Intel 471.</p></div>
<p>The victim complains that negotiations haven&#8217;t moved the price much, but DarkSide countered that the company can easily afford the payout. &#8220;I don&#8217;t think so,&#8221; they wrote. &#8220;You aren&#8217;t poor and aren&#8217;t children if you f*cked up you have to meet the consequences.&#8221;</p>
<div id="attachment_55541" style="width: 554px" class="wp-caption aligncenter"><a href="media/2448cfb3.ds-4.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-4.png"><img aria-describedby="caption-attachment-55541" loading="lazy" class="wp-image-55541 size-full" src="media/2448cfb3.ds-4.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-4.png" alt="" width="544" height="260" /></a><p id="caption-attachment-55541" class="wp-caption-text">Image: Intel 471.</p></div>
<p>The victim firm replies a day later saying they&#8217;ve gotten authority to pay $4.75 million, and their tormentors agree to lower the demand significantly to $12 million.</p>
<div id="attachment_55540" style="width: 567px" class="wp-caption aligncenter"><a href="media/13c8de1c.ds-5.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-5.png"><img aria-describedby="caption-attachment-55540" loading="lazy" class="wp-image-55540 size-full" src="media/13c8de1c.ds-5.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-5.png" alt="" width="557" height="350" /></a><p id="caption-attachment-55540" class="wp-caption-text">Image: Intel 471.</p></div>
<p>The victim replies that this is still a huge amount, and it tries to secure additional assurances from the ransomware group if it agrees to pay the $12 million, such as an agreement not to target the company ever again, or give anyone access to its stolen data. The victim also tried to get the attackers to hand over a decryption key before paying the full ransom demand.</p>
<div id="attachment_55539" style="width: 568px" class="wp-caption aligncenter"><a href="media/a32b9020.ds-6.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-6.png"><img aria-describedby="caption-attachment-55539" loading="lazy" class="wp-image-55539 size-full" src="media/a32b9020.ds-6.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-6.png" alt="" width="558" height="456" /></a><p id="caption-attachment-55539" class="wp-caption-text">Image: Intel 471.</p></div>
<p>The crime gang responded that its own rules prohibit it from giving away a decryption key before full payment is made, but they agree to the rest of the terms.</p>
<div id="attachment_55538" style="width: 497px" class="wp-caption aligncenter"><a href="media/210df54e.ds-7.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-7.png"><img aria-describedby="caption-attachment-55538" loading="lazy" class="wp-image-55538 size-full" src="media/210df54e.ds-7.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-7.png" alt="" width="487" height="582" /></a><p id="caption-attachment-55538" class="wp-caption-text">Image: Intel 471.</p></div>
<p>The victim firm agrees to pay an $11 million ransom, and their extortionists concur and promise not to attack or help anyone else attack the company&#8217;s network going forward.</p>
<div id="attachment_55537" style="width: 561px" class="wp-caption aligncenter"><a href="media/948c670f.ds-8.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-8.png"><img aria-describedby="caption-attachment-55537" loading="lazy" class="wp-image-55537 size-full" src="media/948c670f.ds-8.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-8.png" alt="" width="551" height="495" /></a><p id="caption-attachment-55537" class="wp-caption-text">Image: Intel 471</p></div>
<p>Flashpoint assesses that at least some of the criminals behind DarkSide hail from another ransomware outfit called &#8220;<a href="https://krebsonsecurity.com/?s=revil" target="_blank" rel="noopener">REvil</a>,&#8221; a.k.a. &#8220;Sodinokibi&#8221; (although Flashpoint rates this finding at only &#8220;moderate&#8221; confidence). REvil <a href="https://krebsonsecurity.com/2019/07/is-revil-the-new-gandcrab-ransomware/" target="_blank" rel="noopener">is widely considered to be the newer name for GandCrab</a>, a ransomware-as-a-service offering that closed up shop in 2019 after bragging that it had extorted more than $2 billion.</p>
<p>Experts say ransomware attacks will continue to grow in sophistication, frequency and cost unless something is done to disrupt the ability of crooks to get paid for such crimes. According to <a href="https://www.coveware.com/blog/q3-2020-ransomware-marketplace-report#:~:text=Average%20Ransomware%20Increases%20as%20Attackers%20Target%20Bigger%20Companies&amp;text=The%20average%20ransom%20payment%20increased,to%20drag%20the%20averages%20up." target="_blank" rel="noopener">a report</a> late last year from <strong>Coveware</strong>, the average ransomware payment in the third quarter of 2020 was $233,817, up 31 percent from the second quarter of last year. Security firm Emsisoft found that almost 2,400 U.S.-based governments, healthcare facilities and schools were victims of ransomware in 2020.</p>
<p>Last month, a group of tech industry heavyweights lent their imprimatur to a task force that <a href="https://krebsonsecurity.com/2021/04/task-force-seeks-to-disrupt-ransomware-payments/#more-55321" target="_blank" rel="noopener">delivered an 81-page report to the Biden administration</a> on ways to stymie the ransomware industry. Among many other recommendations, the report urged the White House to make finding, frustrating and apprehending ransomware crooks a priority within the U.S. intelligence community, and to designate the current scourge of digital extortion as a national security threat.</p>


feed_id: https://krebsonsecurity.com/?p=55527
title: Microsoft Patch Tuesday, May 2021 Edition
uri: Microsoft-Patch-Tuesday-May-2021-Edition
url: https://krebsonsecurity.com/2021/05/microsoft-patch-tuesday-may-2021-edition/
content:
<p><strong>Microsoft</strong> today released fixes to plug at least 55 security holes in its <strong>Windows</strong> operating systems and other software. Four of these weaknesses can be exploited by malware and malcontents to seize complete, remote control over vulnerable systems without any help from users. On deck this month are patches to quash a wormable flaw, a creepy wireless bug, and yet another reason to call for the death of Microsoft&#8217;s <strong>Internet Explorer</strong> (IE) web browser.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="579" height="425" /></p>
<p>While May brings about half the normal volume of updates from Microsoft, there are some notable weaknesses that deserve prompt attention, particularly from enterprises. By all accounts, the most pressing priority this month is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31166" target="_blank" rel="noopener">CVE-2021-31166</a>, a Windows 10 and Windows Server flaw which allows an unauthenticated attacker to remotely execute malicious code at the operating system level. With this weakness, an attacker could compromise a host simply by sending it a specially-crafted packet of data.</p>
<p>&#8220;That makes this bug wormable, with even Microsoft calling that out in their write-up,” said <strong>Dustin Childs</strong>, with<strong> Trend Micro&#8217;s ZDI</strong> program. &#8220;Before you pass this aside, Windows 10 can also be configured as a web server, so it is impacted as well. Definitely put this on the top of your test-and-deploy list.&#8221;</p>
<p><strong>Kevin Breen </strong>from <strong>Immersive Labs</strong> said the fact that this one is just 0.2 points away from a perfect 10 CVSS score should be enough to identify just how important it is to patch.</p>
<p>&#8220;For ransomware operators, this kind of vulnerability is a prime target for exploitation,&#8221; Breen said. &#8220;Wormable exploits should always be a high priority, especially if they are for services that are designed to be public facing. As this specific exploit would not require any form of authentication, it’s even more appealing for attackers, and any organization using HTTP.sys protocol stack should prioritize this patch.&#8221;</p>
<p>Breen also called attention to <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26419" target="_blank" rel="noopener">CVE-2021-26419</a> &#8212; a vulnerability in <strong>Internet Explorer 11</strong> &#8212; to make the case for why IE needs to stand for &#8220;Internet Exploder.&#8221; To trigger this vulnerability, a user would have to visit a site that is controlled by the attacker, although Microsoft also recognizes that it could be triggered by embedding ActiveX controls in Office Documents.</p>
<p>&#8220;IE needs to die – and I’m not the only one that thinks so,&#8221; Breen said. &#8220;If you are an organization that has to provide IE11 to support legacy applications, consider enforcing a policy on the users that restricts the domains that can be accessed by IE11 to only those legacy applications. All other web browsing should be performed with a supported browser.&#8221;<span id="more-55527"></span></p>
<p>Another curious bug fixed this month is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-24587" target="_blank" rel="noopener">CVE-2020-24587</a>, described as a &#8220;Windows Wireless Networking Information Disclosure Vulnerability.&#8221; ZDI&#8217;s Childs said this one has the potential to be pretty damaging.</p>
<p>&#8220;This patch fixes a vulnerability that could allow an attacker to disclose the contents of encrypted wireless packets on an affected system,&#8221; he said. &#8220;It’s not clear what the range on such an attack would be, but you should assume some proximity is needed. You’ll also note this CVE is from 2020, which could indicate Microsoft has been working on this fix for some time.&#8221;</p>
<p>Microsoft also patched four more security holes its <strong>Exchange Server</strong> corporate email platform, which recently was <a href="https://krebsonsecurity.com/?s=exchange+server+attack" target="_blank" rel="noopener">besieged by attacks on four other zero-day Exchange flaws</a> that resulted in hundreds of thousands of servers worldwide getting hacked. One of the bugs is credited to <strong>Orange Tsai</strong> of the DEVCORE research team, who was responsible for <a href="https://krebsonsecurity.com/2021/03/a-basic-timeline-of-the-exchange-mass-hack/" target="_blank" rel="noopener">disclosing the ProxyLogon Exchange Server vulnerability</a> that was patched <a href="https://krebsonsecurity.com/2021/03/microsoft-chinese-cyberspies-used-4-exchange-server-flaws-to-plunder-emails/" target="_blank" rel="noopener">in an out-of-band release back in March</a>.</p>
<div id="attachment_54677" style="width: 644px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-54677" loading="lazy" class="size-full wp-image-54677" src="media/9e11d583.orangetsai.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/orangetsai.png" alt="" width="634" height="239" /><p id="caption-attachment-54677" class="wp-caption-text">Researcher Orange Tsai commenting that nobody guessed the remote zero-day he reported on Jan. 5, 2021 to Microsoft was in Exchange Server.</p></div>
<p>&#8220;While none of these flaws are deemed critical in nature, it is a reminder that researchers and attackers are still looking closely at Exchange Server for additional vulnerabilities, so organizations that have yet to update their systems should do so as soon as possible,&#8221; said <strong>Satnam Narang</strong>, staff research engineer at <strong>Tenable</strong>.</p>
<p>As always, it’s a good idea for Windows users to get in the habit of updating at least once a month, but for regular users (read: not enterprises) it’s usually safe to wait a few days until after the patches are released, so that Microsoft has time to iron out any kinks in the new armor.</p>
<p>But before you update, <em>please</em> make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates have been known to erase or corrupt files.</p>
<p>So do yourself a favor and backup before installing any patches. Windows 10 even has some <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">see this guide</a>.</p>
<p>If you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips.</p>


feed_id: https://krebsonsecurity.com/?p=55588
title: DarkSide Ransomware Gang Quits After Servers, Bitcoin Stash Seized
uri: DarkSide-Ransomware-Gang-Quits-After-Servers-Bitcoin-Stash-Seized
url:
https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/

content:
<p>The <strong>DarkSide</strong> ransomware affiliate program responsible for <a href="https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/" target="_blank" rel="noopener">the six-day outage</a> at <strong>Colonial Pipeline</strong> this week that led to fuel shortages and price spikes across the country is running for the hills. The crime gang announced it was closing up shop after its servers were seized and someone drained the cryptocurrency from an account the group uses to pay affiliates.</p>
<p>&#8220;Servers were seized (country not named), money of advertisers and founders was transferred to an unknown account,&#8221; reads a message from a cybercrime forum reposted to the Russian OSINT Telegram channel.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-55589" src="media/2da6d5a2.ds-bye.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-bye.png" alt="" width="474" height="630" /></p>
<p>&#8220;A few hours ago, we lost access to the public part of our infrastructure,&#8221; the message continues, explaining the outage affected its victim shaming blog where stolen data is published from victims who refuse to pay a ransom. The outage also took down its payment server and those that supply its distributed denial-of-service feature, which is used to turn up the heat on victims who balk at paying.</p>
<p>&#8220;Also, a few hours after the withdrawal, funds from the payment server (ours and clients&#8217;) were withdrawn to an unknown address,&#8221; the DarkSide admin says.</p>
<p>DarkSide organizers also said they were releasing decryption tools for all of the companies that have been ransomed but which haven&#8217;t yet paid.</p>
<p>&#8220;After that, you will be free to communicate with them wherever you want in any way you want,&#8221; the instructions read.<span id="more-55588"></span></p>
<p>The DarkSide message includes passages apparently penned by a leader of <a href="https://krebsonsecurity.com/?s=revil" target="_blank" rel="noopener">the REvil ransomware-as-a-service platform</a>. This is interesting because security experts have posited that many of DarkSide&#8217;s core members are closely tied to the REvil gang.</p>
<p>The REvil representative said its program was introducing new restrictions on the kinds of organizations that affiliates could hold for ransom, and that henceforth it would be forbidden to attack those in the &#8220;social sector&#8221; (defined as healthcare and educational institutions) and organizations in the &#8220;gov-sector&#8221; (state) of any country. Affiliates also will be required to get approval before infecting victims.</p>
<p>The new restrictions came as some Russian cybercrime forums began distancing themselves from ransomware operations altogether. On Thursday, the administrator of the popular Russian forum XSS announced the forum would no longer allow discussion threads about ransomware moneymaking programs.</p>
<p>&#8220;There&#8217;s too much publicity,&#8221; the XSS administrator explained. &#8220;Ransomware has gathered a critical mass of nonsense, bullshit, hype, and fuss around it. The word &#8216;ransomware&#8217; has been put on a par with a number of unpleasant phenomena, such as geopolitical tensions, extortion, and government-backed hacks. This word has become dangerous and toxic.&#8221;</p>
<p>In <a href="https://www.intel471.com/blog/darkside-ransomware-shut-down-revil-avaddon-cybercrime" target="_blank" rel="noopener">a blog post</a> on the DarkSide closure, cyber intelligence firm <strong>Intel 471</strong> said it believes all of these actions can be tied directly to the reaction related to the high-profile ransomware attacks covered by the media this week.</p>
<p>&#8220;However, a strong caveat should be applied to these developments: it’s likely that these ransomware operators are trying to retreat from the spotlight more than suddenly discovering the error of their ways,&#8221; Intel 471 wrote. &#8220;A number of the operators will most likely operate in their own closed-knit groups, resurfacing under new names and updated ransomware variants. Additionally, the operators will have to find a new way to &#8216;wash&#8217; the cryptocurrency they earn from ransoms. Intel 471 has observed that BitMix, a popular cryptocurrency mixing service used by Avaddon, DarkSide and REvil has allegedly ceased operations. Several apparent customers of the service reported they were unable to access BitMix in the last week.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=55569
title: Try This One Weird Trick Russian Hackers Hate
uri: Try-This-One-Weird-Trick-Russian-Hackers-Hate
url: https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/
content:
<p>In a <strong>Twitter</strong> discussion last week on ransomware attacks, KrebsOnSecurity <a href="https://twitter.com/briankrebs/status/1392163072970829830" target="_blank" rel="noopener">noted</a> that virtually all ransomware strains have a built-in failsafe designed to cover the backsides of the malware purveyors: They simply will not install on a <strong>Microsoft Windows</strong> computer that already has one of many types of virtual keyboards installed &#8212; such as Russian or Ukrainian. So many readers had questions in response to the tweet that I thought it was worth a blog post exploring this one weird cyber defense trick.</p>
<div id="attachment_55609" style="width: 774px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55609" loading="lazy" class=" wp-image-55609" src="media/f07dee7e.cis.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/cis.png" alt="" width="764" height="593" /><p id="caption-attachment-55609" class="wp-caption-text">The Commonwealth of Independent States (CIS) more or less matches the exclusion list on an awful lot of malware coming out of Eastern Europe.</p></div>
<p>The Twitter thread came up in a discussion on <a href="https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/" target="_blank" rel="noopener">the ransomware attack against Colonial Pipeline</a>, which earlier this month shut down 5,500 miles of fuel pipe for nearly a week, causing fuel station supply shortages throughout the country and driving up prices. The <a href="https://www.fbi.gov/news/pressrel/press-releases/fbi-statement-on-network-disruption-at-colonial-pipeline" target="_blank" rel="noopener">FBI said</a> the attack was the work of <strong>DarkSide</strong>, a new-ish ransomware-as-a-service offering that says it targets only large corporations.</p>
<p>DarkSide and other Russian-language affiliate moneymaking programs have long barred their criminal associates from installing malicious software on computers in a host of Eastern European countries, including Ukraine and Russia. This prohibition dates back to the earliest days of organized cybercrime, and it is intended to minimize scrutiny and interference from local authorities.</p>
<p>In Russia, for example, authorities there generally will not initiate a cybercrime investigation against one of their own unless a company or individual within the country&#8217;s borders files an official complaint as a victim. Ensuring that no affiliates can produce victims in their own countries is the easiest way for these criminals to stay off the radar of domestic law enforcement agencies.</p>
<p>Possibly feeling the heat from being <a href="https://www.whitehouse.gov/briefing-room/statements-releases/2021/05/12/fact-sheet-president-signs-executive-order-charting-new-course-to-improve-the-nations-cybersecurity-and-protect-federal-government-networks/" target="_blank" rel="noopener">referenced</a> in <a href="https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/" target="_blank" rel="noopener">President Biden&#8217;s Executive Order on cybersecurity</a> this past week, the DarkSide group sought to distance itself from their attack against Colonial Pipeline. In a message posted to its victim shaming blog, DarkSide tried to say it was &#8220;apolitical&#8221; and that it didn&#8217;t wish to participate in geopolitics.</p>
<p>&#8220;Our goal is to make money, and not creating problems for society,&#8221; the DarkSide criminals wrote last week. &#8220;From today we introduce moderation and check each company that our partners want to encrypt to avoid social consequences in the future.”</p>
<p>But here&#8217;s the thing: <em>Digital extortion gangs like DarkSide take great care to make their entire platforms geopolitical, because their malware is engineered to work only in certain parts of the world.</em></p>
<p>DarkSide, like a great many other malware strains, has a hard-coded do-not-install list of countries which are the principal members of the Commonwealth of Independent States (CIS) &#8212; former Soviet satellites that all currently have favorable relations with the Kremlin, including Azerbaijan, Belarus, Georgia, Romania, Turkmenistan, Ukraine and Uzbekistan. The full exclusion list in DarkSide (published by <strong>Cybereason</strong>) is below:</p>
<div id="attachment_55610" style="width: 956px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55610" loading="lazy" class="size-full wp-image-55610" src="media/ef1b99e4.excludelang.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/excludelang.png" alt="" width="946" height="494" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/05/excludelang.png 946w, https://krebsonsecurity.com/wp-content/uploads/2021/05/excludelang-768x401.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/05/excludelang-782x408.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/05/excludelang-267x140.png 267w" sizes="(max-width: 946px) 100vw, 946px" /><p id="caption-attachment-55610" class="wp-caption-text">Image: Cybereason.</p></div>
<p>Simply put, countless malware strains will check for the presence of one of these languages on the system, and if they&#8217;re detected the malware will exit and fail to install.</p>
<p>[Side note. Many security experts have pointed to connections between the DarkSide and REvil (a.k.a. &#8220;Sodinokibi&#8221;) ransomware groups. REvil was previously known as <a href="https://krebsonsecurity.com/?s=gandcrab" target="_blank" rel="noopener">GandCrab</a>, and one of the many things GandCrab had in common with REvil was that <a href="https://krebsonsecurity.com/2019/07/is-revil-the-new-gandcrab-ransomware/" target="_blank" rel="noopener">both programs barred affiliates from infecting victims in Syria.</a> As we can see from the chart above, Syria is also exempted from infections by DarkSide ransomware. And DarkSide itself proved their connection to REvil this past week <a href="https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/" target="_blank" rel="noopener">when it announced it was closing up shop after its servers and bitcoin funds were seized</a>.]<span id="more-55569"></span></p>
<h2>CAVEAT EMPTOR</h2>
<p>Will installing one of these languages keep your Windows computer safe from all malware? Absolutely not. There is plenty of malware that doesn&#8217;t care where in the world you are. And there is no substitute for adopting a defense-in-depth posture, and avoiding risky behaviors online.</p>
<p>But is there really a downside to taking this simple, free, prophylactic approach? None that I can see, other than perhaps a sinking feeling of capitulation. The worst that could happen is that you accidentally toggle the language settings and all your menu options are in Russian.</p>
<p>If this happens (and the first time it does the experience may be a bit jarring) hit the Windows key and the space bar at the same time; if you have more than one language installed you will see the ability to quickly toggle from one to the other. The little box that pops up when one hits that keyboard combo looks like this:</p>
<p><img loading="lazy" class="aligncenter wp-image-55608" src="media/1dd44478..png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/луныцше.png" alt="" width="563" height="249" /></p>
<p>Cybercriminals are notoriously responsive to defenses which cut into their profitability, so why wouldn&#8217;t the bad guys just change things up start ignoring the language check? Well, they certainly can and maybe even will do that (<a href="https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html" target="_blank" rel="noopener">a recent version of DarkSide analyzed by Mandiant</a> did <em>not</em> perform the system language check).</p>
<p>But doing so increases the risk to their personal safety and fortunes by some non-trivial amount, said <strong>Allison Nixon</strong>, chief research officer at New York City-based cyber investigations firm <a href="https://www.unit221b.com" target="_blank" rel="noopener">Unit221B</a>.</p>
<p>Nixon said because of Russia&#8217;s unique legal culture, criminal hackers in that country employ these checks to ensure they are only attacking victims outside of the country.</p>
<p>&#8220;This is for their legal protection,&#8221; Nixon said. &#8220;Installing a Cyrillic keyboard, or changing a specific registry entry to say &#8216;RU&#8217;, and so forth, might be enough to convince malware that you are Russian and off limits. This can technically be used as a &#8216;vaccine&#8217; against Russian malware.&#8221;</p>
<p>Nixon said if enough people do this in large numbers, it may in the short term protect some people, but more importantly in the long term it forces Russian hackers to make a choice: Risk losing legal protections, or risk losing income.</p>
<p>&#8220;Essentially, Russian hackers will end up facing the same difficulty that defenders in the West must face &#8212; the fact that it is very difficult to tell the difference between a domestic machine and a foreign machine masquerading as a domestic one,&#8221; she said.</p>
<p>KrebsOnSecurity asked Nixon&#8217;s colleague at Unit221B &#8212; founder <strong>Lance James</strong> &#8212; what he thought about the efficacy of another anti-malware approach suggested by Twitter followers who chimed in on last week&#8217;s discussion: Adding entries to the Windows registry that specify the system is running as a virtual machine (VM). In a bid to stymie analysis by antivirus and security firms, some malware authors have traditionally configured their malware to quit installing if it detects it is running in a virtual environment.</p>
<p>But James said this prohibition is no longer quite so common, particularly since so many organizations have transitioned to virtual environments for everyday use.</p>
<p>&#8220;Being a virtual machine doesn&#8217;t stop malware like it used to,&#8221; James said. &#8220;In fact, a lot of the ransomware we&#8217;re seeing now is running on VMs.&#8221;</p>
<p>But James says he loves the idea of everyone adding a language from the CIS country list so much he&#8217;s produced his own <a href="https://github.com/Unit221B/Russian" target="_blank" rel="noopener">clickable two-line Windows batch script</a> that adds a Russian language reference in the specific Windows registry keys that are checked by malware. The script effectively allows one&#8217;s Windows PC to look like it has a Russian keyboard installed without actually downloading the added script libraries from Microsoft.</p>
<p>To install a different keyboard language on a Windows 10 computer the old fashioned way, hit the Windows key and X at the same time, then select Settings, and then select &#8220;Time and Language.&#8221; Select Language, and then scroll down and you should see an option to install another character set. Pick one, and the language should be installed the next time you reboot. Again, if for some reason you need to toggle between languages, Windows+Spacebar is your friend.</p>


feed_id: https://krebsonsecurity.com/?p=55458
title: Recycle Your Phone, Sure, But Maybe Not Your Number
uri: Recycle-Your-Phone-Sure-But-Maybe-Not-Your-Number
url: https://krebsonsecurity.com/2021/05/recycle-your-phone-sure-but-maybe-not-your-number/
content:
<p>Many online services allow users to reset their passwords by clicking a link sent via SMS, and this unfortunately widespread practice has <a href="https://krebsonsecurity.com/2019/03/why-phone-numbers-stink-as-identity-proof/" target="_blank" rel="noopener"> turned mobile phone numbers into de facto identity documents</a>. Which means losing control over one thanks to a divorce, job termination or financial crisis can be devastating.</p>
<p>Even so, plenty of people willingly abandon a mobile number without considering the potential fallout to their digital identities when those digits invariably get reassigned to someone else. New research shows how fraudsters can abuse wireless provider websites to identify available, recycled mobile numbers that allow password resets at a range of email providers and financial services online.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-55651" src="media/35b0c87b.phoneguy.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/phoneguy.png" alt="" width="519" height="526" /></p>
<p>Researchers in the computer science department at <strong>Princeton University </strong>say they sampled 259 phone numbers at two major wireless carriers, and found 171 of them were tied to existing accounts at popular websites, potentially allowing those accounts to be hijacked.</p>
<p>The Princeton team further found 100 of those 259 numbers were linked to leaked login credentials on the web, which could enable account hijackings that defeat SMS-based multi-factor authentication.</p>
<p>&#8220;Our key finding is that attackers can feasibly leverage number recycling to target previous owners and their accounts,&#8221; the researchers wrote. &#8220;The moderate to high hit rates of our testing methods indicate that most recycled numbers are vulnerable to these attacks. Furthermore, by focusing on blocks of Likely recycled numbers, an attacker can easily discover available recycled numbers, each of which then becomes a potential target.&#8221;</p>
<p>The researchers located newly-recycled mobile numbers by browsing numbers made available to customers interested in signing up for a prepaid account at <strong>T-Mobile</strong> or <strong>Verizon </strong>(apparently <strong>AT&amp;T</strong> doesn&#8217;t provide a similar interface). They said they were able to identify and ignore large blocks of new, unused numbers, as these blocks tend to be made available consecutively &#8212; much like newly printed money is consecutively numbered in stacks.</p>
<p><img loading="lazy" class="aligncenter wp-image-55462" src="media/c32465bf.numberrecyclingattacks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/numberrecyclingattacks.png" alt="" width="767" height="768" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/05/numberrecyclingattacks.png 837w, https://krebsonsecurity.com/wp-content/uploads/2021/05/numberrecyclingattacks-768x769.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/05/numberrecyclingattacks-782x783.png 782w" sizes="(max-width: 767px) 100vw, 767px" /></p>
<p>The Princeton team has a number of recommendations for T-Mobile and Verizon, noting that both carriers allow unlimited inquiries on their prepaid customer platforms online &#8212; meaning there is nothing to stop attackers from automating this type of number reconnaissance.</p>
<p>&#8220;On postpaid interfaces, Verizon already has safeguards and T-Mobile does not even support changing numbers online,&#8221; the researchers wrote. &#8220;However, the number pool is shared between postpaid and prepaid, rendering all subscribers vulnerable to attacks.&#8221;<span id="more-55458"></span></p>
<p>They also recommend the carriers teach their support employees to remind customers about the risks of relinquishing a mobile number without first disconnecting it from other identities and sites online, advice they generally did not find was offered when interacting with customer support regarding number changes.</p>
<p>In addition, the carriers could offer their own &#8220;number parking&#8221; service for customers who know they will not require phone service for an extended period of time, or for those who just aren&#8217;t sure what they want to do with a number. Such services are already offered by companies like <a href="https://www.numberbarn.com" target="_blank" rel="noopener">NumberBarn</a> and <a href="https://parkmyphone.com/" target="_blank" rel="noopener">Park My Phone</a>, and they generally cost between $2-5 per month.</p>
<p>The Princeton study recommends consumers who are considering a number change instead either store the digits at an existing number parking service, or &#8220;port&#8221; the number to something like <strong>Google Voice</strong>. For a one-time $20 fee, Google Voice will let you port the number, and then you can continue to receive texts and calls to that number via Google Voice, or you can forward them to another number.</p>
<p>Porting seems like less of a hassle and potentially safer considering <a href="https://blog.dashlane.com/world-password-day/" target="_blank" rel="noopener">the average user has something like 150 accounts online</a>, and a significant number of those accounts are going to be tied to one&#8217;s mobile number.</p>
<p>The full Princeton study is available <a href="media/e73d0d8c.recycled-numbers-latest.pdf" data-original-source="https://recyclednumbers.cs.princeton.edu/assets/recycled-numbers-latest.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=55671
title: How to Tell a Job Offer from an ID Theft Trap
uri: How-to-Tell-a-Job-Offer-from-an-ID-Theft-Trap
url: https://krebsonsecurity.com/2021/05/how-to-tell-a-job-offer-from-an-id-theft-trap/
content:
<p>One of the oldest scams around &#8212; the fake job interview that seeks only to harvest your personal and financial data &#8212; is on the rise, the <strong>FBI</strong> warns. Here&#8217;s the story of a recent <strong>LinkedIn</strong> impersonation scam that led to more than 100 people getting duped, and one almost-victim who decided the job offer was too-good-to-be-true.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-55696" src="media/30bcc77c.jobscam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/jobscam.png" alt="" width="690" height="443" /></p>
<p>Last week, someone began began posting classified notices on LinkedIn for different design consulting jobs at <a href="https://www.geosyntec.com/" target="_blank" rel="noopener">Geosyntec Consultants</a>, an environmental engineering firm based in the Washington, D.C. area. Those who responded were told their application for employment was being reviewed and that they should email <a href="https://www.linkedin.com/in/troygwin" target="_blank" rel="noopener">Troy Gwin </a>&#8212; Geosyntec&#8217;s senior recruiter &#8212; immediately to arrange a screening interview.</p>
<p>Gwin contacted KrebsOnSecurity after hearing from job seekers trying to verify the ad, which urged respondents to email Gwin at a Gmail address that was not his. Gwin said LinkedIn told him roughly 100 people applied before the phony ads were removed for abusing the company&#8217;s terms of service.</p>
<p>&#8220;The endgame was to offer a job based on successful completion of background check which obviously requires entering personal information,&#8221; Gwin said. &#8220;Almost 100 people applied. I feel horrible about this. These people were really excited about this &#8216;opportunity&#8217;.&#8221;</p>
<p><a href="https://www.linkedin.com/in/essiegel/" target="_blank" rel="noopener">Erica Siegel</a> was particularly excited about the possibility of working in a creative director role she interviewed for at the fake Geosyntec. Siegel said her specialty &#8212; helping wealthy people develop their own personal brands &#8212; has been in low demand throughout the pandemic, so she&#8217;s applied to dozens of jobs and freelance gigs over the past few months.</p>
<p>On Monday, someone claiming to work with Gwin contacted Siegel and asked her to set up an online interview with Geosyntec. Siegel said the &#8220;recruiter&#8221; sent her a list of screening questions that all seemed relevant to the position being advertised.</p>
<p>Siegel said that within about an hour of submitting her answers, she received a reply saying the company&#8217;s board had unanimously approved her as a new hire, with an incredibly generous salary considering she had to do next to no work to get a job she could do from home.</p>
<p>Worried that her potential new dream job might be too-good-to-be-true, she sent the recruiter a list of her own questions that she had about the role and its position within the company.</p>
<p>But the recruiter completely ignored Siegel&#8217;s follow-up questions, instead sending a reply that urged her to get in touch with a contact in human resources to immediately begin the process of formalizing her employment. Which of course involves handing over one&#8217;s personal (driver&#8217;s license info) and financial details for direct deposit.</p>
<p><a href="media/e13cd1e4.esiegel.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/esiegel.png"><img loading="lazy" class="aligncenter wp-image-55693" src="media/e13cd1e4.esiegel.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/esiegel.png" alt="" width="766" height="152" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/05/esiegel.png 2164w, https://krebsonsecurity.com/wp-content/uploads/2021/05/esiegel-768x152.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/05/esiegel-1536x304.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2021/05/esiegel-2048x405.png 2048w, https://krebsonsecurity.com/wp-content/uploads/2021/05/esiegel-782x155.png 782w" sizes="(max-width: 766px) 100vw, 766px" /></a></p>
<p>Multiple things about this job offer didn&#8217;t smell right to Siegel.</p>
<p>&#8220;I usually have six or seven interviews before getting a job,&#8221; Siegel said. &#8220;Hardly ever in my lifetime have I seen a role that flexible, completely remote and paid the kind of money I would ask for. You never get all three of those things.&#8221;</p>
<p>So she called her dad, an environmental attorney who happens to know and have worked with people at the real Geosyntec Consultants. Then she got in touch with the real Troy Gwin, who confirmed her suspicions that the whole thing was a scam.</p>
<p>&#8220;Even after the real Troy said they&#8217;d gotten these [LinkedIn] ads shut down, this guy was still emailing me asking for my HR information,&#8221; Siegel said. &#8220;So my dad said, &#8216;Troll him back, and tell him you want a signing bonus via money order.&#8217; I was like, okay, what&#8217;s the worst that could happen? I never heard from him again.&#8221;<span id="more-55671"></span></p>
<h2>HOW TO SPOT A JOB SCAM</h2>
<p>In late April, the FBI <a href="https://www.fbi.gov/contact-us/field-offices/elpaso/news/press-releases/fbi-warns-cyber-criminals-are-using-fake-job-listings-to-target-applicants-personally-identifiable-information" target="_blank" rel="noopener">warned</a> that technology is making these scams easier and more lucrative for fraudsters, who are particularly fond of impersonating recruiters.</p>
<p>&#8220;Fake Job or Employment Scams occur when criminal actors deceive victims into believing they have a job or a potential job,&#8221; the FBI warned. &#8220;Criminals leverage their position as “employers” to persuade victims to provide them with personally identifiable information (PII), become unwitting money mules, or to send them money.&#8221;</p>
<p>Last year, some 16,012 people reported being victims of employment scams with losses totaling more than $59 million, according to the FBI&#8217;s <a href="http://www.ic3.gov/" target="_blank" rel="noopener">Internet Crime Complaint Center</a> (IC3). But the real losses each year from employment scams are likely far higher; as the Justice Department often points out, relatively few victims of these crimes report the matter to the IC3.</p>
<p>LinkedIn said its platform uses automated and manual defenses to detect and address fake accounts or fraudulent payments.</p>
<p>&#8220;Any accounts or job posts that violate our policies are blocked from the site,&#8221; LinkedIn said in response to a request for comment. &#8220;The majority of fake job postings are stopped before going live on our site, and for those job postings that aren’t, whenever we find fake posts, we work to remove it quickly.&#8221;</p>
<p>LinkedIn&#8217;s most recent <a href="https://about.linkedin.com/transparency" target="_blank" rel="noopener">transparency report</a> says these automated defenses block or automatically remove 98.4% of the fake accounts. But the scam that ensnared Gwin and Siegel is more of a hybrid, in that the majority of it operates outside of LinkedIn&#8217;s control via email services like Gmail and Yahoo.</p>
<p>This, by the way, should be a major red flag for anyone searching for a job, says the FBI: &#8220;Potential employers contact victims through non-company email domains and teleconference applications.&#8221;</p>
<p>Here are some other telltale signs of a job scam, as per the FBI:</p>
<p>-Interviews are not conducted in-person or through a secure video call.<br />
-Potential employers contact victims through non-company email domains and teleconference applications.<br />
-Potential employers require employees to purchase start-up equipment from the company.<br />
-Potential employers require employees to pay upfront for background investigations or screenings.<br />
-Potential employers request credit card information.<br />
-Potential employers send an employment contract to physically sign asking for PII.<br />
-Job postings appear on job boards, but not on the companies’ websites.<br />
-Recruiters or managers do not have profiles on the job board, or the profiles do not seem to fit their roles.</p>


feed_id: https://krebsonsecurity.com/?p=55754
title: Boss of ATM Skimming Syndicate Arrested in Mexico
uri: Boss-of-ATM-Skimming-Syndicate-Arrested-in-Mexico
url: https://krebsonsecurity.com/2021/05/boss-of-atm-skimming-syndicate-arrested-in-mexico/
content:
<p><strong>Florian &#8220;The Shark&#8221; Tudor</strong>, the alleged ringleader of a prolific ATM skimming gang that siphoned hundreds of millions of dollars from bank accounts of tourists visiting Mexico over the last eight years, was arrested in Mexico City on Thursday in response to an extradition warrant from a Romanian court.</p>
<div id="attachment_55765" style="width: 781px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55765" loading="lazy" class=" wp-image-55765" src="media/4768df23.tudormx.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/tudormx.png" alt="" width="771" height="382" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/05/tudormx.png 1048w, https://krebsonsecurity.com/wp-content/uploads/2021/05/tudormx-768x380.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/05/tudormx-782x387.png 782w" sizes="(max-width: 771px) 100vw, 771px" /><p id="caption-attachment-55765" class="wp-caption-text">Florian Tudor, at a 2020 press conference in Mexico in which he asserted he was a legitimate businessman and not a mafia boss. Image: OCCRP.</p></div>
<p>Tudor, a native of Craiova, Romania, moved to Mexico to set up <strong>Top Life Servicios</strong>, an ATM servicing company which managed a fleet of relatively new ATMs based in Mexico branded as <strong>Intacash</strong>.</p>
<p>Intacash was the central focus of a <a href="https://krebsonsecurity.com/2015/09/tracking-a-bluetooth-skimmer-gang-in-mexico/" target="_blank" rel="noopener">three</a>–<a href="https://krebsonsecurity.com/2015/09/tracking-bluetooth-skimmers-in-mexico-part-ii/" target="_blank" rel="noopener">part</a> <a href="https://krebsonsecurity.com/2015/09/whos-behind-bluetooth-skimming-in-mexico/" target="_blank" rel="noopener">investigation</a> KrebsOnSecurity published in September 2015. That series tracked the activities of a crime gang working with Intacash that was bribing and otherwise coercing ATM technicians to install sophisticated Bluetooth-based skimmers inside cash machines throughout popular tourist destinations in and around Mexico’s Yucatan Peninsula — including Cancun, Cozumel, Playa del Carmen and Tulum.</p>
<p>Follow-up <a href="https://www.occrp.org/en/how-a-crew-of-romanian-criminals-conquered-the-world-of-atm-skimming/" target="_blank" rel="noopener">reporting last year</a> by the <strong>Organized Crime and Corruption Reporting Project</strong> (OCCRP) found Tudor and his associates compromised more than 100 ATMs across Mexico using skimmers that were able to remain in place undetected for years. The OCCRP, which dubbed Tudor&#8217;s group &#8220;The Riviera Maya Gang,&#8221; estimates the crime syndicate used cloned card data and stolen PINs to steal more than $1.2 billion from bank accounts of tourists visiting the region.</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/O9jf-RtpPXM?start=1" width="760" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>Last year, a Romanian court ordered Tudor&#8217;s capture following his conviction in absentia for attempted murder, blackmail and the creation of an organized crime network that specialized in human trafficking.</p>
<p>Mexican authorities have been examining bank accounts tied to Tudor and his companies, and investigators believe Tudor and his associates paid protection and hush money to various Mexican politicians and officials over the years. In February, the leader of Mexico&#8217;s Green Party <a href="https://krebsonsecurity.com/2021/02/mexican-politician-removed-over-alleged-ties-to-romanian-atm-skimmer-gang/" target="_blank" rel="noopener">stepped down after it emerged that he received funds from Tudor&#8217;s group</a>.</p>
<p>This is the second time Mexican authorities have detained Tudor. In April 2019, Tudor and his deputy <a href="https://krebsonsecurity.com/2019/04/alleged-chief-of-romanian-atm-skimming-gang-arrested-in-mexico/" target="_blank" rel="noopener">were arrested for illegal firearms possession</a>. That arrest came just months after Tudor allegedly ordered the execution of a former bodyguard who was trying to help U.S. authorities bring down the group&#8217;s lucrative skimming operations.</p>
<p>Tudor&#8217;s <a href="https://www.gob.mx/fgr/prensa/comunicado-fgr-192-21-fgr-informa" target="_blank" rel="noopener">arrest this week inside the premises of the Mexican Attorney General&#8217;s Office</a> did not go smoothly, according to Mexican news outlets. <em>El Universal</em> <a href="https://www.eluniversal.com.mx/nacion/video-me-estan-ahorcando-asi-fue-la-detencion-de-florian-tudor-en-la-fgr" target="_blank" rel="noopener">reports</a> that a brawl broke out between Tudor&#8217;s lawyers and officials at the Mexican AG&#8217;s office, and <a href="https://twitter.com/El_Universal_Mx/status/1398038127697141761" target="_blank" rel="noopener">a video released by the news outlet on Twitter</a> shows Tudor resisting arrest as he is being hauled out of the building hand and foot.</p>
<p>A Mexican judge will decide on Tudor&#8217;s extradition to Romania in the coming weeks.</p>


feed_id: https://krebsonsecurity.com/?p=55728
title: Using Fake Reviews to Find Dangerous Extensions
uri: Using-Fake-Reviews-to-Find-Dangerous-Extensions
url: https://krebsonsecurity.com/2021/05/using-fake-reviews-to-find-dangerous-extensions/
content:
<p>Fake, positive reviews have infiltrated nearly every corner of life online these days, confusing consumers while offering an unwelcome advantage to fraudsters and sub-par products everywhere. Happily, identifying and tracking these fake reviewer accounts is often the easiest way to spot scams. Here&#8217;s the story of how bogus reviews on a counterfeit <strong>Microsoft Authenticator</strong> browser extension exposed dozens of other extensions that siphoned personal and financial data.</p>
<div id="attachment_55741" style="width: 775px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55741" loading="lazy" class="wp-image-55741" src="media/0c740dbf.cs-msauthcomments.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/cs-msauthcomments.png" alt="" width="765" height="310" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/05/cs-msauthcomments.png 1271w, https://krebsonsecurity.com/wp-content/uploads/2021/05/cs-msauthcomments-768x311.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/05/cs-msauthcomments-782x317.png 782w" sizes="(max-width: 765px) 100vw, 765px" /><p id="caption-attachment-55741" class="wp-caption-text">Comments on the fake Microsoft Authenticator browser extension show the reviews for these applications are either positive or very negative &#8212; basically calling it out as a scam. Image: chrome-stats.com.</p></div>
<p>After hearing from a reader about a phony Microsoft Authenticator extension that appeared on the <strong>Google Chrome Store</strong>, KrebsOnSecurity began looking at the profile of the account that created it. There were a total of five reviews on the extension before it was removed: Three Google users gave it one star, warning people to stay far away from it; but two of the reviewers awarded it between three and four stars.</p>
<p>&#8220;It&#8217;s great!,&#8221; the Google account <strong>Theresa Duncan</strong> enthused, improbably. &#8220;I&#8217;ve only had very occasional issues with it.&#8221;</p>
<p>&#8220;Very convenient and handing,&#8221; assessed <strong>Anna Jones</strong>, incomprehensibly.</p>
<p>Google&#8217;s Chrome Store said the email address tied to the account that published the knockoff Microsoft extension also was responsible for one called &#8220;<strong>iArtbook Digital Painting</strong>.&#8221; Before it was removed from the Chrome Store, iArtbook had garnered just 22 users and three reviews. As with the knockoff Microsoft extension, all three reviews were positive, and all were authored by accounts with first and last names, like <strong>Megan Vance</strong>, <strong>Olivia Knox</strong>, and <strong>Alison Graham</strong>.</p>
<p>Google&#8217;s Chrome Store doesn&#8217;t make it easy to search by reviewer. For that I turned to <strong>Hao Nguyen</strong>, the developer behind <a href="https://www.chrome-stats.com" target="_blank" rel="noopener">chrome-stats.com</a>, which indexes and makes searchable a broad array of attributes about extensions available from Google.</p>
<p>Looking at the Google accounts that left positive reviews on both the now-defunct Microsoft Authenticator and iArtbook extensions, KrebsOnSecurity noticed that each left positive reviews on a handful of other extensions that have since been removed.</p>
<div id="attachment_55784" style="width: 770px" class="wp-caption aligncenter"><a href="media/7ac3c4a0.iartbook.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/iartbook.png"><img aria-describedby="caption-attachment-55784" loading="lazy" class="wp-image-55784" src="media/7ac3c4a0.iartbook.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/iartbook.png" alt="" width="760" height="243" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/05/iartbook.png 1044w, https://krebsonsecurity.com/wp-content/uploads/2021/05/iartbook-768x246.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/05/iartbook-782x250.png 782w" sizes="(max-width: 760px) 100vw, 760px" /></a><p id="caption-attachment-55784" class="wp-caption-text">Reviews on the iArtbook extension were all from apparently fake Google accounts that each reviewed two other extensions, one of which was published by the same developer. This same pattern was observed across 45 now-defunct extensions.</p></div>
<p>Like an ever-expanding <a href="https://en.wikipedia.org/wiki/Venn_diagram" target="_blank" rel="noopener">venn diagram</a>, a review of the extensions commented on by each new fake reviewer found led to the discovery of even more phony reviewers and extensions. In total, roughly 24 hours worth of digging through chrome-stats.com unearthed more than 100 positive reviews on a network of patently fraudulent extensions.</p>
<p>Those reviews in turn lead to the relatively straightforward identification of:</p>
<p>-39 reviewers who were happy with extensions that spoofed major brands and requested financial data<br />
-45 malicious extensions that collectively had close to 100,000 downloads<br />
-25 developer accounts tied to multiple banned applications</p>
<p>The extensions spoofed a range of consumer brands, including <strong>Adobe</strong>, <strong>Amazon</strong>, <strong>Facebook</strong>, <strong>HBO</strong>, <strong>Microsoft</strong>, <strong>Roku</strong> and <strong>Verizon</strong>. Scouring the manifests for each of these other extensions in turn revealed that many of the same developers were tied to multiple apps being promoted by the same phony Google accounts.</p>
<p>Some of the fake extensions have only a handful of downloads, but most have hundreds or thousands. A <a href="https://chrome-stats.com/d/cfpojnimgikehbalpifbfnofalkmeikm" target="_blank" rel="noopener">fake Microsoft Teams extension</a> attracted 16,200 downloads in the roughly two months it was available from the Google store. A <a href="https://chrome-stats.com/d/cafffncdbdopajhdpnfpohbneabfmjef" target="_blank" rel="noopener">counterfeit version</a> of <strong>CapCut</strong>, a professional video editing software suite, claimed nearly 24,000 downloads over a similar time period.</p>
<div id="attachment_55749" style="width: 771px" class="wp-caption aligncenter"><a href="media/477f7702.msteams-fakeapp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/msteams-fakeapp.png"><img aria-describedby="caption-attachment-55749" loading="lazy" class="wp-image-55749" src="media/477f7702.msteams-fakeapp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/msteams-fakeapp.png" alt="" width="761" height="469" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/05/msteams-fakeapp.png 1103w, https://krebsonsecurity.com/wp-content/uploads/2021/05/msteams-fakeapp-768x473.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/05/msteams-fakeapp-782x482.png 782w" sizes="(max-width: 761px) 100vw, 761px" /></a><p id="caption-attachment-55749" class="wp-caption-text">More than 16,000 people downloaded a fake Microsoft Teams browser extension over the roughly two months it was available for download from the Google Chrome store.</p></div>
<p>Unlike malicious browser extensions that can <a href="https://krebsonsecurity.com/2021/03/is-your-browser-extension-a-botnet-backdoor/" target="_blank" rel="noopener">turn your PC into a botnet or harvest your cookies</a>, none of the extensions examined here request any special permissions from users. Once installed, however, they invariably prompt the user to provide personal and financial data &#8212; all the while pretending to be associated with major brand names.<span id="more-55728"></span></p>
<p>In some cases, the fake reviewers and phony extension developers used in this scheme share names, such as the case with &#8220;<strong>brook ice</strong>,&#8221; the Google account that positively reviewed the malicious Adobe and <strong>Microsoft Teams</strong> extensions. The email address <strong>brookice100@gmail.com</strong> was used to register the developer account responsible for producing two of the phony extensions examined in this review (PhotoMath and Dollify).</p>
<div id="attachment_55745" style="width: 781px" class="wp-caption aligncenter"><a href="media/3f330733.extensionreviewers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/extensionreviewers.png"><img aria-describedby="caption-attachment-55745" loading="lazy" class="wp-image-55745" src="media/3f330733.extensionreviewers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/extensionreviewers.png" alt="" width="771" height="300" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/05/extensionreviewers.png 1750w, https://krebsonsecurity.com/wp-content/uploads/2021/05/extensionreviewers-768x298.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/05/extensionreviewers-1536x597.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2021/05/extensionreviewers-782x304.png 782w" sizes="(max-width: 771px) 100vw, 771px" /></a><p id="caption-attachment-55745" class="wp-caption-text">Some of the data that informed this report. The full spreadsheet is available as a link at the end of the story.</p></div>
<p>As we can see from the spreadsheet snippet above, many of the Google accounts that penned positive reviews on patently bogus extensions left comments on multiple apps on the same day.</p>
<p>Additionally, Google&#8217;s account recovery tools indicate many different developer email addresses tied to extensions reviewed here share the same recovery email &#8212; suggesting a relatively few number of anonymous users are controlling the entire scheme. When the spreadsheet data shown above is sorted by email address of the extension developer, the grouping of the reviews by date becomes even clearer.</p>
<p>KrebsOnSecurity shared these findings with Google and will update this story in the event they respond. Either way, Google somehow already detected all of these extensions as fraudulent and removed them from its store.</p>
<p>However, there may be a future post here about how long that bad extension identification and removal process has taken over time. Overall, most of these extensions were available for two to three months before being taken down.</p>
<p>As for the &#8220;so what?&#8221; here? I performed this research mainly because I could, and I thought it was <a href="https://docs.google.com/spreadsheets/d/1CcFc4mgGA9Ping8RZIh6MH5XUUFXyYdJlvO-xRMda1Q/edit?usp=sharing" target="_blank" rel="noopener">interesting enough to share</a>. Also, I got fascinated with the idea that finding fake applications might be as simple as identifying and following the likely fake reviewers. I&#8217;m positive there is more to this network of fraudulent extensions than is documented here.</p>
<p>As this story illustrates, it pays to be judicious about installing extensions. Leaving aside these extensions which are outright fraudulent, so many legitimate extensions <a href="https://krebsonsecurity.com/2021/03/is-your-browser-extension-a-botnet-backdoor/" target="_blank" rel="noopener">get abandoned or sold each year to shady marketers</a> that it&#8217;s wise to only trust extensions that are actively maintained (and perhaps have a critical mass of users that would make noise if anything untoward happened with the software).</p>
<p>According to chrome-stats.com, the majority of extensions — more than 100,000 of them — are effectively abandoned by their authors, or haven’t been updated in more than two years. In other words, there a great many developers who are likely to be open to someone else buying up their creation along with their user base.</p>
<p>The data that informed this report is searchable <a href="https://docs.google.com/spreadsheets/d/1CcFc4mgGA9Ping8RZIh6MH5XUUFXyYdJlvO-xRMda1Q/edit?usp=sharing" target="_blank" rel="noopener">in this Google spreadsheet</a>.</p>


feed_id: https://krebsonsecurity.com/?p=55809
title: Adventures in Contacting the Russian FSB
uri: Adventures-in-Contacting-the-Russian-FSB
url: https://krebsonsecurity.com/2021/06/adventures-in-contacting-the-russian-fsb/
content:
<p>KrebsOnSecurity recently had occasion to contact the <strong>Russian Federal Security Service</strong> (FSB), the Russian equivalent of the <strong>U.S. Federal Bureau of Investigation</strong> (FBI). In the process of doing so, I encountered a small snag: The FSB&#8217;s website said in order to communicate with them securely, I needed to download and install an encryption and virtual private networking (VPN) appliance that is flagged by at least 20 antivirus products as malware.</p>
<div id="attachment_55828" style="width: 1580px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55828" loading="lazy" class="size-full wp-image-55828" src="media/d0fa12ba.fsbhq.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/fsbhq.png" alt="" width="1570" height="1030" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/fsbhq.png 1570w, https://krebsonsecurity.com/wp-content/uploads/2021/06/fsbhq-768x504.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/06/fsbhq-1536x1008.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2021/06/fsbhq-782x513.png 782w" sizes="(max-width: 1570px) 100vw, 1570px" /><p id="caption-attachment-55828" class="wp-caption-text">The FSB headquarters at Lubyanka Square, Moscow. Image: Wikipedia.</p></div>
<p>The reason I contacted the FSB &#8212; one of the successor agencies to the Russian KGB &#8212; ironically enough had to do with security concerns raised by an infamous Russian hacker about the FSB&#8217;s own preferred method of being contacted.</p>
<p>KrebsOnSecurity was seeking comment from the FSB about <a href="https://cybersec.org/anews/czib-fsb-rasprostranyaet-troyan-pri-obrashheniyah-pod-vidom-generatora-sluchajnyh-chisel.html" target="_blank" rel="noopener">a blog post</a> published by <a href="https://en.wikipedia.org/wiki/Vladislav_Horohorin" target="_blank" rel="noopener">Vladislav &#8220;BadB&#8221; Horohorin</a>, a former international stolen credit card trafficker who served seven years in U.S. federal prison for his role in the <a href="https://www.justice.gov/opa/pr/international-credit-card-trafficker-sentenced-88-months-prison" target="_blank" rel="noopener">theft of $9 million from RBS WorldPay in 2009</a>. Horohorin, a citizen of Russia, Israel and Ukraine, is now back where he grew up in Ukraine, running a cybersecurity consulting business.</p>
<div id="attachment_55848" style="width: 772px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55848" loading="lazy" class=" wp-image-55848" src="media/a8227e44.badbdumps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/badbdumps.png" alt="" width="762" height="437" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/badbdumps.png 1264w, https://krebsonsecurity.com/wp-content/uploads/2021/06/badbdumps-768x441.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/06/badbdumps-782x449.png 782w" sizes="(max-width: 762px) 100vw, 762px" /><p id="caption-attachment-55848" class="wp-caption-text">Horohorin&#8217;s BadB carding store, badb[.]biz, circa 2007. Image: Archive.org.</p></div>
<p>Visit the FSB&#8217;s website and you might notice its web address starts with http:// instead of https://, meaning the site is not using an encryption certificate. In practical terms, any information shared between the visitor and the website is sent in plain text and will be visible to anyone who has access to that traffic.</p>
<p>This appears to be the case regardless of which Russian government site you visit. According to <a href="https://browser.yandex.com/help/tls/tls.html" target="_blank" rel="noopener">Russian search giant Yandex</a>, the laws of the Russian federation demand that encrypted connections be installed according to the <a href="https://en.wikipedia.org/wiki/GOST_(block_cipher)" target="_blank" rel="noopener">Russian GOST cryptographic algorithm</a>.</p>
<p>That means those who have a reason to send encrypted communications to a Russian government organization &#8212; including ordinary things like making a payment for a government license or fine, or filing legal documents &#8212; need to first install <strong>CryptoPro</strong>, a Windows-only application that loads the GOST encryption libraries on a user&#8217;s computer.</p>
<p>But if you want to talk directly to the FSB over an encrypted connection, you can just install their own client, which bundles the CryptoPro code. Visit the FSB&#8217;s site and select the option to &#8220;transfer meaningful information to operational units,&#8221; and you&#8217;ll see a prompt to install a &#8220;random number generation&#8221; application that is needed before a specific contact form on the FSB&#8217;s website will load properly.</p>
<p>Mind you, I&#8217;m not suggesting anyone go do that: Horohorin pointed out that this random number generator was flagged by 20 different antivirus and security products as malicious.</p>
<p>&#8220;Think well before contacting the FSB for any questions or dealing with them, and if you nevertheless decide to do this, it is better to use a virtual machine,&#8221; Horohorin wrote. &#8220;And a spacesuit. And, preferably, while in another country.&#8221;</p>
<div id="attachment_55817" style="width: 775px" class="wp-caption aligncenter"><a href="media/92ddf517.fsb-rng.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/fsb-rng.png"><img aria-describedby="caption-attachment-55817" loading="lazy" class="wp-image-55817" src="media/92ddf517.fsb-rng.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/fsb-rng.png" alt="" width="765" height="423" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/fsb-rng.png 1482w, https://krebsonsecurity.com/wp-content/uploads/2021/06/fsb-rng-768x425.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/06/fsb-rng-782x433.png 782w" sizes="(max-width: 765px) 100vw, 765px" /></a><p id="caption-attachment-55817" class="wp-caption-text">Antivirus product detections on the FSB&#8217;s VPN software. Image: VirusTotal.</p></div>
<p>It&#8217;s probably worth mentioning that the FSB is the same agency that&#8217;s been sanctioned for malicious cyber activity by the U.S. government on multiple occasions over the past five years. According to the most recent sanctions by the <strong>U.S. Treasury Department</strong>, the FSB is known for recruiting criminal hackers from underground forums and offering them legal cover for their actions.</p>
<p>&#8220;To bolster its malicious cyber operations, the FSB cultivates and co-opts criminal hackers, including the <a href="https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/" target="_blank" rel="noopener">previously designated Evil Corp.</a>, enabling them to engage in disruptive ransomware attacks and phishing campaigns,&#8221; reads <a href="https://home.treasury.gov/news/press-releases/jy0127" target="_blank" rel="noopener">a Treasury assessment from April 2021</a>.</p>
<p>While Horohorin seems convinced the FSB is disseminating malware, it is not unusual for a large number of security tools used by <a href="https://www.virustotal.com" target="_blank" rel="noopener">VirusTotal</a> or other similar malware &#8220;sandbox&#8221; services to incorrectly flag safe files as bad or suspicious &#8212; an all-too-common condition known as a &#8220;false positive.&#8221;</p>
<p>Late last year I <a href="https://twitter.com/briankrebs/status/1326235217250672641" target="_blank" rel="noopener">warned my followers on Twitter</a> to put off installing updates for their <strong>Dell</strong> products until the company could explain why a bunch of its software drivers were being detected as malware by two dozen antivirus tools. Those all turned out to be false positives.</p>
<p>To really figure out what this FSB software was doing, I turned to <strong>Lance James</strong>, the founder of <a href="https://www.unit221b.com" target="_blank" rel="noopener">Unit221B</a>, a New York City based cybersecurity firm. James said each download request generates a new executable program. That is because the uniqueness of the file itself is part of what makes the one-to-one encrypted connection possible.<span id="more-55809"></span></p>
<p>&#8220;Essentially it is like a temporary, one-time-use VPN, using a separate key for each download&#8221; James said. &#8220;The executable is the handshake with you to exchange keys, as it stores the key for that session in the exe. It&#8217;s a terrible approach. But it&#8217;s what it is.&#8221;</p>
<p>James said the FSB&#8217;s program does not appear to be malware, at least in terms of the actions it takes on a user&#8217;s computer.</p>
<p>&#8220;There&#8217;s no sign of actual trojan activity here except the fact it self deletes,&#8221; James said. &#8220;It uses GOST encryption, and [the antivirus products] may be thinking that those properties look like ransomware.&#8221;</p>
<p>James says he suspects the antivirus false-positives were triggered by certain behaviors which could be construed as malware-like. The screenshot below &#8212; from VirusTotal &#8212; says some of the file&#8217;s contents align with detection rules made to find instances of ransomware.</p>
<div id="attachment_55825" style="width: 767px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55825" loading="lazy" class=" wp-image-55825" src="media/e90bd832.fsb-sigma.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/fsb-sigma.png" alt="" width="757" height="481" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/fsb-sigma.png 945w, https://krebsonsecurity.com/wp-content/uploads/2021/06/fsb-sigma-768x488.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/06/fsb-sigma-782x497.png 782w" sizes="(max-width: 757px) 100vw, 757px" /><p id="caption-attachment-55825" class="wp-caption-text">Some of the malware detection rules triggered by the FSB&#8217;s software. Source: VirusTotal.</p></div>
<p>Other detection rules tripped by this file include program routines that erase event logs from the user&#8217;s system &#8212; a behavior often seen in malware that is trying to hide its tracks.</p>
<p>On a hunch that just including the GOST encryption routine in a test program might be enough to trigger false positives in VirusTotal, James wrote and compiled a short program in <a href="https://en.wikipedia.org/wiki/C%2B%2B" target="_blank" rel="noopener">C++</a> that invoked the GOST cipher but otherwise had no networking components. He then uploaded the file for scanning at VirusTotal.</p>
<p>Even though James&#8217; test program did nothing untoward or malicious, it was <a href="https://www.virustotal.com/gui/file/16e943a9db575be34eeb5f7cbe118451397661db0f0d9a7d3356c2f85701866d/detection" target="_blank" rel="noopener">flagged by six antivirus engines as potentially hostile</a>. Symantec&#8217;s machine learning engine seemed particularly certain that James&#8217; file might be bad, awarding it the threat name &#8220;ML.Attribute.HighConfidence&#8221; &#8212; the same designation it assigned to the FSB&#8217;s program.</p>
<p>KrebsOnSecurity installed the FSB&#8217;s software on a test computer using a separate VPN, and straight away it connected to an Internet address currently assigned to the FSB (213.24.76.xxx).</p>
<p>The program prompted me to click on various parts of the screen to generate randomness for an encryption key, and when that was done it left a small window which explained in Russian that the connection was established and that I should visit a specific link on the FSB&#8217;s site. </p>
<div id="attachment_55833" style="width: 771px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55833" loading="lazy" class=" wp-image-55833" src="media/0d0e6e65.fsb-rngip.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/fsb-rngip.png" alt="" width="761" height="572" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/fsb-rngip.png 1020w, https://krebsonsecurity.com/wp-content/uploads/2021/06/fsb-rngip-768x578.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/06/fsb-rngip-782x588.png 782w" sizes="(max-width: 761px) 100vw, 761px" /><p id="caption-attachment-55833" class="wp-caption-text">The FSB&#8217;s random number generator in action.</p></div>
<p>Doing so opened up a page where I could leave a message for the FSB. I asked them if they had any response to their program being broadly flagged as malware.</p>
<div id="attachment_55835" style="width: 641px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55835" loading="lazy" class="size-full wp-image-55835" src="media/b2b5ef80.fsblocal.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/fsblocal.png" alt="" width="631" height="670" /><p id="caption-attachment-55835" class="wp-caption-text">The contact form that ultimately appeared after installing the FSB&#8217;s software and clicking a specific link at fsb[.]ru.</p></div>
<p>After all the effort, I&#8217;m disappointed to report that I have not yet received a reply. Nor did I hear back from <a href="https://wikileaks.org/plusd/cables/06MOSCOW12936_a.html" target="_blank" rel="noopener">S-Terra CSP</a>, the company that makes the VPN software offered by the FSB.</p>
<p>James said that given their position, he could see why many antivirus products might think it&#8217;s malware.</p>
<p>&#8220;Since they won&#8217;t use our crypto and we won&#8217;t use theirs,&#8221; James said. &#8220;It&#8217;s a great explanation on political weirdness with crypto.&#8221;</p>
<p>Still, James said, a number of things just don&#8217;t make sense about the way the FSB has chosen to deploy its one-time VPN software.</p>
<p>&#8220;The way they have set this up to suddenly trust a dynamically changing exe is still very concerning. Also, why would you send me a 256 random number generator seed in an exe when the computer has a perfectly valid and tested random number generator built in? You&#8217;re sending an exe to me with a key you decide over a non-secure environment. Why the fuck if you&#8217;re a top intelligence agency would you do that?&#8221;</p>
<p>Why indeed. I wonder how many people would share information about federal crimes with the FBI if the agency required everyone to install an executable file first &#8212; to say nothing of one that looks a lot like ransomware to antivirus firms?</p>
<p>After doing this research, I learned the FSB recently launched a website that is only reachable via <a href="https://www.torproject.org/" rel="noopener" target="_blank">Tor</a>, software that protects users’ anonymity by bouncing their traffic between different servers and encrypting the traffic at every step of the way. Unlike the FSB&#8217;s clear web site, the agency&#8217;s Tor site does not ask visitors to download some dodgy software before contacting them.</p>
<p>&#8220;The application is running for a limited time to ensure your safety,&#8221; the instructions for the FSB&#8217;s random number generator assure, with just a gentle nudge of urgency. &#8220;Do not forget to close the application when finished.&#8221;</p>
<p>Yes, don&#8217;t forget that. Also, do not forget to incinerate your computer when finished.</p>


feed_id: https://krebsonsecurity.com/?p=55877
title: Justice Dept. Claws Back $2.3M Paid by Colonial Pipeline to Ransomware Gang
uri: Justice-Dept-Claws-Back-2-3M-Paid-by-Colonial-Pipeline-to-Ransomware
url:
https://krebsonsecurity.com/2021/06/justice-dept-claws-back-2-3m-paid-by-colonial-pipeline-to-ransomware-gang/

content:
<p>The <strong>U.S. Department</strong> <strong>of Justice</strong> said today it has recovered $2.3 million worth of Bitcoin that <strong>Colonial Pipeline</strong> paid to ransomware extortionists last month. The funds had been sent to <strong><a href="https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/" target="_blank" rel="noopener">DarkSide</a></strong>, a ransomware-as-a-service syndicate that disbanded after a May 14 farewell message to affiliates saying its Internet servers and cryptocurrency stash were seized by unknown law enforcement entities.</p>
<p><img loading="lazy" class="aligncenter  wp-image-53514" src="media/0df06f89.ransomware.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware.png" alt="" width="767" height="575" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware.png 1016w, https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware-768x575.png 768w" sizes="(max-width: 767px) 100vw, 767px" /></p>
<p>On May 7, the DarkSide ransomware gang sprang its attack against Colonial, which ultimately paid 75 Bitcoin (~$4.4 million) to its tormentors. The company said the attackers only hit its business IT networks &#8212; not its pipeline security and safety systems &#8212; but that it shut the pipeline down anyway as a precaution [several publications noted Colonial shut down its pipeline because its billing system was impacted, and it had no way to get paid].</p>
<p>On or around May 14, the DarkSide representative on several Russian-language cybercrime forums <a href="https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/" target="_blank" rel="noopener">posted a message saying the group was calling it quits</a>.</p>
<p>&#8220;Servers were seized, money of advertisers and founders was transferred to an unknown account,&#8221; read the farewell message. &#8220;Hosting support, apart from information &#8216;at the request of law enforcement agencies,&#8217; does not provide any other information.&#8221;</p>
<div id="attachment_55589" style="width: 484px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55589" loading="lazy" class="size-full wp-image-55589" src="media/2da6d5a2.ds-bye.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/ds-bye.png" alt="" width="474" height="630" /><p id="caption-attachment-55589" class="wp-caption-text">A message from the DarkSide and REvil ransomware-as-a-service cybercrime affiliate programs.</p></div>
<p>Many security experts said they suspected DarkSide was just laying low for a while thanks to the heat from the Colonial attack, and that the group would re-emerge under a new banner in the coming months. And while that may be true, the seizure announced today by the DOJ certainly supports the DarkSide administrator&#8217;s claims that their closure was involuntary.</p>
<p>Security firms have suspected for months that the DarkSide gang shares some leadership with that of <a href="https://krebsonsecurity.com/?s=revil" rel="noopener" target="_blank">REvil, a.k.a. Sodinokibi</a>, another ransomware-as-a-service platform that closed up shop in 2019 after bragging that it had extorted more than $2 billion from victims. That suspicion was solidified further when the REvil administrator added his comments to the announcement about DarkSide&#8217;s closure (see screenshot above).</p>
<p>First surfacing on Russian language hacking forums in August 2020, DarkSide is a ransomware-as-a-service platform that vetted cybercriminals can use to infect companies with ransomware and carry out negotiations and payments with victims. DarkSide says it targets only big companies, and forbids affiliates from dropping ransomware on organizations in several industries, including healthcare, funeral services, education, public sector and non-profits.</p>
<p>According to <a href="https://www.elliptic.co/blog/darkside-ransomware-has-netted-over-90-million-in-bitcoin" target="_blank" rel="noopener">an analysis</a> published May 18 by cryptocurrency security firm <strong>Elliptic</strong>, 47 cybercrime victims paid DarkSide a total of $90 million in Bitcoin, putting the average ransom payment of DarkSide victims at just shy of $2 million.</p>
<p><H2>HOW DID THEY DO IT?</H2></p>
<p>The DoJ&#8217;s <a href="https://www.justice.gov/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside" target="_blank" rel="noopener">announcement</a> left open the question of how exactly it was able to recover a portion of the payment made by Colonial, which shut down its Houston to New England fuel pipeline for a week and prompted long lines, price hikes and gas shortages at filling stations across the nation.</p>
<p>The DOJ said law enforcement was able to track multiple transfers of bitcoin and identify that approximately 63.7 bitcoins (~$3.77 million on May 8), &#8220;representing the proceeds of the victim&#8217;s ransom payment, had been transferred to a specific address, for which the FBI has the &#8216;private key,&#8217; or the rough equivalent of a password needed to access assets accessible from the specific Bitcoin address.&#8221;</p>
<div id="attachment_55881" style="width: 676px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55881" loading="lazy" class=" wp-image-55881" src="media/bcf6fc88.fbi-ds.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/fbi-ds.png" alt="" width="666" height="264" /><p id="caption-attachment-55881" class="wp-caption-text">A passage from the DOJ&#8217;s press release today.</p></div>
<p>How it came to have that private key is the key question. <strong>Nicholas Weaver</strong>, a lecturer at the computer science department at <strong>University of California, Berkeley</strong>, said the most likely explanation is that law enforcements agent seized money from a specific DarkSide affiliate responsible for bringing the crime gang the initial access to Colonial&#8217;s systems.</p>
<p>&#8220;The &#8216;obtained the private key&#8217; part of their statement is doing a lot of work,&#8221; Weaver said, point out that the amount the FBI recovered was less than the full amount Colonial paid.</p>
<p>&#8220;It is ONLY the Colonial Pipeline ransom, and it looks to be only the affiliate&#8217;s take.&#8221;</p>
<p>Experts at Elliptic came to the same conclusion.</p>
<p>&#8220;Any ransom payment made by a victim is then split between the affiliate and the developer,&#8221; <a href="https://www.elliptic.co/blog/us-authorities-seize-darkside" target="_blank" rel="noopener">writes</a> Elliptic&#8217;s co-founder <strong>Tom Robinson</strong>. &#8220;In the case of the Colonial Pipeline ransom payment, 85% (63.75 BTC) went to the affiliate and 15% went to the DarkSide developer.&#8221;</p>
<p>The Biden administration is under increasing pressure to do something about the epidemic of ransomware attacks. In conjunction with today&#8217;s action, the DOJ <a href="https://www.justice.gov/opa/press-release/file/1402006/download" target="_blank" rel="noopener">called attention to the wins of its Ransomware and Digital Extortion Task Force</a>, which have included successful prosecutions of crooks behind such threats as the Netwalker and SamSam ransomware strains.</p>
<p>The DOJ also released <a href="https://www.justice.gov/opa/press-release/file/1402001/download" target="_blank" rel="noopener">a June 3 memo</a> from <strong>Deputy Attorney General Lisa O. Monaco</strong> instructing all federal prosecutors to adhere to new guidelines that seek centralize reporting about ransomware victims.</p>
<p>Having a central place for law enforcement and intelligence agencies to gather and act on ransomware threats was one of the key <a href="https://krebsonsecurity.com/2021/04/task-force-seeks-to-disrupt-ransomware-payments/" target="_blank" rel="noopener">recommendations of a ransomware task force being led by some of the world&#8217;s top tech firms</a>. In an 81-page report, the industry led task force called for an international coalition to combat ransomware criminals, and for a global network of investigation hubs. Their recommendations focus mainly on disrupting cybercriminal ransomware gangs by limiting their ability to get paid, and targeting the individuals and finances of the organized thieves behind these crimes.</p>


feed_id: https://krebsonsecurity.com/?p=55896
title: Microsoft Patches Six Zero-Day Security Holes
uri: Microsoft-Patches-Six-Zero-Day-Security-Holes
url: https://krebsonsecurity.com/2021/06/microsoft-patches-six-zero-day-security-holes/
content:
<p><strong>Microsoft</strong> today released another round of security updates for <strong>Windows</strong> operating systems and supported software, <em>including fixes for six zero-day bugs that malicious hackers already are exploiting in active attacks.</em></p>
<p><img loading="lazy" class="aligncenter size-full wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="579" height="425" /></p>
<p>June&#8217;s Patch Tuesday addresses just 49 security holes &#8212; about half the normal number of vulnerabilities lately. But what this month lacks in volume it makes up for in urgency: Microsoft warns that bad guys are leveraging a half-dozen of those weaknesses to break into computers in targeted attacks.</p>
<p>Among the zero-days are:</p>
<p>&#8211;<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-33742" target="_blank" rel="noopener">CVE-2021-33742</a>, a remote code execution bug in a Windows HTML component.<br />
&#8211;<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31955" target="_blank" rel="noopener">CVE-2021-31955</a>, an information disclosure bug in the Windows Kernel<br />
&#8211;<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31956" target="_blank" rel="noopener">CVE-2021-31956</a>, an elevation of privilege flaw in Windows NTFS<br />
&#8211;<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-33739" target="_blank" rel="noopener">CVE-2021-33739</a>, an elevation of privilege flaw in the Microsoft Desktop Window Manager<br />
&#8211;<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31201" target="_blank" rel="noopener">CVE-2021-31201</a>, an elevation of privilege flaw in the Microsoft Enhanced Cryptographic Provider<br />
&#8211;<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31199" target="_blank" rel="noopener">CVE-2021-31199</a>, an elevation of privilege flaw in the Microsoft Enhanced Cryptographic Provider</p>
<p><strong>Kevin Breen</strong>, director of cyber threat research at <strong>Immersive Labs</strong>, said elevation of privilege flaws are just as valuable to attackers as remote code execution bugs: Once the attacker has gained an initial foothold, he can move laterally across the network and uncover further ways to escalate to system or domain-level access.</p>
<p>&#8220;This can be hugely damaging in the event of ransomware attacks, where high privileges can enable the attackers to stop or destroy backups and other security tools,&#8221; Breen said. &#8220;The &#8216;exploit detected&#8217; tag means attackers are actively using them, so for me, it’s the most important piece of information we need to prioritize the patches.&#8221;<span id="more-55896"></span></p>
<p>Microsoft also patched five critical bugs &#8212; flaws that can be remotely exploited to seize control over the targeted Windows computer without any help from users. <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31959" target="_blank" rel="noopener">CVE-2021-31959</a> affects everything from <strong>Windows 7</strong> through <strong>Windows 10</strong> and <strong>Server</strong> versions <strong>2008</strong>,<strong> 2012</strong>, <strong>2016</strong> and <strong>2019</strong>.</p>
<p><strong>Sharepoint</strong> also got a critical update in <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31963" target="_blank" rel="noopener">CVE-2021-31963</a>; Microsoft says this one is less likely to be exploited, but then critical Sharepoint flaws are a favorite target of ransomware criminals.</p>
<p>Interestingly, two of the Windows zero-day flaws &#8212; CVE-2021-31201 and CVE-2021-31199 &#8212; are related to a patch <strong>Adobe</strong> released today for <a href="https://helpx.adobe.com/security/products/acrobat/apsb21-29.html" target="_blank" rel="noopener">CVE-2021-28550</a>, a flaw in <strong>Adobe Acrobat</strong> and <strong>Reader</strong> that also is being actively exploited.</p>
<p>&#8220;Attackers have been seen exploiting these vulnerabilities by sending victims specially crafted PDFs, often attached in a phishing email, that when opened on the victim&#8217;s machine, the attacker is able to gain arbitrary code execution,&#8221; said<strong> Christopher Hass</strong>, director of information security and research at <strong>Automox</strong>. &#8220;There are no workarounds for these vulnerabilities, patching as soon as possible is highly recommended.&#8221;</p>
<p>In addition to updating Acrobat and Reader, Adobe patched flaws in a slew of other products today, including <strong>Adobe Connect,</strong> <strong>Photoshop</strong>, and <strong>Creative Cloud</strong>. The full list is <a href="https://helpx.adobe.com/security.html" target="_blank" rel="noopener">here</a>, with links to updates.</p>
<p>The usual disclaimer:</p>
<p>Before you update with this month’s patch batch, please make sure you have backed up your system and/or important files. It’s not uncommon for Windows updates to hose one’s system or prevent it from booting properly, and some updates even have been known to erase or corrupt files.</p>
<p>So do yourself a favor and backup <em>before</em> installing any patches. Windows 10 even has <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">some built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, see <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">this guide</a>.</p>
<p>As always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips.</p>
<p>For a quick visual breakdown of each update released today and its severity level, check out the <a href="https://isc.sans.edu/forums/diary/Microsoft+June+2021+Patch+Tuesday/27506/" target="_blank" rel="noopener">this Patch Tuesday post</a> from the <strong>SANS Internet Storm Center</strong>.</p>


feed_id: https://krebsonsecurity.com/?p=55911
title: How Does One Get Hired by a Top Cybercrime Gang?
uri: How-Does-One-Get-Hired-by-a-Top-Cybercrime-Gang
url: https://krebsonsecurity.com/2021/06/how-does-one-get-hired-by-a-top-cybercrime-gang/
content:
<p>The<strong> U.S. Department of Justice </strong>(DOJ) last week announced the arrest of a 55-year-old Latvian woman who&#8217;s alleged to have worked as a programmer for <strong>Trickbot</strong>, a malware-as-a-service platform responsible for infecting millions of computers and seeding many of those systems with ransomware.</p>
<p>Just how did a self-employed web site designer and mother of two come to work for one of the world&#8217;s most rapacious cybercriminal groups and then leave such an obvious trail of clues indicating her involvement with the gang? This post explores answers to those questions, as well as some of the ways Trickbot and other organized cybercrime gangs gradually recruit, groom and trust new programmers.</p>
<div id="attachment_55940" style="width: 1400px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55940" loading="lazy" class="size-full wp-image-55940" src="media/4b8ebf3e.allawitte.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/allawitte.png" alt="" width="1390" height="725" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/allawitte.png 1390w, https://krebsonsecurity.com/wp-content/uploads/2021/06/allawitte-768x401.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/06/allawitte-782x408.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/06/allawitte-267x140.png 267w" sizes="(max-width: 1390px) 100vw, 1390px" /><p id="caption-attachment-55940" class="wp-caption-text">Alla Witte&#8217;s personal website &#8212; allawitte[.]nl &#8212; circa October 2018.</p></div>
<p>The <a href="https://www.justice.gov/opa/press-release/file/1401766/download" target="_blank" rel="noopener">indictment released by the DOJ</a> (PDF) is heavily redacted, and only one of the defendants is named: <strong>Alla &#8220;Max&#8221; Witte</strong>, a 55-year-old Latvian national who was arrested Feb. 6 in Miami, Fla.</p>
<p>The DOJ alleges Witte was responsible for &#8220;overseeing the creation of code related to the monitoring and tracking of authorized users of the Trickbot malware, the control and deployment of ransomware, obtaining payments from ransomware victims, and developing tools and protocols for the storage of credentials stolen and exfiltrated from victims infected by Trickbot.&#8221;</p>
<p>The indictment also says Witte provided code to the Trickbot Group for a web panel used to access victim data stored in a database. According to the government, that database contained a large number of credit card numbers and stolen credentials from the Trickbot botnet, as well as information about infected machines available as bots.</p>
<p>&#8220;Witte provided code to this repository that showed an infected computer or &#8216;bot&#8217; status in different colors based on the colors of a traffic light and allowed other Trickbot Group members to know when their co-conspirators were working on a particular infected machine,&#8221; the indictment alleges.</p>
<p>While any law enforcement action against a crime group that has targeted hospitals, schools, public utilities and governments is good news, Witte&#8217;s indictment and arrest were probably inevitable: It is hard to think of an accused cybercriminal who has made more stunningly poor and rookie operational security mistakes than this Latvian senior citizen.</p>
<p>For starters, it appears at one point in 2020 Witte actually <a href="https://twitter.com/cybsecbot/status/1401588458666270722" rel="noopener" target="_blank">hosted Trickbot malware on a vanity website registered in her name</a> &#8212; <a href="https://web.archive.org/web/20170914053226/http://allawitte.nl/" target="_blank" rel="noopener">allawitte[.]nl</a>.</p>
<p>While it is generally a bad idea for cybercriminals to mix their personal life with work, Witte&#8217;s social media accounts mention a close family member (perhaps her son or husband) had the first name &#8220;Max,&#8221; which allegedly was her hacker handle.</p>
<p>Unlike many accused cybercriminals who hail from Russia or former Soviet countries, Witte did not feel obligated to avoid traveling to areas where she might be within reach of U.S. law enforcement agencies. According to her indictment, Witte was living in the South American nation of <a href="https://en.wikipedia.org/wiki/Suriname" rel="noopener" target="_blank">Suriname</a> and she was arrested in Miami while flying from Suriname. It is not clear where her intended destination was.</p>
<div id="attachment_55950" style="width: 540px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55950" loading="lazy" src="media/0e087b62.coolprogrammer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/coolprogrammer.png" alt="" width="530" height="162" class="size-full wp-image-55950" /><p id="caption-attachment-55950" class="wp-caption-text">A Google-translated post Witte made to her Vkontakte page, five years before allegedly joining the Trickbot group.</p></div>
<p><strong>Alex Holden</strong>, founder of the cybersecurity intelligence firm Hold Security, said Witte&#8217;s greatest lapse in judgment came around Christmas time in 2019, when she infected one of her own computers with the Trickbot malware &#8212; allowing it to steal and log her data within the botnet interface.</p>
<p>&#8220;On top of the password re-use, the data shows a great insight into her professional and personal Internet usage,&#8221; Holden wrote in <a href="https://holdsecurity.com/news/2021/06/trickbot-gang-arrest-story-of-alla-witte/" target="_blank" rel="noopener">a blog post on Witte&#8217;s arrest</a>.</p>
<p>&#8220;Many in the gang not only knew her gender but her name too,&#8221; Holden wrote. &#8220;Several group members had AllaWitte folders with data. They refer to Alla almost like they would address their mothers.&#8221;</p>
<p>So how did this hacker mom with apparently zero sense of self-preservation come to work for one of the world&#8217;s most predatory cybercriminal gangs?<span id="more-55911"></span></p>
<p>The government&#8217;s indictment dedicates several pages to describing the hiring processes of the Trickbot group, which continuously scoured fee-based Russian and Belarussian-based job websites for resumes of programmers looking for work. Those who responded were asked to create various programs designed to test the applicant&#8217;s problem-solving and coding skills.</p>
<p>Here&#8217;s a snippet of translated instant message text between two of the unnamed Trickbot defendants, in which they discuss an applicant who understood immediately that he was being hired to help with cybercrime activity.</p>
<div id="attachment_55937" style="width: 613px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55937" loading="lazy" class="size-full wp-image-55937" src="media/aa912a2d.trickbot-blackhat.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/trickbot-blackhat.png" alt="" width="603" height="725" /><p id="caption-attachment-55937" class="wp-caption-text">A conversation between two Trickbot group members concerning a potential new hire. Image: DOJ.</p></div>
<p>The following conversation, on or about June 1, 2016, concerned a potential new Trickbot hire who successfully completed a test task that involved altering a Firefox Web browser.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-55938" src="media/b34b99d3.trickbot-working.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/trickbot-working.png" alt="" width="614" height="631" /></p>
<p>Other conversation snippets in the indictment suggest the majority of new recruits understand that what the projects and test tasks they are being asked to perform are related to cybercrime activity.</p>
<p>&#8220;The majority understand that this is blackhat and asking for the commercial target,&#8221; wrote the defendant identified only as Co-Conspirator 8 (CC8).</p>
<p>But what about new hires that aren&#8217;t hip to exactly how the programs they&#8217;re being asked to create get used? Another source in the threat intelligence industry who has had access to the inner workings of Trickbot provided some additional context on how developers are onboarded into the group.</p>
<p>&#8220;There&#8217;s a two-step hiring process where at first you may not understand who you&#8217;re working for,&#8221; said the source. &#8220;But that timeframe is typically pretty short, like less than a year.&#8221;</p>
<p>After that, if the candidate is talented and industrious enough, someone in the Trickbot group will &#8220;read in&#8221; the new recruit &#8212; i.e. explain in plain terms how their work is being used.</p>
<p>&#8220;If you&#8217;re good, at some point they&#8217;re going to read you in and you&#8217;ll know, but if you&#8217;re not good or you&#8217;re not okay with that, they will triage that pretty quickly and your services will no longer be required,&#8221; the source said. &#8220;But if you make it past that first year, the chances that you still don&#8217;t know what you&#8217;re doing are very slim.&#8221;</p>
<p>According to the DOJ, Witte had access to Trickbot for roughly two years between 2018 and 2020.</p>
<p>Investigators say prior to launching Trickbot, some members of the conspiracy previously were responsible for disseminating <a href="https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/dyre/" target="_blank" rel="noopener">Dyre</a>, a particularly stealthy password stealer that looked for passwords used at various banks. The government says Trickbot members &#8212; including Witte &#8212; routinely used bank account passwords stolen by their malware to drain victim bank accounts and send the money to <a href="https://krebsonsecurity.com/?s=money+mules" target="_blank" rel="noopener">networks of money mules</a>.</p>
<p>The hiring model adopted by Trickbot allows the gang to recruit a steady stream of talented developers cheaply and covertly. But it also introduces the very real risk that new recruits may offer investigators a way to infiltrate the group&#8217;s operations, and possibly even identify co-conspirators.</p>
<p>Ransomware attacks are nearly all perpetrated these days by ransomware affiliate groups which <a href="https://krebsonsecurity.com/2020/10/amid-an-embarrassment-of-riches-ransom-gangs-increasingly-outsource-their-work/" rel="noopener" target="_blank">constantly recruit new members</a> to account for attrition, competition from other ransomware groups, and for the odd affiliate who gets busted by law enforcement.</p>
<p>Under the ransomware affiliate model, a cybercriminal can earn up to 85 percent of the total ransom paid by a victim company he or she is responsible for compromising and bringing to the group. But from time to time, poor operational security by an affiliate exposes the gang&#8217;s entire operation.</p>
<p>On June 7, the DOJ <a href="https://krebsonsecurity.com/2021/06/justice-dept-claws-back-2-3m-paid-by-colonial-pipeline-to-ransomware-gang/#more-55877" target="_blank" rel="noopener">announced it had clawed back $2.3 million worth of Bitcoin that Colonial Pipeline paid to ransomware extortionists last month</a>. The funds had been sent to <a href="https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/" rel="noopener" target="_blank">DarkSide</a>, a ransomware-as-a-service syndicate that disbanded after a May 14 farewell message to affiliates saying its Internet servers and cryptocurrency stash were seized by unknown law enforcement entities.</p>
<p>&#8220;The proceeds of the victim’s ransom payment&#8230;had been transferred to a specific address, for which the FBI has the ‘private key,’ or the rough equivalent of a password needed to access assets accessible from the specific Bitcoin address,&#8221; the DOJ explained, somewhat cryptically.</p>
<p>Multiple security experts quickly zeroed in on how investigators were able to retrieve the funds, which did not represent the total amount Colonial paid (~$4.4 million): The amount seized was roughly what a top DarkSide affiliate would have earned for scoring the initial malware infection that precipitated the ransomware incident.</p>


feed_id: https://krebsonsecurity.com/?p=55973
title: Ukrainian Police Nab Six Tied to CLOP Ransomware
uri: Ukrainian-Police-Nab-Six-Tied-to-CLOP-Ransomware
url: https://krebsonsecurity.com/2021/06/ukrainian-police-nab-six-tied-to-clop-ransomware/
content:
<p>Authorities in Ukraine this week charged six people alleged to be part of the <strong>CLOP ransomware group</strong>, a cybercriminal gang said to have extorted more than half a billion dollars from victims. Some of CLOP&#8217;s victims this year alone include<strong> Stanford University Medical School</strong>, the <strong>University of California</strong>, and <strong>University of Maryland</strong>.</p>
<div id="attachment_55976" style="width: 747px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55976" loading="lazy" class="size-full wp-image-55976" src="media/5e48e039.ucp-tesla.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/ucp-tesla.png" alt="" width="737" height="417" /><p id="caption-attachment-55976" class="wp-caption-text">A still shot from a video showing Ukrainian police seizing a Tesla, one of many high-end vehicles seized in this week&#8217;s raids on the Clop gang.</p></div>
<p>According to <a href="https://www.npu.gov.ua/ua/news/kiberzlochini/kiberpolicziya-vikrila-xakerske-ugrupovannya-u-rozpovsyudzhenni-virusu-shifruvalnika-ta-nanesenni-inozemnim-kompaniyam-piv-milyarda-dolariv-zbitkiv/" target="_blank" rel="noopener">a statement</a> and videos released today, the Ukrainian Cyber Police charged six defendants with various computer crimes linked to the CLOP gang, and conducted 21 searches throughout the Kyiv region.</p>
<p>First debuting in early 2019, CLOP is one of several ransomware groups that hack into organizations, launch ransomware that encrypts files and servers, and then demand an extortion payment in return for a digital key needed to unlock access.</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/PqGaZgepNTE" width="700" height="315" frameborder="0" allowfullscreen="allowfullscreen"><span data-mce-type="bookmark" style="display: inline-block; width: 0px; overflow: hidden; line-height: 0;" class="mce_SELRES_start">﻿</span></iframe>/</div>
<p>CLOP has been especially busy over the past six months exploiting four different zero-day vulnerabilities in <strong>File Transfer Appliance</strong> (FTA), a file sharing product made by California-based <a href="https://www.accellion.com/company/security-updates/mandiant-issues-final-report-regarding-accellion-fta-attack/" target="_blank" rel="noopener">Accellion</a>.</p>
<p>The CLOP gang seized on those flaws <a href="https://www.recordedfuture.com/dewmode-accellion-supply-chain-impact/" target="_blank" rel="noopener">to deploy ransomware to a significant number of Accellion&#8217;s FTA customers</a>, including U.S. grocery chain <strong>Krogers</strong>, the law firm <strong>Jones Day</strong>, security firm <strong>Qualys</strong>, and the Singaporean telecom giant <strong>Singtel</strong>.</p>
<p>Last year, CLOP adopted the practice of attempting to extract a second ransom demand from victims in exchange for a promise not to publish or sell any stolen data. Terabytes of documents and files stolen from victim organizations that have not paid a data ransom are now available for download from CLOP&#8217;s deep web site, including Stanford, UCLA and the University of Maryland.</p>
<div id="attachment_55974" style="width: 945px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55974" loading="lazy" class="size-full wp-image-55974" src="media/efa4091e.clopleaks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/clopleaks.png" alt="" width="935" height="725" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/clopleaks.png 935w, https://krebsonsecurity.com/wp-content/uploads/2021/06/clopleaks-768x596.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/06/clopleaks-782x606.png 782w" sizes="(max-width: 935px) 100vw, 935px" /><p id="caption-attachment-55974" class="wp-caption-text">CLOP&#8217;s victim shaming blog on the deep web.</p></div>
<p><span id="more-55973"></span></p>
<p>It&#8217;s not clear how much this law enforcement operation by Ukrainian authorities will affect the overall operations of the CLOP group. Cybersecurity intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a> says the law enforcement raids in Ukraine were limited to the cash-out and money laundering side of CLOP’s business only.</p>
<p>&#8220;We do not believe that any core actors behind CLOP were apprehended, due to the fact that they are probably living in Russia,&#8221; Intel 471 concluded. &#8220;The overall impact to CLOP is expected to be minor although this law enforcement attention may result in the CLOP brand getting abandoned as we&#8217;ve recently seen with other ransomware groups like <a href="https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/" target="_blank" rel="noopener">DarkSide</a> and <a href="https://www.bleepingcomputer.com/news/security/babuk-quits-ransomware-encryption-focuses-on-data-theft-extortion/" target="_blank" rel="noopener">Babuk</a>&#8221; [links added].</p>
<p>While CLOP as a moneymaking collective is fairly young organization, security experts say CLOP members hail from a group of Threat Actors (TA) known as &#8220;<a href="https://attack.mitre.org/groups/G0092/" target="_blank" rel="noopener">TA505</a>,&#8221; which <strong>MITRE</strong>&#8216;s <strong>ATT&amp;CK</strong> database says is a financially motivated cybercrime group that has been active since at least 2014. &#8220;This group is known for frequently changing malware and driving global trends in criminal malware distribution,&#8221; MITRE assessed.</p>


feed_id: https://krebsonsecurity.com/?p=55971
title: First American Financial Pays Farcical $500K Fine
uri: First-American-Financial-Pays-Farcical-500K-Fine
url: https://krebsonsecurity.com/2021/06/first-american-financial-pays-farcical-500k-fine/
content:
<p>In May 2019, KrebsOnSecurity broke the news that the website of mortgage settlement giant <a href="https://en.wikipedia.org/wiki/First_American_Corporation" target="_blank" rel="noopener">First American Financial Corp.</a> [<a href="https://www.marketbeat.com/stocks/NYSE/FAF/" target="_blank" rel="noopener">NYSE:FAF</a>] was <a href="https://krebsonsecurity.com/2019/05/first-american-financial-corp-leaked-hundreds-of-millions-of-title-insurance-records/" target="_blank" rel="noopener">leaking more than 800 million documents</a> &#8212; many containing sensitive financial data &#8212; related to real estate transactions dating back 16 years. This week, the <strong>U.S. Securities and Exchange Commission</strong> settled its investigation into the matter after the Fortune 500 company agreed to pay a paltry penalty of less than $500,000.</p>
<div id="attachment_47830" style="width: 995px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-47830" loading="lazy" class="size-full wp-image-47830" src="media/e0ba395a.firstamericanfinancial.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/firstamericanfinancial.jpg" alt="" width="985" height="586" /><p id="caption-attachment-47830" class="wp-caption-text">First American Financial Corp.</p></div>
<p>If you bought or sold a property in the last two decades or so, chances are decent that you also gave loads of personal and financial documents to First American. According to <a href="https://www.alta.org/publications/press-release.cfm?ALTA-Reports-Title-Premium-Volume-Increases-217-Percent-in-2020" target="_blank" rel="noopener">data</a> from the <strong>American Land Title Association</strong>, First American is the second largest mortgage title and settlement company in the United States, handling nearly a quarter of all closings each year.</p>
<p>The SEC says First American derives nearly 92 percent of its revenue from its title insurance segment, earning $7.1 billion last year.</p>
<p>Title insurance protects homebuyers from the prospect of someone contesting their legitimacy as the new homeowner. According to <a href="https://www.simpleshowing.com/blog/who-pays-for-the-title-insurance" target="_blank" rel="noopener">SimpleShowing.com</a>, there are actually two title insurance policies in each transaction &#8212; one for the buyer and one for the lender (the latter also needs protection as they’re providing the mortgage to purchase the home).</p>
<p>Title insurance is not mandated by law, but most lenders require it as part of any mortgage transaction. In other words, if you wish to take out a mortgage on a home you will not be able to do so without giving companies like First American gobs of documents about your income, assets and liabilities &#8212; including quite a bit of sensitive financial data.</p>
<p>Aside from its core business competency &#8212; checking to make sure the property at issue in any real estate transaction is unencumbered by any liens or other legal claims against it &#8212; First American basically has one job: Protect the privacy and security of all these documents.</p>
<div id="attachment_47843" style="width: 767px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-47843" loading="lazy" class=" wp-image-47843" src="media/49e128d0.sample-fa.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/sample-fa.jpg" alt="" width="757" height="619" /><p id="caption-attachment-47843" class="wp-caption-text">A redacted screenshot of one of many millions of sensitive records exposed by First American&#8217;s Web site.</p></div>
<p>It&#8217;s easy to see why companies like First American might not view protecting this data as sacrosanct, as the entire industry&#8217;s incentive for safeguarding all those sensitive documents is somewhat misaligned.</p>
<p>That is to say, in the title insurance industry the parties to a real estate transaction aren&#8217;t customers, but rather <em>they are are the product</em>. The actual customers of the title insurance companies are principally the banks which back these mortgage transactions.</p>
<p>We see a similar dynamic with social media platforms, where the &#8220;user&#8221; is not the customer at all but the product whose data is being bought and sold by these platforms.</p>
<p>Roughly five months before KrebsOnSecurity notified First American that anyone with a web browser could view sensitive document in its &#8220;Eagle Pro&#8221; database online just by changing some characters at the end of a link, an internal security audit at First American flagged the exact same vulnerability.</p>
<p>But the company never acted to fix it until the news media came calling.<span id="more-55971"></span></p>
<p>The SEC&#8217;s <a href="media/1d04a10a.34-92176.pdf" data-original-source="https://www.sec.gov/litigation/admin/2021/34-92176.pdf" target="_blank" rel="noopener">administrative proceeding</a> (PDF) explains how things slipped through the cracks. Under First American’s documented vulnerability remediation policies, the data leak was classified as a security weakness with a &#8220;level 3&#8221; severity, which placed it in the &#8220;medium risk&#8221; category and required remediation within 45 days.</p>
<p>But rather than recording the vulnerability as a level 3 severity, due to a clerical error the vulnerability was erroneously entered as a level 2 or &#8220;low risk&#8221; severity in First American’s automated tracking system. Level 2 issues required remediation within 90 days. Even so, First American missed that mark.</p>
<p>The SEC said that under First American’s remediation policies, if the person responsible for fixing the problem is unable to do so based on the timeframes listed above, that employee must have their management contact the company&#8217;s information security department to discuss their remediation plan and proposed time estimate.</p>
<p>&#8220;If it is not technically possible to remediate the vulnerability, or if remediation is cost prohibitive, the [employee] and their management must contact Information Security to obtain a waiver or risk acceptance approval from the CISO,&#8221; the SEC explained. &#8220;The [employee] did not request a waiver or risk acceptance from the CISO.&#8221;</p>
<p>So, <em>someone</em> within First American accepted the risk, but that person neglected to ensure the higher-ups within the company also were comfortable with that risk. It&#8217;s difficult not to hum a tune whenever the phrase &#8220;accepted the risk&#8221; comes up if you&#8217;ve ever seen <a href="https://www.youtube.com/watch?v=9IG3zqvUqJY" target="_blank" rel="noopener">this excellent infosec industry parody</a>.</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/9IG3zqvUqJY" width="760" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>The SEC took aim at First American because a few days after our May 24, 2019 story ran, the company issued an 8-K filing with the agency stating First American had no prior indication of any vulnerability.</p>
<p>&#8220;That statement demonstrated that First American’s senior management was not properly informed of the prior report of a vulnerability and a failure to remediate the problem,&#8221; <a href="https://www.jdsupra.com/legalnews/first-american-financial-corporation-1557953/" target="_blank" rel="noopener">wrote</a> <strong>Michael Volkov</strong>, a 30-year federal prosecutor who now runs <strong>The Volkov Law Group</strong> in Washington, D.C.</p>
<p>Reporting for <strong>Reuters Regulatory Intelligence</strong>, <strong>Richard Satran</strong> says the SEC charged First American with violating <a href="https://regintel.thomsonreuters.com/#accelus/ri/%7B%22location%22%3A%22%23ri%2Fdocument%2FIB24519D3415811E7BBBE00FF10906607%2Fview%2F%257B%2522searchId%2522%253A%2522i0ad69f050000017a11d5ee5bd08edb08%2522%252C%2522resultId%2522%253A%2522i0ad818130000017a11d5e8c5cda6b79f%2522%252C%2522contentType%2522%253A%2522Regulatory%2520Guidance%2520Summaries%2522%252C%2522contentTypeSearchId%2522%253A%2522i0ad69f050000017a11d5e61cd08edaff%2522%252C%2522returnText%2522%253A%2522backToSearch%2522%252C%2522returnTo%2522%253A%2522ri%252Fsearch%252Fi0ad69f050000017a11d5ee5bd08edb08%252Foverview%2522%252C%2522resultsToInclude%2522%253A%2522SUBSCRIBED%2522%252C%2522originType%2522%253A%2522Search%2522%252C%2522originId%2522%253A%2522i0ad69f050000017a11d5ee5bd08edb08%2522%252C%2522highlightTerms%2522%253A%2522240.13a-15%2520Controls%2520and%2520procedures.%2522%252C%2522order%2522%253A%2522RELEVANCE%2522%257D%22%7D" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://regintel.thomsonreuters.com/%23accelus/ri/%257B%2522location%2522%253A%2522%2523ri%252Fdocument%252FIB24519D3415811E7BBBE00FF10906607%252Fview%252F%25257B%252522searchId%252522%25253A%252522i0ad69f050000017a11d5ee5bd08edb08%252522%25252C%252522resultId%252522%25253A%252522i0ad818130000017a11d5e8c5cda6b79f%252522%25252C%252522contentType%252522%25253A%252522Regulatory%252520Guidance%252520Summaries%252522%25252C%252522contentTypeSearchId%252522%25253A%252522i0ad69f050000017a11d5e61cd08edaff%252522%25252C%252522returnText%252522%25253A%252522backToSearch%252522%25252C%252522returnTo%252522%25253A%252522ri%25252Fsearch%25252Fi0ad69f050000017a11d5ee5bd08edb08%25252Foverview%252522%25252C%252522resultsToInclude%252522%25253A%252522SUBSCRIBED%252522%25252C%252522originType%252522%25253A%252522Search%252522%25252C%252522originId%252522%25253A%252522i0ad69f050000017a11d5ee5bd08edb08%252522%25252C%252522highlightTerms%252522%25253A%252522240.13a-15%252520Controls%252520and%252520procedures.%252522%25252C%252522order%252522%25253A%252522RELEVANCE%252522%25257D%2522%257D&amp;source=gmail&amp;ust=1624038375598000&amp;usg=AFQjCNHMJYuOv4ioeN0hyF8iZaeV7CLifg">Rule 13a-15(a) of the Exchange Act.</a></p>
<p>&#8220;The rule broadly requires firms involved in securities issuance to have a compliance process in place to assure material information follows securities laws,&#8221; Satran wrote. &#8220;The SEC avoided getting into the specific details of the breach and instead focused on the way its disclosure was handled.&#8221;</p>
<p><a href="https://www.linkedin.com/in/raschcyber/" target="_blank" rel="noopener">Mark Rasch</a>, also former federal prosecutor in Washington, said the SEC is signaling with this action that it intends to take on more cases in which companies flub security governance in some big way.</p>
<p>&#8220;It&#8217;s a win for the SEC, and for First America, but it&#8217;s hardly justice,&#8221; Rasch said. &#8220;It&#8217;s a paltry fine, and it involves no admission of guilt by First American.&#8221;</p>
<p>Rasch said First American&#8217;s first problem was labeling the weakness as a medium risk.</p>
<p>&#8220;This is lots of sensitive data you&#8217;re exposing to anyone with a web browser,&#8221; Rasch said. &#8220;That&#8217;s a high-risk vulnerability. It also means you probably don&#8217;t know whether or not anyone has accessed that data. There&#8217;s no way to tell unless you can go back through all your logs all those years.&#8221;</p>
<p>The SEC said the 800 million+ records had been publicly available on First American&#8217;s website since 2013. In August 2019, the company said a third-party investigation into the exposure identified just 32 consumers whose non-public personal information likely was accessed without authorization.</p>
<p>When KrebsOnSecurity asked how long it maintained access logs or how far back in time that review went, First American declined to be more specific, saying only that its logs covered a period that was typical for a company of its size and nature.</p>
<p>However, documents from New York financial regulators show First American was unable to determine whether records were accessed prior to Jun 2018 (one year prior to fixing the weakness).</p>
<p>The records exposed by First American would have been a virtual gold mine for phishers and scammers involved in Business Email Compromise (BEC) scams, which often impersonate real estate agents, closing agencies, title and escrow firms in a bid to <a href="https://krebsonsecurity.com/2017/04/blind-trust-in-email-could-cost-you-your-home/" target="_blank" rel="noopener noreferrer">trick property buyers into wiring funds to fraudsters</a>. According to the FBI, BEC scams are the most costly form of cybercrime today.</p>
<p>First American is not out of the regulatory woods yet from this enormous data leak. In July 2020, the <strong>New York State Department of Financial Services</strong> <a href="https://krebsonsecurity.com/2020/07/ny-charges-first-american-financial-for-massive-data-leak/" target="_blank" rel="noopener">announced the company was the target of their first ever cybersecurity enforcement action</a> in connection with the incident, charges that could bring steep financial penalties. That inquiry is ongoing.</p>
<p>The DFS considers each instance of exposed personal information a separate violation, and the company faces penalties of up to $1,000 per violation. According to the SEC, First American&#8217;s EaglePro database contained tens of millions of document images that contained non-public personal information.</p>


feed_id: https://krebsonsecurity.com/?p=56022
title: How Cyber Safe is Your Drinking Water Supply?
uri: How-Cyber-Safe-is-Your-Drinking-Water-Supply
url: https://krebsonsecurity.com/2021/06/how-cyber-safe-is-your-drinking-water-supply/
content:
<p>Amid multiple recent reports of hackers breaking into and tampering with drinking water treatment systems comes a new industry survey with some sobering findings: A majority of the 52,000 separate drinking water systems in the United States still haven&#8217;t inventoried some or any of their information technology systems &#8212; a basic first step in protecting networks from cyberattacks.</p>
<p><img loading="lazy" class="aligncenter wp-image-54338" src="media/eb4dd2bc.drinkwatersupply.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/drinkwatersupply.jpg" alt="" width="672" height="504" /></p>
<p>The <a href="https://www.waterisac.org" target="_blank" rel="noopener">Water Information Sharing and Analysis Center</a> (WaterISAC) &#8212; an industry group that tries to facilitate information sharing and the adoption of best practices among utilities in the water sector &#8212; surveyed roughly 600 employees of water and wastewater treatment facilities nationwide, and found 37.9 percent of utilities have identified all IT-networked assets, with an additional 21.7 percent working toward that goal.</p>
<p>The ISAC found when it comes to IT systems tied to &#8220;operational technology&#8221; (OT) &#8212; systems responsible for monitoring and controlling the industrial operation of these utilities and their safety features &#8212; just 30.5 percent had identified all OT-networked assets, with an additional 22.5 percent working to do so.</p>
<p>&#8220;Identifying IT and OT assets is a critical first step in improving cybersecurity,&#8221; the report concluded. &#8220;An organization cannot protect what it cannot see.&#8221;</p>
<p>It&#8217;s also hard to see threats you&#8217;re not looking for: 67.9 percent of water systems reported no IT security incidents in the last 12 months, a somewhat unlikely scenario.</p>
<p><strong>Michael Arceneaux</strong>, managing director of the WaterISAC, said the survey shows much room for improvement and a need for support and resources.</p>
<p>&#8220;Threats are increasing, and the sector, EPA, CISA and USDA need to collaborate to help utilities prevent and recover from compromises,&#8221; Arceneaux <a href="https://twitter.com/criticalh2o/status/1405638206301868032" target="_blank" rel="noopener">said on Twitter</a>.</p>
<p>While documenting each device that needs protection is a necessary first step, a number of recent cyberattacks on water treatment systems have been blamed on a failure to properly secure water treatment employee accounts that can be used for remote access.</p>
<p>In April, federal prosecutors unsealed an indictment against a 22-year-old from Kansas who&#8217;s accused of <a href="https://www.vice.com/en/article/3anx79/feds-indict-kansas-man-for-allegedly-hacking-into-water-supply" target="_blank" rel="noopener">hacking into a public water system in 2019</a>. The defendant in that case is a former employee of the water district he allegedly hacked.</p>
<p>In February, we learned that <a href="https://krebsonsecurity.com/2021/02/whats-most-interesting-about-the-florida-water-system-hack-that-we-heard-about-it-at-all/" target="_blank" rel="noopener">someone hacked into the water treatment plan in Oldsmar, Fla.</a> and briefly increased the amount of sodium hydroxide (a.k.a. lye used to control acidity in the water) to 100 times the normal level. That incident stemmed from stolen or leaked employee credentials for <strong>TeamViewer</strong>, a popular program that lets users remotely control their computers.</p>
<p>In January, a hacker tried to poison a water treatment plant that served parts of the San Francisco Bay Area, <a href="https://www.nbcnews.com/tech/security/hacker-tried-poison-calif-water-supply-was-easy-entering-password-rcna1206" target="_blank" rel="noopener">reports</a> <strong>Kevin Collier</strong> for NBCNews. The hacker in that case also had the username and password for a former employee&#8217;s TeamViewer account.<span id="more-56022"></span></p>
<div id="attachment_56035" style="width: 768px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56035" loading="lazy" class=" wp-image-56035" src="media/8bb5e298.waterisac-challenges.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/waterisac-challenges.png" alt="" width="758" height="434" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/waterisac-challenges.png 1023w, https://krebsonsecurity.com/wp-content/uploads/2021/06/waterisac-challenges-768x439.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/06/waterisac-challenges-782x447.png 782w" sizes="(max-width: 758px) 100vw, 758px" /><p id="caption-attachment-56035" class="wp-caption-text">Image: WaterISAC.</p></div>
<p><strong>Andrew Hildick-Smith</strong> is a consultant who served more than 15 years managing remote access systems for the Massachusetts Water Resources Authority. He said the percentage of companies that reported already having inventoried all of their IT systems is roughly equal to the number of larger water utilities (greater than 50,000 population) that recently had to certify to the <strong>Environmental Protection Agency</strong> (EPA) that they are compliant with <a href="https://www.epa.gov/ground-water-and-drinking-water/americas-water-infrastructure-act-2018-awia" target="_blank" rel="noopener">the Water Infrastructure Act of 2018</a>.</p>
<p>The water act gives utilities serving between 3,300 and 50,000 residents until the end of this month to complete a cybersecurity risk and resiliency assessment.</p>
<p>But Hildick-Smith said the vast majority of the nation&#8217;s water utilities &#8212; tens of thousands of them &#8212; serve fewer than 3,300 residents, and those utilities currently do not have to report to the EPA about their cybersecurity practices (or the lack thereof).</p>
<p>&#8220;A large number of utilities &#8212; probably close to 40,000 of them &#8212; are small enough that they haven&#8217;t been asked to do anything,&#8221; he said. &#8220;But some of those utilities are kind of doing cybersecurity based on self motivation rather than any requirement.&#8221;</p>
<p>According to the WaterISAC, a great many of the nation&#8217;s water utilities are subject to economic disadvantages typical of rural and urban communities.</p>
<p>&#8220;Others do not have access to a cybersecurity workforce,&#8221; the report explains. &#8220;Operating in the background is that these utilities are struggling to maintain and replace infrastructure, maintain revenues while addressing issues of affordability, and comply with safe and clean water regulations.&#8221;</p>
<p>The report makes the case for federal funding of state and local systems to provide cybersecurity training, tools and services for those in charge of maintaining IT systems, noting that 38 percent of water systems allocate less than 1 percent of their annual budgets to cybersecurity.</p>
<p>As the recent hacking incidents above can attest, enabling some form of multi-factor authentication for remote access can blunt many of these attacks.</p>
<p>However, the sharing of remote access credentials among water sector employees may be a contributing factor in these recent incidents, since organizations that let multiple employees use the same account also are less likely to have any form of multi-factor enabled.</p>
<p>A copy of the Water ISAC report is available <a href="media/e65ef047.atingCouncil_Cybersecurity_State_of_the_Industry-17-JUN-2021.pdf" data-original-source="https://www.waterisac.org/system/files/articles/FINAL_2021_WaterSectorCoordinatingCouncil_Cybersecurity_State_of_the_Industry-17-JUN-2021.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=54583
title: How Cyber Sleuths Cracked an ATM Shimmer Gang
uri: How-Cyber-Sleuths-Cracked-an-ATM-Shimmer-Gang
url: https://krebsonsecurity.com/2021/06/how-cyber-sleuths-cracked-an-atm-shimmer-gang/
content:
<p>In 2015, police departments worldwide started finding ATMs compromised with advanced new &#8220;shimming&#8221; devices made to steal data from chip card transactions. Authorities in the United States and abroad had seized many of these shimmers, but for years couldn&#8217;t decrypt the data on the devices. This is a story of ingenuity and happenstance, and how one former Secret Service agent helped crack a code that revealed the contours of a global organized crime ring.</p>
<p><strong>Jeffrey Dant</strong> was a special agent at the <strong>U.S. Secret Service</strong> for 12 years until 2015. After that, Dant served as the global lead for the fraud fusion center at <strong>Citi</strong>, one of the largest financial institutions in the United States.</p>
<p>Not long after joining Citi, Dant heard from industry colleagues at a bank in Mexico who reported finding one of these shimming devices inside the card acceptance slot of a local ATM. As it happens, KrebsOnSecurity <a href="https://krebsonsecurity.com/2015/08/chip-card-atm-shimmer-found-in-mexico/" target="_blank" rel="noopener">wrote about that particular shimmer back in August 2015</a>.</p>
<div id="attachment_31892" style="width: 770px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-31892" loading="lazy" class="size-full wp-image-31892" src="media/2e9dc855.shimalone.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/08/shimalone.png" alt="" width="760" height="775" srcset="https://krebsonsecurity.com/wp-content/uploads/2015/08/shimalone.png 760w, https://krebsonsecurity.com/wp-content/uploads/2015/08/shimalone-580x591.png 580w" sizes="(max-width: 760px) 100vw, 760px" /><p id="caption-attachment-31892" class="wp-caption-text">This card &#8216;shimming&#8217; device is made to read chip-enabled cards and can be inserted directly into the ATM&#8217;s card acceptance slot.</p></div>
<p>The shimmers were an innovation that caused concern on multiple levels. For starters, chip-based payment cards were supposed to make it far more expensive and difficult for thieves to copy and clone. But these skimmers took advantage of weaknesses in the way many banks at the time implemented the new chip card standard.</p>
<p>Also, unlike traditional ATM skimmers that run on hidden cell phone batteries, the ATM shimmers found in Mexico did not require any external power source, and thus could remain in operation collecting card data until the device was removed.</p>
<p>When a chip card is inserted, a chip-capable ATM reads the data stored on the smart card by sending an electric current through the chip. Incredibly, these shimmers were able to siphon a small amount of that power (a few milliamps) to record any data transmitted by the card. When the ATM is no longer in use, the skimming device remains dormant, storing the stolen data in an encrypted format.</p>
<p>Dant and other investigators looking into the shimmers didn&#8217;t know at the time how the thieves who planted the devices went about gathering the stolen data. Traditional ATM skimmers are either retrieved manually, or they are programmed to transmit the stolen data wirelessly, such as via text message or Bluetooth.</p>
<p>But recall that these shimmers don&#8217;t have anywhere near the power needed to transmit data wirelessly, and the flexible shimmers themselves tend to rip apart when retrieved from the mouth of a compromised ATM. So how were the crooks collecting the loot?</p>
<p>&#8220;We didn&#8217;t know how they were getting the PINs at the time, either,&#8221; Dant recalled. &#8220;We found out later they were combining the skimmers with old school cameras hidden in fake overhead and side panels on the ATMs.&#8221;</p>
<p>Investigators wanted to look at the data stored on the shimmer, but it was encrypted. So they sent it to MasterCard&#8217;s forensics lab in the United Kingdom, and to the Secret Service.</p>
<p>&#8220;The Secret Service didn&#8217;t have any luck with it,&#8221; Dant said. &#8220;MasterCard in the U.K. was able to understand a little bit at a high level what it was doing, and they confirmed that it was powered by the chip. But the data dump from the shimmer was just encrypted gibberish.&#8221;</p>
<p>Organized crime gangs that specialize in deploying skimmers very often will encrypt stolen card data as a way to remove the possibility that any gang members might try to personally siphon and sell the card data in underground markets.</p>
<h2>THE DOWNLOAD CARDS</h2>
<p>Then in 2017, Dant got a lucky break: Investigators had found a shimming device inside an ATM in New York City, and that device appeared identical to the shimmers found in Mexico two years earlier.</p>
<p>&#8220;That was the first one that had showed up in the U.S. at that point,&#8221; Dant said.</p>
<p>The Citi team suspected that if they could work backwards from the card data that was known to have been recorded by the skimmers, they might be able to crack the encryption.</p>
<p>&#8220;We knew when the shimmer went into the ATM, thanks to closed-circuit television footage,&#8221; Dant said. &#8220;And we know when that shimmer was discovered. So between that time period of a couple of days, these are the cards that interacted with the skimmer, and so these card numbers are most likely on this device.&#8221;</p>
<p>Based off that hunch, MasterCard&#8217;s eggheads had success decoding the encrypted gibberish. But they already knew which payment cards had been compromised, so what did investigators stand to gain from breaking the encryption?</p>
<p>According to Dant, this is where things got interesting: They found that the same primary account number (unique 16 digits of the card) was present on the download card and on the shimmers from both New York City and Mexican ATMs.</p>
<p>Further research revealed that account number was tied to a payment card issued years prior by an Austrian bank to a customer who reported never receiving the card in the mail.</p>
<p>&#8220;So why is this Austrian bank card number on the download card and two different shimming devices in two different countries, years apart?&#8221; Dant said he wondered at the time.</p>
<p>He didn&#8217;t have to wait long for an answer. Soon enough, the NYPD brought a case against a group of Romanian men suspected of planting the same shimming devices in both the U.S. and Mexico. Search warrants served against the Romanian defendants turned up multiple copies of the shimmer they&#8217;d seized from the compromised ATMs.<span id="more-54583"></span></p>
<p>&#8220;They found an entire ATM skimming lab that had different versions of that shimmer in untrimmed squares of sheet metal,&#8221; Dant said. &#8220;But but what stood out the most was this unique device &#8212; the download card.&#8221;</p>
<div id="attachment_56062" style="width: 775px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56062" loading="lazy" class=" wp-image-56062" src="media/b1e01690.downloadcard-both.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/downloadcard-both.png" alt="" width="765" height="316" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/downloadcard-both.png 828w, https://krebsonsecurity.com/wp-content/uploads/2021/06/downloadcard-both-768x317.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/06/downloadcard-both-782x323.png 782w" sizes="(max-width: 765px) 100vw, 765px" /><p id="caption-attachment-56062" class="wp-caption-text">The download card (right, in blue) opens an encrypted session with the shimmer, and then transmits the stolen card data to the attached white plastic device. Image: KrebsOnSecurity.com.</p></div>
<p>The download card consisted of two pieces of plastic about the width of a debit card but a bit long longer. The blue plastic part &#8212; made to be inserted into a card reader &#8212; features the same contacts as a chip card. The blue plastic was attached via a ribbon cable to a white plastic card with a green LED and other electronic components.</p>
<p>Sticking the blue download card into a chip reader revealed the same Austrian card number seen on the shimming devices. It then became very clear what was happening.</p>
<p>&#8220;The download card was hard coded with chip card data on it, so that it could open up an encrypted session with the shimmer,&#8221; which also had the same card data, Dant said.</p>
<div id="attachment_56061" style="width: 776px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56061" loading="lazy" class=" wp-image-56061" src="media/feacc395.downloadcardblue.jpeg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/downloadcardblue.jpeg" alt="" width="766" height="515" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/downloadcardblue.jpeg 828w, https://krebsonsecurity.com/wp-content/uploads/2021/06/downloadcardblue-768x517.jpeg 768w, https://krebsonsecurity.com/wp-content/uploads/2021/06/downloadcardblue-782x526.jpeg 782w" sizes="(max-width: 766px) 100vw, 766px" /><p id="caption-attachment-56061" class="wp-caption-text">The download card, up close. Image: KrebsOnSecurity.com.</p></div>
<p>Once inserted into the mouth of ATM card acceptance slot that&#8217;s already been retrofitted with one of these shimmers, the download card causes an encrypted data exchange between it and the shimmer. Once that two-way handshake is confirmed, the white device lights up a green LED when the data transfer is complete.</p>
<h2>THE MASTER KEY</h2>
<p>Dant said when the Romanian crew mass-produced their shimming devices, they did so using the same stolen Austrian bank card number. What this meant was that now the Secret Service and Citi had a master key to discover the same shimming devices installed in other ATMs.</p>
<p>That&#8217;s because every time the gang compromised a new ATM, that Austrian account number would traverse the global payment card networks &#8212; telling them exactly which ATM had just been hacked.</p>
<p>&#8220;We gave that number to the card networks, and they were able to see all the places that card had been used on their networks before,&#8221; Dant said. &#8220;We also set things up so we got alerts anytime that card number popped up, and we started getting tons of alerts and finding these shimmers all over the world.&#8221;</p>
<p>For all their sleuthing, Dant and his colleagues never really saw shimming take off in the United States, at least nowhere near as prevalently as in Mexico, he said.</p>
<p>The problem was that many banks in Mexico and other parts of Latin America had not properly implemented the chip card standard, which meant thieves could use shimmed chip card data to make the equivalent of old magnetic stripe-based card transactions.</p>
<p>By the time the Romanian gang&#8217;s shimmers started showing up in New York City, the vast majority of U.S. banks had already properly implemented chip card processing in such a way that the same phony chip card transactions which sailed through Mexican banks would simply fail every time they were tried against U.S. institutions.</p>
<p>&#8220;It never took off in the U.S., but this kind of activity went on like wildfire for years in Mexico,&#8221; Dant said.</p>
<p>The other reason shimming never emerged as a major threat for U.S. financial institutions is that many ATMs have been upgraded over the past decade so that their card acceptance slots are far slimmer, Dant observed.</p>
<p>&#8220;That download card is thicker than a lot of debit cards, so a number of institutions were quick to replace the older card slots with newer hardware that reduced the height of a card slot so that you could maybe get a shimmer and a debit card, but definitely not a shimmer and one of these download cards,&#8221; he said.</p>
<p>Shortly after ATM shimmers started showing up at banks in Mexico, KrebsOnSecurity <a href="https://krebsonsecurity.com/2015/09/tracking-a-bluetooth-skimmer-gang-in-mexico/" target="_blank" rel="noopener">spent</a> <a href="https://krebsonsecurity.com/2015/09/tracking-bluetooth-skimmers-in-mexico-part-ii/" target="_blank" rel="noopener">four</a> <a href="https://krebsonsecurity.com/2015/09/whos-behind-bluetooth-skimming-in-mexico/" target="_blank" rel="noopener">days</a> in Mexico tracing the activities of a Romanian organized crime gang that had very recently started its own ATM company there called <strong>Intacash</strong>.</p>
<p>Sources told KrebsOnSecurity that the Romanian gang also was paying technicians from competing ATM providers to retrofit cash machines with Bluetooth-based skimmers that hooked directly up to the electronics on the inside. Hooked up to the ATM&#8217;s internal power, those skimmers could collect card data indefinitely, and the data could be collected wirelessly with a smart phone.</p>
<p>Follow-up <a href="https://www.occrp.org/en/how-a-crew-of-romanian-criminals-conquered-the-world-of-atm-skimming/" target="_blank" rel="noopener">reporting last year</a> by the <strong>Organized Crime and Corruption Reporting Project</strong> (OCCRP) found Intacash and its associates compromised more than 100 ATMs across Mexico using skimmers that were able to remain in place undetected for years. The OCCRP, which dubbed the Roomanian group “The Riviera Maya Gang,” estimates the crime syndicate used cloned card data and stolen PINs to steal more than $1.2 billion from bank accounts of tourists visiting the region.</p>
<p>Last month, <a href="https://krebsonsecurity.com/2021/05/boss-of-atm-skimming-syndicate-arrested-in-mexico/" target="_blank" rel="noopener">Mexican authorities arrested Florian &#8220;The Shark&#8221; Tudor</a>, Intacash&#8217;s boss and the reputed ringleader of the Romanian skimming syndicate. Authorities charged that Tudor&#8217;s group also specialized in human trafficking, which allowed them to send gang members to compromise ATMs across the border in the United States.</p>


feed_id: https://krebsonsecurity.com/?p=56082
title: MyBook Users Urged to Unplug Devices from Internet
uri: MyBook-Users-Urged-to-Unplug-Devices-from-Internet
url: https://krebsonsecurity.com/2021/06/mybook-users-urged-to-unplug-devices-from-internet/
content:
<p>Hard drive giant <strong>Western Digital</strong> is urging users of its <strong>MyBook Live</strong> brand of network storage drives to disconnect them from the Internet, warning that malicious hackers are remotely wiping the drives using a previously unknown critical flaw that can be triggered by anyone who knows the Internet address of an affected device.</p>
<div id="attachment_56085" style="width: 841px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56085" loading="lazy" class="size-full wp-image-56085" src="media/6d73316e.wd-help.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/wd-help.png" alt="" width="831" height="565" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/wd-help.png 831w, https://krebsonsecurity.com/wp-content/uploads/2021/06/wd-help-768x522.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/06/wd-help-782x532.png 782w" sizes="(max-width: 831px) 100vw, 831px" /><p id="caption-attachment-56085" class="wp-caption-text">One of many similar complaints on Western Digital&#8217;s user forum.</p></div>
<p>Earlier this week, <a href="https://www.bleepingcomputer.com/news/security/wd-my-book-nas-devices-are-being-remotely-wiped-clean-worldwide/" target="_blank" rel="noopener">Bleeping Computer</a> and <a href="https://arstechnica.com/gadgets/2021/06/mass-data-wipe-in-my-book-devices-prompts-warning-from-western-digital/?utm_brand=arstechnica&amp;utm_source=twitter&amp;utm_social-type=owned&amp;utm_medium=social" target="_blank" rel="noopener">Ars Technica</a> pointed to <a href="https://community.wd.com/t/help-all-data-in-mybook-live-gone-and-owner-password-unknown/268111" target="_blank" rel="noopener">a heated discussion thread on Western Digital&#8217;s user forum</a> where many customers complained of finding their <strong>MyBook Live</strong> and <strong>MyBook Live Duo</strong> devices completely wiped of their data.</p>
<p>&#8220;Western Digital has determined that some My Book Live and My Book Live Duo devices are being compromised through exploitation of a remote command execution vulnerability,&#8221; the company said in a statement June 24. &#8220;In some cases, this compromise has led to a factory reset that appears to erase all data on the device. The My Book Live and My Book Live Duo devices received its final firmware update in 2015. We understand that our customers’ data is very important. We are actively investigating the issue and will provide an updated advisory when we have more information.&#8221;</p>
<p>Western Digital&#8217;s <a href="https://www.westerndigital.com/support/productsecurity/wdc-21008-recommended-security-measures-wd-mybooklive-wd-mybookliveduo" rel="noopener" target="_blank">brief advisory</a> includes <a href="https://nvd.nist.gov/vuln/detail/CVE-2018-18472#VulnChangeHistorySection" target="_blank" rel="noopener">a link to an entry in the National Vulnerability Database for CVE-2018-18472</a>. The NVD writeup says Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug.</p>
<p>&#8220;It can be triggered by anyone who knows the IP address of the affected device, as exploited in the wild in June 2021 for factory reset commands,&#8221; NVD wrote.</p>
<p>Examine the CVE attached to this flaw and you&#8217;ll notice it was issued in 2018. The <a href="https://nvd.nist.gov/vuln/detail/CVE-2018-18472#VulnChangeHistorySection" target="_blank" rel="noopener">NVD&#8217;s advisory</a> credits VPN reviewer <strong>Wizcase.com</strong> with reporting the bug to Western Digital three years ago, back in June 2018. </p>
<p>In some ways, it&#8217;s remarkable that it took this long for vulnerable MyBook devices to be attacked: The 2018 Wizcase writeup on the flaw includes proof-of-concept code that lets anyone run commands on the devices as the all-powerful &#8220;root&#8221; user. <span id="more-56082"></span></p>
<p>Western Digital&#8217;s response at the time was that the affected devices were no longer supported and that customers should avoid connecting them to the Internet. That response also suggested this bug has been present in its devices for at least a decade.</p>
<p>&#8220;The vulnerability report CVE-2018-18472 affects My Book Live devices originally introduced to the market between 2010 and 2012,&#8221; reads a reply from Western Digital that Wizcase <a href="https://www.wizcase.com/blog/hack-2018/" target="_blank" rel="noopener">posted to its blog</a>. &#8220;These products have been discontinued since 2014 and are no longer covered under our device software support lifecycle. We encourage users who wish to continue operating these legacy products to configure their firewall to prevent remote access to these devices, and to take measures to ensure that only trusted devices on the local network have access to the device.&#8221;</p>
<div id="attachment_56084" style="width: 778px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56084" loading="lazy" class=" wp-image-56084" src="media/bdc6729b.MBLD.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/MBLD.png" alt="" width="768" height="484" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/MBLD.png 946w, https://krebsonsecurity.com/wp-content/uploads/2021/06/MBLD-768x484.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/06/MBLD-782x493.png 782w" sizes="(max-width: 768px) 100vw, 768px" /><p id="caption-attachment-56084" class="wp-caption-text">A local administration page for the MyBook Live Duo.</p></div>
<p>Wizcase said the flaw it found in MyBook devices also may be present in certain models of <strong>WD MyCloud</strong> network attached storage (NAS) devices, although Western Digital&#8217;s advisory makes no mention of its MyCloud line being affected.</p>
<p>The vulnerable MyBook devices are popular among home users and small businesses because they&#8217;re relatively feature-rich and inexpensive, and can be upgraded with additional storage quite easily. But these products also make it simple for users to access their files remotely over the Internet using a mobile app.</p>
<p>I&#8217;m guessing it is primarily users who&#8217;ve configured their MyBooks to be remotely accessible who are experiencing these unfortunate drive wipes. Regardless, it&#8217;s probably safest to observe Western Digital&#8217;s advice and disconnect any MyBooks you have from ethernet access.</p>
<p>If you&#8217;d still like to keep your MyBook connected to your local network (at least until you can find a suitable backup for your backups), please make double sure remote access is not enabled in your device settings (see screenshot above).</p>


feed_id: https://krebsonsecurity.com/?p=55409
title: We Infiltrated a Counterfeit Check Ring! Now What?
uri: We-Infiltrated-a-Counterfeit-Check-Ring-Now-What
url: https://krebsonsecurity.com/2021/06/we-infiltrated-a-counterfeit-check-ring-now-what/
content:
<p>Imagine waking up each morning knowing the identities of thousands of people who are about to be mugged for thousands of dollars each. You know exactly when and where each of those muggings will take place, and you&#8217;ve shared this information in advance with the authorities each day for a year with no outward indication that they are doing anything about it. How frustrated would you be?</p>
<div id="attachment_56121" style="width: 770px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56121" loading="lazy" class=" wp-image-56121" src="media/7cc38348.badcheck.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/badcheck.png" alt="" width="760" height="286" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/badcheck.png 858w, https://krebsonsecurity.com/wp-content/uploads/2021/06/badcheck-768x289.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/06/badcheck-782x294.png 782w" sizes="(max-width: 760px) 100vw, 760px" /><p id="caption-attachment-56121" class="wp-caption-text">A counterfeit check image [redacted] that was intended for a person helping this fraud gang print and mail phony checks tied to a raft of email-based scams. One fraud-fighting group is intercepting hundreds to thousands of these per day.</p></div>
<p>Such is the curse of the fraud fighter known online by the handles &#8220;<strong>Brianna Ware</strong>&#8221; and &#8220;<strong>BWare</strong>&#8221; for short, a longtime member of a global group of volunteers who&#8217;ve infiltrated a cybercrime gang that disseminates counterfeit checks tied to a dizzying number of online scams.</p>
<p>For the past year, BWare has maintained contact with an insider from the criminal group that&#8217;s been sending daily lists of would-be victims who are to receive counterfeit checks printed using the real bank account information of legitimate companies.</p>
<p>&#8220;Some days we&#8217;re seeing thousands of counterfeit checks going out,&#8221; BWare said.</p>
<p>The scams used in connection with the fraudulent checks vary widely, from fake employment and &#8220;mystery shopper&#8221; schemes to those involving people who have been told they can get paid to cover their cars in advertisements (a.k.a. <a href="https://www.consumer.ftc.gov/blog/2016/08/how-spot-car-wrap-scam" rel="noopener" target="_blank">the &#8220;car wrap&#8221; scam</a>).</p>
<div id="attachment_56122" style="width: 776px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56122" loading="lazy" class=" wp-image-56122" src="media/37f60340.letterwithcheck.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/letterwithcheck.png" alt="" width="766" height="434" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/letterwithcheck.png 1076w, https://krebsonsecurity.com/wp-content/uploads/2021/06/letterwithcheck-768x435.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/06/letterwithcheck-782x443.png 782w" sizes="(max-width: 766px) 100vw, 766px" /><p id="caption-attachment-56122" class="wp-caption-text">A form letter mailed out with a counterfeit check urges the recipient to text a phone number after the check has been deposited.</p></div>
<p>Most of the counterfeit checks being disseminated by this fraud group are in amounts ranging from $2,500 to $5,000. The crimes that the checks enable are known variously as &#8220;<strong>advanced fee</strong>&#8221; scams, in that they involve tricking people into making payments in anticipation of receiving something of greater value in return.</p>
<p>But in each scheme the goal is the same: Convince the recipient to deposit the check and then wire a portion of the amount somewhere else. A few days after the check is deposited, it gets invariably canceled by the organization whose bank account information was on the check. And then person who deposited the phony check is on the hook for the entire amount.</p>
<p>&#8220;Like the car wrap scam, where they send you a check for $5,000, and you agree to keep $1,000 for your first payment and send the rest back to them in exchange for the car wrap materials,&#8221; BWare said. &#8220;Usually the check includes a letter that says they want you to text a specific phone number to let them know you received the check. When you do that, they&#8217;ll start sending you instructions on how and where to send the money.&#8221;</p>
<div id="attachment_56123" style="width: 763px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56123" loading="lazy" class=" wp-image-56123" src="media/15b07bce.autowrap.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/autowrap.png" alt="" width="753" height="429" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/autowrap.png 774w, https://krebsonsecurity.com/wp-content/uploads/2021/06/autowrap-768x438.png 768w" sizes="(max-width: 753px) 100vw, 753px" /><p id="caption-attachment-56123" class="wp-caption-text">A typical confirmation letter that accompanies a counterfeit check for a car wrap scam.</p></div>
<p>Traditionally, these groups have asked recipients to transit money via wire transfer. But these days, BWare said, the same crooks are now asking people to forward the money via mobile applications like <strong>CashApp</strong> and <strong>Venmo</strong>.</p>
<p>BWare and other volunteer fraud fighters believe the fake checks gang is using people looped into phony employment schemes and wooed through online romance scams to print the counterfeit checks, and that other recruits are responsible for mailing them out each day.</p>
<p>&#8220;More often than not, the scammers creating the shipping labels will provide those to an unwitting accomplice, or the accomplice is told to log in to an account and print the labels,&#8221; BWare explained.</p>
<p>Often the counterfeit checks and labels forwarded by BWare&#8217;s informant come with notes attached indicating the type of scam with which they are associated.</p>
<p>&#8220;Sometimes they&#8217;re mystery shopper scams, and other times it&#8217;s overpayment for an item sold on Craigslist,&#8221; BWare said. &#8220;We don&#8217;t know how the scammers are getting the account and routing numbers for these checks, but they are drawn on real companies and always scan fine through a bank&#8217;s systems initially. The recipients can deposit them at any bank, but we try to get the checks to the banks when we can so they have a heads up.&#8221;</p>
<h2>SHRINKING FROM THE FIREHOSE?</h2>
<p>Roughly a year ago, BWare&#8217;s group started sharing its intelligence with fraud investigators at <strong>FedEx</strong> and the <strong>U.S. Postal Service</strong> &#8212; the primary delivery mechanisms for these counterfeit checks.</p>
<p><img loading="lazy" src="media/649c88f1.fps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/fps.png" alt="" width="197" height="242" class="alignright size-full wp-image-56127" />Both the USPS and FedEx have an interest in investigating because the fraudsters in this case are using stolen shipping labels paid for by companies who have no idea their FedEx or USPS accounts are being used for such purposes.</p>
<p>&#8220;In most cases, the name of the sender will be completely unrelated to what&#8217;s being sent,&#8221; BWare said. &#8220;For example, you&#8217;ll see a label for a letter to go out with a counterfeit check for a car wrap scam, and the sender on the shipping label will be something like XYZ Biological Resources.&#8221;</p>
<p>But BWare says a year later, there is little sign that anyone is interested in acting on the shared intelligence.</p>
<p>&#8220;It&#8217;s so much information that they really don&#8217;t want it anymore and they&#8217;re not doing anything about it,&#8221; BWare said of FedEx and the USPS. &#8220;It&#8217;s almost like they&#8217;re turning a blind eye. There are so many of these checks going out each day that instead of trying to drink from the firehouse, they&#8217;re just turning their heads.&#8221;</p>
<p>FedEx did not respond to requests for comment. <strong>The U.S. Postal Inspection Service</strong> responded with a statement saying it &#8220;does not comment publicly on its investigative procedures and operational protocols.&#8221;<span id="more-55409"></span></p>
<h2>ANY METHOD THAT WORKS</h2>
<p><strong>Ronnie Tokazowski</strong> is a threat researcher at <strong>Agari</strong>, a security firm that has closely tracked many of the groups behind these advanced fee schemes [KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/10/how-do-you-fight-a-12b-fraud-problem-one-scammer-at-a-time/" target="_blank" rel="noopener">interviewed Tokazowski in 2018</a> after he received a security industry award for his work in this area].</p>
<p>Tokazowski said it&#8217;s likely the group BWare has infiltrated is involved in a myriad other email fraud schemes, including so-called <a href="https://krebsonsecurity.com/tag/ceo-fraud/" target="_blank" rel="noopener">&#8220;business email compromise&#8221; (BEC) or &#8220;CEO scams,&#8221;</a> in which the fraudsters impersonate executives at a company in the hopes of convincing someone at the firm to wire money for payment of a non-existent invoice. According to the FBI, BEC scams netted thieves nearly $2 billion in 2020 &#8212; far more than any other type of cybercrime.</p>
<p>In <a href="media/3c99dbbd.scattered-canary.pdf" data-original-source="https://www.agari.com/cyber-intelligence-research/whitepapers/scattered-canary.pdf" target="_blank" rel="noopener">a report released in 2019</a> (PDF), Agari profiled a group it dubbed &#8220;<strong>Scattered Canary</strong>&#8221; that is operating principally out of West Africa and dabbles in a dizzying array of schemes, including BEC and romance scams, FEMA and SBA loans, unemployment insurance fraud, counterfeit checks and of course money laundering.</p>
<div id="attachment_56126" style="width: 820px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56126" loading="lazy" src="media/659e964f.scatteredcanary.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/06/scatteredcanary.png" alt="" width="810" height="343" class="size-full wp-image-56126" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/scatteredcanary.png 810w, https://krebsonsecurity.com/wp-content/uploads/2021/06/scatteredcanary-768x325.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/06/scatteredcanary-782x331.png 782w" sizes="(max-width: 810px) 100vw, 810px" /><p id="caption-attachment-56126" class="wp-caption-text">Image: Agari.</p></div>
<p>Tokazowski said he doesn&#8217;t know if the group BWare is watching has any affiliation with Scattered Canary. But he said his experience with Scattered Canary shows these groups tend to make money via any and all methods that reliably produce results.</p>
<p>&#8220;One of the things that came out of the Scattered Canary report was that the actors we saw doing BEC scams were the same actors doing the car wrap and various Craigslist scams involving fake checks,&#8221; he said. &#8220;The people doing this type of crime will have tutorials on how to run the scam, how to wire money out for unemployment fraud, how to target people on Craigslist, and so on. It&#8217;s very different from the way a Russian hacking group might go after one industry vertical or piece of software or focus on one or two types of fraud. They will follow any method they can that works.&#8221;</p>
<p>Tokazowski said he&#8217;s taken his share of flack from people on social media who say his focus on West African nations as the primary source of these advanced fee and BEC scams is somehow racist [KrebsOnSecurity experienced a similar response to the 2013 stories, <a href="https://krebsonsecurity.com/2013/09/spy-service-exposes-nigerian-yahoo-boys/" target="_blank" rel="noopener">Spy Service Exposes Nigerian &#8216;Yahoo Boys&#8217;</a>, and <a href="https://krebsonsecurity.com/2013/09/yahoo-boys-have-419-facebook-friends/" target="_blank" rel="noopener">&#8216;Yahoo Boys&#8217; Have 419 Facebook Friends</a>].</p>
<p>But Tokazowski maintains he has been one of the more vocal proponents of the idea that trying to fight these problems by arresting those involved is something of a Sisyphean task, and that it makes way more sense to focus on changing the economic realities in places like Nigeria, which has been a hotbed of advanced fee activity for decades.</p>
<p>Nigeria has the world&#8217;s second-highest unemployment rate &#8212; <a href="https://www.bloomberg.com/news/articles/2021-03-15/nigeria-unemployment-rate-rises-to-second-highest-on-global-list" target="_blank" rel="noopener">rising from 27.1 percent in 2019 to 33 percent in 2020</a>, according to the <strong>National Bureau of Statistics</strong>. The nation also is among the world&#8217;s most corrupt, according to <a href="https://www.transparency.org/en/cpi/2020/index/nga" target="_blank" rel="noopener">2020 findings</a> from<strong> Transparency International</strong>.</p>
<p>&#8220;Education is definitely one piece, as raising awareness is hands down the best way to get ahead of this,&#8221; Tokazowski said. &#8220;But we also need to think about ways to create more business opportunities there so that people who are doing this to put food on the table have more legitimate opportunities. Unfortunately, thanks to the level of corruption of government officials, there are a lot of cultural reasons that fighting this type of crime at the source is going to be difficult.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=56153
title: Intuit to Share Payroll Data from 1.4M Small Businesses With Equifax
uri: Intuit-to-Share-Payroll-Data-from-1-4M-Small-Businesses-With-Equifax
url:
https://krebsonsecurity.com/2021/07/intuit-to-share-payroll-data-from-1-4m-small-businesses-with-equifax/

content:
<p>Financial services giant <strong>Intuit</strong> this week informed 1.4 million small businesses using its <strong>QuickBooks Online Payroll</strong> and <strong>Intuit Online Payroll</strong> products that their payroll information will be shared with big-three consumer credit bureau <strong>Equifax </strong>starting later this year unless customers opt out by the end of this month.</p>
<p>Intuit says the change is tied to an &#8220;exciting&#8221; and &#8220;free&#8221; new service that will let millions of small business employees get easy access to employment and income verification services when they wish to apply for a loan or line of credit.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-56158" src="media/e92ee3a8.qop-tosdelta.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/qop-tosdelta.png" alt="" width="578" height="736" /></p>
<p>&#8220;In early fall 2021, your QuickBooks Online Payroll subscription will include an automated income and employment verification service powered by <strong>The Work Number </strong>from Equifax,&#8221; reads the Intuit email, which <a href="https://glam.app.intuit.com/app/guesttos?glocale=en_US&amp;cid=DR_EM-ELM2953-001a-Text1-NA-TWNPayroll-NA-NA-CN-COMPL-NA-US-QBOPR" target="_blank" rel="noopener">includes a link to the new Terms of Service</a>. &#8220;Your employees may need to verify their income and employment info when applying for things like loans, credit, or public aid. Before, you likely had to manually provide this info to lenders, creditors or government agencies. These verifications will be automated by The Work Number, which helps employees get faster approvals and saves you time.&#8221;</p>
<p>An Intuit spokesperson clarified that the new service is not available through QuickBooks Online or to QuickBooks Online users as a whole. Intuit&#8217;s FAQ on the changes is <a href="https://quickbooks.intuit.com/learn-support/en-us/data-utilities/get-answers-to-questions-about-the-work-number-from-equifax/00/897361" target="_blank" rel="noopener">here</a>.</p>
<p>Equifax&#8217;s <a href="https://krebsonsecurity.com/?s=equifax+breach" target="_blank" rel="noopener">2017 megabreach that exposed the personal and financial details of 145.5 million Americans</a> may have shocked the public, but it did little to stop <a href="https://secure.theworknumber.talx.com/twneeer/PreAuthenticated/EnterEmployerSearchCriteria.ascx" target="_blank" rel="noopener">more than a million employers</a> from continuing to sell Equifax their employee payroll data, <em>Bloomberg</em> found in late 2017.</p>
<p>&#8220;The workforce-solutions unit is now among Equifax’s fastest-growing businesses, contributing more than a fifth of the firm’s $3.1 billion of revenue last year,&#8221; <a href="https://www.bloomberg.com/news/articles/2017-10-02/equifax-has-amassed-salary-details-for-people-at-7-100-companies" target="_blank" rel="noopener">wrote</a> <strong>Jennifer Surane</strong>. &#8220;Using payroll data from government agencies and thousands of employers &#8212; including a vast majority of Fortune 500 companies &#8212; Equifax has cultivated a database of 300 million current and historic employment records, according to regulatory filings.&#8221;</p>
<p>QuickBooks Online user <strong>Anthony Citrano</strong> <a href="https://twitter.com/acitrano/status/1410351452346720259" target="_blank" rel="noopener">posted on Twitter about receiving the notice</a>, noting that the upcoming changes had yet to receive any attention in the financial or larger media space.</p>
<p>&#8220;The way I read the terms, Equifax gets to proactively collect all payroll data just in case they need to share it later &#8212; similar to how they already handle credit reporting,&#8221; said Citrano, who is founder and CEO of <a href="https://acquicent.com/" target="_blank" rel="noopener">Acquicent</a>, a company that issues non-fungible tokens (NFTs). &#8220;And that feels like a disaster waiting to happen, especially given Equifax&#8217;s history.&#8221;</p>
<p>In selling payroll data to Equifax, Intuit will be joining some of the world&#8217;s largest payroll providers. For example,<strong> ADP </strong>&#8212; the largest payroll software provider in the United States &#8212; has long shared payroll data with Equifax.</p>
<p>But Citrano said this move by Intuit will incorporate a large number of fairly small businesses.</p>
<p>&#8220;ADP participates in some way already, but QuickBooks Online jumping on the bandwagon means a lot of employees of small to mid-sized businesses are going to be affected,&#8221; he said.</p>
<p>Why might small businesses want to think twice before entrusting Equifax with their payroll data? The answer is the company doesn&#8217;t have a great track record of protecting that information.<span id="more-56153"></span></p>
<p>In the days following the 2017 breach at Equifax, KrebsOnSecurity pointed out that The Work Number <a href="https://krebsonsecurity.com/2017/10/equifax-breach-fallout-your-salary-history/" target="_blank" rel="noopener">made it a little too easy for anyone to learn your salary history</a>. At the time, all you needed to view someone&#8217;s entire work and salary history was their Social Security number and date of birth. It didn&#8217;t help that for roughly half the U.S. population, both of the pieces of information were known to be in the possession of criminals behind the breach.</p>
<p>Equifax responded by <a href="https://krebsonsecurity.com/2017/11/equifax-reopens-salary-lookup-service/" target="_blank" rel="noopener">taking down its Work Number website</a> until it was able to include additional authentication requirements, saying anyone <a href="https://krebsonsecurity.com/2017/11/how-to-opt-out-of-equifax-revealing-your-salary-history/" target="_blank" rel="noopener">could opt out of Equifax revealing their salary history</a>.</p>
<p>Equifax&#8217;s security improvements included the addition of four multiple-guess questions whose answers were based on publicly-available data. But these requirements were easily bypassed, as evidenced by a previous breach at Equifax&#8217;s employment division.</p>
<p>The Work Number is a user-paid verification of employment database created by <strong>TALX Corp.</strong>, a data broker acquired by Equifax in 2007. Four months before the epic 2017 breach became public, <a href="https://krebsonsecurity.com/2017/05/fraudsters-exploited-lax-security-at-equifaxs-talx-payroll-division/" target="_blank" rel="noopener">KrebsOnSecurity broke the news</a> that fraudsters who specialize in <a href="https://krebsonsecurity.com/?s=tax+refund+fraud" target="_blank" rel="noopener">tax refund fraud</a> had been successfully guessing the answers to those secret questions to reset TALX account PINs, which then let them view past W-2 tax forms for employees at many Fortune 500 companies.</p>
<p>Intuit says affected customers that do not want this new service included must update their preferences and opt-out by July 31, 2021. Otherwise, they will be automatically will be opted in. According to Intuit, customers can opt out by following these steps:</p>
<p>1. <a href="http://app.eq.intuit.com/e/er?s=113755760&amp;lid=79372&amp;elqTrackId=854750cae63f49e4818dec7b7b7d7ddd&amp;elq=9e4203e4332f4e1282245586f6cc650c&amp;elqaid=34657&amp;elqat=1" target="_blank" rel="noopener">Sign in</a> to QuickBooks Online Payroll.</p>
<p>2. Go to Payroll Settings.</p>
<p>3. In the Shared data section, select the pencil and uncheck the box.</p>
<p>4. Select Save.</p>


feed_id: https://krebsonsecurity.com/?p=56182
title: Another 0-Day Looms for Many Western Digital Users
uri: Another-0-Day-Looms-for-Many-Western-Digital-Users
url: https://krebsonsecurity.com/2021/07/another-0-day-looms-for-many-western-digital-users/
content:
<div id="attachment_56186" style="width: 774px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56186" loading="lazy" class=" wp-image-56186" src="media/811c3842.mycloud.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/mycloud.png" alt="" width="764" height="351" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/mycloud.png 1220w, https://krebsonsecurity.com/wp-content/uploads/2021/07/mycloud-768x353.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/mycloud-782x359.png 782w" sizes="(max-width: 764px) 100vw, 764px" /><p id="caption-attachment-56186" class="wp-caption-text">Some of Western Digital&#8217;s MyCloud-based data storage devices. Image: WD.</p></div>
<p>Countless <strong>Western Digital</strong> customers saw their <strong>MyBook Live</strong> network storage drives remotely wiped in the past month thanks to a bug in a product line the company stopped supporting in 2015, as well as a previously unknown zero-day flaw. But there is a similarly serious zero-day flaw present in a much broader range of newer Western Digital <strong>MyCloud</strong> network storage devices that will remain unfixed for many customers who can&#8217;t or won&#8217;t upgrade to the latest operating system.</p>
<p>At issue is a remote code execution flaw residing in all Western Digital network attached storage (NAS) devices running <strong>MyCloud</strong> <strong>OS 3</strong>, an operating system the company only recently stopped supporting.</p>
<p>Researchers <a href="https://www.flashback.sh/" target="_blank" rel="noopener"><strong>Radek Domanski</strong> and <strong>Pedro Ribeiro </strong></a>originally planned to present their findings at the <a href="https://www.thezdi.com/blog/2020/7/28/announcing-pwn2own-tokyo-2020-live-from-toronto" target="_blank" rel="noopener">Pwn2Own hacking competition in Tokyo</a> last year. But just days before the event Western Digital released <strong>MyCloud OS 5</strong>, which eliminated the bug they found. That update effectively nullified their chances at competing in Pwn2Own, which requires exploits to work against the latest firmware or software supported by the targeted device.</p>
<p>Nevertheless, in February 2021, the duo published <a href="https://www.youtube.com/watch?v=vsg9YgvGBec" target="_blank" rel="noopener">this detailed YouTube video</a>, which documents how they discovered a chain of weaknesses that allows an attacker to remotely update a vulnerable device&#8217;s firmware with a malicious backdoor &#8212; using a low-privileged user account that has a blank password.</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/vsg9YgvGBec" width="760" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>The researchers said Western Digital never responded to their reports. In a statement provided to KrebsOnSecurity, Western Digital said it received their report after Pwn2Own Tokyo 2020, but that at the time the vulnerability they reported had already been fixed by the release of My Cloud OS 5.</p>
<p>&#8220;The communication that came our way confirmed the research team involved planned to release details of the vulnerability and asked us to contact them with any questions,&#8221; Western Digital said. &#8220;We didn’t have any questions so we didn’t respond. Since then, we have updated our process and respond to every report in order to avoid any miscommunication like this again. We take reports from the security research community very seriously and conduct investigations as soon as we receive them.&#8221;</p>
<p>Western Digital ignored questions about whether the flaw found by Domanski and Ribeiro was ever addressed in OS 3. A statement published on its support site March 12, 2021 says the company will <a href="https://www.westerndigital.com/support/productsecurity/wdc-21004-recommended-upgrade-to-mycloud-os-5" target="_blank" rel="noopener">no longer provide further security updates to the MyCloud OS 3 firmware</a>.</p>
<p>&#8220;We strongly encourage moving to the My Cloud OS5 firmware,&#8221; the statement reads. &#8220;If your device is not eligible for upgrade to My Cloud OS 5, we recommend that you upgrade to one of our other My Cloud offerings that support My Cloud OS 5. More information can be found <a href="https://shop.westerndigital.com/support/software/my-cloud-os" target="_blank" rel="noopener">here</a>.&#8221; A list of MyCloud devices that can support OS 5 is <a href="http://My Cloud EX2 Ultra My Cloud EX4100 My Cloud PR2100 My Cloud PR4100 My Cloud DL2100 My Cloud DL4100 My Cloud EX2100 My Cloud (Firmware 2.xx.xxx) My Cloud Mirror Gen 2" rel="noopener" target="_blank">here</a>.<span id="more-56182"></span></p>
<p>But according to Domanski, OS 5 is a complete rewrite of Western Digital&#8217;s core operating system, and as a result some of the more popular features and functionality built into OS3 are missing.</p>
<p>&#8220;It broke a lot of functionality,&#8221; Domanski said of OS 5. &#8220;So some users might not decide to migrate to OS 5.&#8221;</p>
<p>In recognition of this, the researchers have <a href="https://www.youtube.com/redirect?event=video_description&amp;redir_token=QUFFLUhqa3VQYnhhbG9LMDRFdlRuX1Y3aVFnTXVEU2swQXxBQ3Jtc0ttRVl0SExFQ29oRFkyNzlvRXpWdXJ5ekxTOGdoS2tpck1nQ0tpYnNyMGs3WVdxQkNtRTl0ZnJaUW9RNlFMX08xT0JOdFJHMXhYUjdyelZNX2pPbzBhaEpSdWVITUotWVkzd2ZPNUFubFJWd09tbGNLOA&amp;q=https%3A%2F%2Fgithub.com%2Fpedrib%2FPoC%2Fblob%2Fmaster%2Fadvisories%2FPwn2Own%2FTokyo_2020%2Fweekend_destroyer%2Fweekend_destroyer_patch.sh" target="_blank" rel="noopener">developed and released their own patch</a> that fixes the vulnerabilities they found in OS 3 (the patch needs to be reapplied each time the device is rebooted). Western Digital said it is aware of third parties offering security patches for My Cloud OS 3.</p>
<p>&#8220;We have not evaluated any such patches and we are unable to provide any support for such patches,&#8221; the company stated.</p>
<div id="attachment_56184" style="width: 683px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56184" loading="lazy" class="size-full wp-image-56184" src="media/fe26f3d7.4100.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/4100.png" alt="" width="673" height="607" /><p id="caption-attachment-56184" class="wp-caption-text">A snippet from the video showing the researchers uploading their malicious firmware via a remote zero-day flaw in MyCloud OS 3.</p></div>
<p>Domanski said MyCloud users on OS 3 can virtually eliminate the threat from this attack by simply ensuring that the devices are not set up to be reachable remotely over the Internet. MyCloud devices make it super easy for customers to access their data remotely, but doing so also exposes them to attacks like last month&#8217;s that led to the mass-wipe of MyBook Live devices.</p>
<p>&#8220;Luckily for many users they don&#8217;t expose the interface to the Internet,&#8221; he said. &#8220;But looking at the number of posts on Western Digital&#8217;s support page related to OS3, I can assume the userbase is still considerable. It almost feels like Western Digital without any notice jumped to OS5, leaving all the users without support.&#8221;</p>
<p><a href="https://twitter.com/dangoodin001" target="_blank" rel="noopener">Dan Goodin</a> at <em>Ars Technica</em> has <a href="https://arstechnica.com/gadgets/2021/06/hackers-exploited-0-day-not-2018-bug-to-mass-wipe-my-book-live-devices/" target="_blank" rel="noopener">a fascinating deep dive</a> on the other zero-day flaw that led to the mass attack last month on MyBook Live devices that Western Digital stopped supporting in 2015. In response to Goodin&#8217;s report, Western Digital acknowledged that the flaw was enabled by a Western Digital developer who removed code that required a valid user password before allowing factory resets to proceed.</p>
<p>Facing a backlash of angry customers, Western Digital also <a href="https://www.westerndigital.com/support/productsecurity/wdc-21008-recommended-security-measures-wd-mybooklive-wd-mybookliveduo" target="_blank" rel="noopener">pledged</a> to provide data recovery services to affected customers starting this month. &#8220;MyBook Live customers will also be eligible for a trade-in program so they can upgrade to MyCloud devices,&#8221; Goodin wrote. &#8220;A spokeswoman said the data recovery service will be free of charge.&#8221;</p>
<p>If attackers get around to exploiting this OS 3 bug, Western Digital might soon be paying for data recovery services and trade-ins for a whole lot more customers.</p>


feed_id: https://krebsonsecurity.com/?p=56213
title: Microsoft Issues Emergency Patch for Windows Flaw
uri: Microsoft-Issues-Emergency-Patch-for-Windows-Flaw
url: https://krebsonsecurity.com/2021/07/microsoft-issues-emergency-patch-for-windows-flaw/
content:
<p><strong>Microsoft </strong>on Tuesday issued an emergency software update to quash a security bug that&#8217;s been dubbed &#8220;<strong>PrintNightmare</strong>,&#8221; a critical vulnerability in all supported versions of<strong> Windows</strong> that is actively being exploited. The fix comes a week ahead of Microsoft&#8217;s normal monthly Patch Tuesday release, and follows the publishing of exploit code showing would-be attackers how to leverage the flaw to break into Windows computers.</p>
<p><img loading="lazy" class="aligncenter wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="757" height="556" /></p>
<p>At issue is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527" target="_blank" rel="noopener">CVE-2021-34527</a>, which involves a flaw in the Windows Print Spooler service that could be exploited by attackers to run code of their choice on a target&#8217;s system. Microsoft says it has already detected active exploitation of the vulnerability.</p>
<p><strong>Satnam Narang</strong>, staff research engineer at<strong> Tenable</strong>, said Microsoft&#8217;s patch warrants urgent attention because of the vulnerability&#8217;s ubiquity across organizations and the prospect that attackers could exploit this flaw in order to take over a Windows domain controller.</p>
<p>&#8220;We expect it will only be a matter of time before it is more broadly incorporated into attacker toolkits,&#8221; Narang said. &#8220;PrintNightmare will remain a valuable exploit for cybercriminals as long as there are unpatched systems out there, and as we know, unpatched vulnerabilities have a long shelf life for attackers.&#8221;</p>
<p>In <a href="https://msrc-blog.microsoft.com/2021/07/06/out-of-band-oob-security-update-available-for-cve-2021-34527/" target="_blank" rel="noopener">a blog post</a>, Microsoft&#8217;s Security Response Center said it was delayed in developing fixes for the vulnerability in <strong>Windows Server 2016</strong>, <strong>Windows 10 version 1607</strong>, and <strong>Windows Server 2012</strong>. The fix also apparently includes a new feature that allows Windows administrators to implement stronger restrictions on the installation of printer software.</p>
<p>&#8220;Prior to installing the July 6, 2021, and newer Windows Updates containing protections for CVE-2021-34527, the printer operators’ security group could install both signed and unsigned printer drivers on a printer server,&#8221; reads Microsoft&#8217;s <a href="https://support.microsoft.com/en-us/topic/kb5005010-restricting-installation-of-new-printer-drivers-after-applying-the-july-6-2021-updates-31b91c02-05bc-4ada-a7ea-183b129578a7" rel="noopener" target="_blank">support advisory</a>. &#8220;After installing such updates, delegated admin groups like printer operators can only install signed printer drivers. Administrator credentials will be required to install unsigned printer drivers on a printer server going forward.”</p>
<p>Windows 10 users can check for the patch by opening Windows Update. Chances are, it will show what&#8217;s pictured in the screenshot below &#8212; that <strong>KB5004945</strong> is available for download and install. A reboot will be required after installation.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-56215" src="media/c2135d01.kb5004945.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/kb5004945.png" alt="" width="760" height="487" /></p>
<p>Friendly reminder: It&#8217;s always a good idea to backup your data before applying security updates. Windows 10 <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" rel="noopener" target="_blank">has some built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once. </p>
<p>This post will be updated if Windows users start reporting any issues in applying the patch.</p>


feed_id: https://krebsonsecurity.com/?p=56209
title: Kaseya Left Customer Portal Vulnerable to 2015 Flaw in its Own Software
uri: Kaseya-Left-Customer-Portal-Vulnerable-to-2015-Flaw-in-its-Own-Softwar
url:
https://krebsonsecurity.com/2021/07/kaseya-left-customer-portal-vulnerable-to-2015-flaw-in-its-own-software/

content:
<p><img loading="lazy" class="aligncenter wp-image-56236" src="media/aebb0d28.kaseya.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/kaseya.png" alt="" width="764" height="510" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/kaseya.png 981w, https://krebsonsecurity.com/wp-content/uploads/2021/07/kaseya-768x513.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/kaseya-782x522.png 782w" sizes="(max-width: 764px) 100vw, 764px" /></p>
<p>Last week cybercriminals deployed ransomware to 1,500 organizations that provide IT security and technical support to many other companies. The attackers exploited a vulnerability in software from <strong>Kaseya</strong>, a Miami-based company whose products help system administrators manage large networks remotely. Now it appears Kaseya&#8217;s customer service portal was left vulnerable until last week to a data-leaking security flaw that was first identified in the same software six years ago.</p>
<p>On July 3, the <a href="https://krebsonsecurity.com/?s=revil" target="_blank" rel="noopener">REvil ransomware affiliate program</a> began using a zero-day security hole (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30116" target="_blank" rel="noopener">CVE-2021-30116</a>) to deploy ransomware to hundreds of IT management companies running Kaseya&#8217;s remote management software &#8212; known as the <strong>Kaseya Virtual System Administrator</strong> (VSA).</p>
<p>According to <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30116" target="_blank" rel="noopener">this entry for CVE-2021-30116</a>, the security flaw that powers that Kaseya VSA zero-day was assigned a vulnerability number on April 2, 2021, indicating Kaseya <a href="https://csirt.divd.nl/2021/07/04/Kaseya-Case-Update-2/" rel="noopener" target="_blank">had roughly three months to address the bug before it was exploited in the wild</a>.</p>
<p>Also on July 3, security incident response firm <strong>Mandiant</strong> notified Kaseya that their billing and customer support site &#8212;<strong>portal.kaseya.net</strong> &#8212; was vulnerable to <a href="https://nvd.nist.gov/vuln/detail/CVE-2015-2862" target="_blank" rel="noopener">CVE-2015-2862</a>, a &#8220;directory traversal&#8221; vulnerability in Kaseya VSA that allows remote users to read any files on the server using nothing more than a Web browser.</p>
<p>As its name suggests, CVE-2015-2862 was issued in July 2015. Six years later, Kaseya&#8217;s customer portal was still exposed to the data-leaking weakness.</p>
<div id="attachment_56237" style="width: 777px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56237" loading="lazy" class=" wp-image-56237" src="media/8aa78291.kaseya-portal.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/kaseya-portal.png" alt="" width="767" height="613" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/kaseya-portal.png 1008w, https://krebsonsecurity.com/wp-content/uploads/2021/07/kaseya-portal-768x613.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/kaseya-portal-782x625.png 782w" sizes="(max-width: 767px) 100vw, 767px" /><p id="caption-attachment-56237" class="wp-caption-text">The Kaseya customer support and billing portal. Image: Archive.org.</p></div>
<p>Mandiant notified Kaseya after hearing about it from <strong>Alex Holden</strong>, founder and chief technology officer of Milwaukee-based cyber intelligence firm <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>. Holden said the 2015 vulnerability was present on Kaseya&#8217;s customer portal until Friday afternoon, allowing him to download the site&#8217;s <a href="https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/webconfig-file-detected/" target="_blank" rel="noopener">&#8220;web.config&#8221; file</a>, a server component that often contains sensitive information such as usernames and passwords and the locations of key databases.</p>
<p>&#8220;It&#8217;s not like they forgot to patch something that Microsoft fixed years ago,&#8221; Holden said. &#8220;It&#8217;s a patch for their own software. And it&#8217;s not zero-day. It&#8217;s from 2015!&#8221;</p>
<p>The official description of CVE-2015-2862 says a would-be attacker would need to be already authenticated to the server for the exploit to work. But Holden said that was not the case with the vulnerability on the Kaseya portal that he reported via Mandiant.</p>
<p>&#8220;This is worse because the CVE calls for an authenticated user,&#8221; Holden said. &#8220;This was not.&#8221;</p>
<p><strong>Michael Sanders</strong>, executive vice president of account management at Kaseya, confirmed that the customer portal was taken offline Friday in response to a vulnerability report. Sanders said the portal had been retired in 2018 in favor of a more modern customer support and ticketing system, yet somehow the old site was still left available online.</p>
<p>&#8220;It was deprecated but left up,&#8221; Sanders said.</p>
<p>In a written statement shared with KrebsOnSecurity, Kaseya said that in 2015 CERT reported two vulnerabilities in its VSA product.</p>
<p>&#8220;We worked with CERT on responsible disclosure and released patches for VSA versions V7, R8, R9 and R9 along with the public disclosure (CVEs) and notifications to our customers. Portal.kaseya.net was not considered by our team to be part of the VSA shipping product and was not part of the VSA product patch in 2015. It has no access to customer endpoints and has been shut down &#8211; and will no longer be enabled or used by Kaseya.&#8221;</p>
<p>&#8220;At this time, there is no evidence this portal was involved in the VSA product security incident,&#8221; the statement continued. &#8220;We are continuing to do forensic analysis on the system and investigating what data is actually there.&#8221;<span id="more-56209"></span></p>
<p>The REvil ransomware group said affected organizations could negotiate independently with them for a decryption key, or someone could pay $70 million worth of virtual currency to buy a key that works to decrypt all systems compromised in this attack.</p>
<p>But Sanders said every ransomware expert Kaseya consulted so far has advised against negotiating for one ransom to unlock all victims.</p>
<p>&#8220;The problem is that they don&#8217;t have our data, they have our customers&#8217; data,&#8221; Sanders said. &#8220;We&#8217;ve been counseled not to do that by every ransomware negotiating company we&#8217;ve dealt with. They said with the amount of individual machines hacked and ransomwared, it would be very difficult for all of these systems to be remediated at once.&#8221;</p>
<p>In a video posted to Youtube on July 6, Kaseya CEO <strong>Fred Voccola</strong> said the ransomware attack had &#8220;limited impact, with only approximately 50 of the more than 35,000 Kaseya customers being breached.&#8221;</p>
<p>&#8220;While each and every customer impacted is one too many, the impact of this highly sophisticated attack has proven to be, thankfully, greatly overstated,&#8221; Voccola said.</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/XfAyutRfy2A" width="760" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>The zero-day vulnerability that led to Kaseya customers (and customers of those customers) getting ransomed was discovered and reported to Kaseya by <a href="https://twitter.com/wietsman" rel="noopener" target="_blank">Wietse Boonstra</a>, a researcher with the <strong>Dutch Institute for Vulnerability Disclosure</strong> (DIVD). </p>
<p>In <a href="https://csirt.divd.nl/2021/07/04/Kaseya-Case-Update-2/" rel="noopener" target="_blank">a July 4 blog post</a>, DIVD&#8217;s<strong> Victor Gevers </strong>wrote that Kaseya was &#8220;very cooperative,&#8221; and &#8220;asked the right questions.&#8221;</p>
<p>&#8220;Also, partial patches were shared with us to validate their effectiveness,&#8221; Gevers wrote. &#8220;During the entire process, Kaseya has shown that they were willing to put in the maximum effort and initiative into this case both to get this issue fixed and their customers patched. They showed a genuine commitment to do the right thing. Unfortunately, we were beaten by REvil in the final sprint, as they could exploit the vulnerabilities before customers could even patch.&#8221;</p>
<p>Still, Kaseya has yet to issue an official patch for the flaw Boonstra reported in April. Kaseya <a href="https://venturebeat.com/2021/07/07/kaseya-patch-fixing-zero-day-attack-delayed-as-issues-hit-saas-rollout/" rel="noopener" target="_blank">told customers on July 7</a> that it was working &#8220;through the night&#8221; to push out an update.</p>
<p>Gevers said the Kaseya vulnerability was discovered as part of a larger DIVD effort to look for serious flaws in a wide array of remote network management tools. </p>
<p>&#8220;We are focusing on these types of products because we spotted a trend where more and more of the products that are used to keep networks safe and secure are showing structural weaknesses,&#8221; he wrote.</p>


feed_id: https://krebsonsecurity.com/?p=56096
title: Spike in “Chain Gang” Destructive Attacks on ATMs
uri: Spike-in-Chain-Gang-Destructive-Attacks-on-ATMs
url: https://krebsonsecurity.com/2021/07/spike-in-chain-gang-destructive-attacks-on-atms/
content:
<p>Last summer, financial institutions throughout Texas started reporting a sudden increase in attacks involving well-orchestrated teams that would show up at night, use stolen trucks and heavy chains to rip Automated Teller Machines (ATMs) out of their foundations, and make off with the cash boxes inside. Now it appears the crime &#8212; known variously as &#8220;<strong>ATM smash-and-grab</strong>&#8221; or &#8220;<strong>chain gang</strong>&#8221; attacks &#8212; is rapidly increasing in other states.</p>
<div id="attachment_56259" style="width: 771px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56259" loading="lazy" class=" wp-image-56259" src="media/e3258385.atmsng.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/atmsng.png" alt="" width="761" height="426" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/atmsng.png 897w, https://krebsonsecurity.com/wp-content/uploads/2021/07/atmsng-768x430.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/atmsng-782x438.png 782w" sizes="(max-width: 761px) 100vw, 761px" /><p id="caption-attachment-56259" class="wp-caption-text">Four different ATM &#8220;chain gang&#8221; attacks in Texas recently. Image: Texas Bankers Association.</p></div>
<p>The <strong>Texas Bankers Association</strong> documented at least 139 chain gang attacks against Texas financial institutions in the year ending November 2020. The association says organized crime is the main source of the destructive activity, and that Houston-based FBI officials have made more than 50 arrests and are actively tracking about 250 individuals suspected of being part of these criminal rings.</p>
<p>From surveillance camera footage examined by fraud investigators, the perpetrators have followed the same playbook in each incident. The bad guys show up in the early morning hours with a truck or tractor that&#8217;s been stolen from a local construction site.</p>
<p>Then two or three masked men will pry the front covering from the ATM using crowbars, and attach heavy chains to the cash machine. The canisters of cash inside are exposed once the crooks pull the ATM&#8217;s safe door off using the stolen vehicle.</p>
<p>In nearly all cases, the perpetrators are done in less than five minutes.</p>
<p><strong>Tracey Santor</strong> is the bond product manager for <a href="https://www.travelers.com/" target="_blank" rel="noopener">Travelers</a>, which insures a large number of financial institutions against this type of crime. Santor said investigators questioning some of the suspects learned that the smash-and-grabs are used as a kind of initiation for would-be gang members.</p>
<p><span class="pullquote pqright">&#8220;One of the things they found out during the arrest was the people wanting to be in the gang were told they had to bring them $250,000 within a week,&#8221; Santor said.</span> &#8220;And they were given instructions on how to do it. I&#8217;ve also heard of cases where the perpetrators put construction cones around the ATM so it looks to anyone passing by that they&#8217;re legitimately doing construction at the site.&#8221;</p>
<p>Santor said the chain gang attacks have spread to other states, and that in the year ending June 2021 Travelers saw a 257 percent increase in the number of insurance claims related to ATM smash-and-grabs.</p>
<p>That 257 percent increase also includes claims involving incidents where attackers will crash a stolen car into a convenience store, and then in the ensuing commotion load the store&#8217;s ATM into the back of the vehicle and drive away.</p>
<p>In addition to any cash losses &#8212; which can often exceed $200,000 &#8212; replacing destroyed ATMs and any associated housing can take weeks, and newer model ATMs can cost $80,000 or more.</p>
<p>&#8220;It&#8217;s not stopping,&#8221; Santor said of the chain gang attacks. &#8220;In the last year we counted 32 separate states we&#8217;ve seen this type of attack in. Normally we are seeing single digits across the country. 2021 is going to be the same or worse for us than last year.&#8221;<span id="more-56096"></span></p>
<p>Increased law enforcement scrutiny of the crime in Texas might explain why a number of neighboring states are seeing a recent uptick in the number of chain gang attacks, said <strong>Elaine Dodd</strong>, executive vice president of the fraud division for the <strong>Oklahoma Bankers Association</strong>.</p>
<p>&#8220;We have a lot of it going on here now and they&#8217;re getting good at it,&#8221; Dodd said. &#8220;The numbers are surging. I think since Texas has focused law enforcement attention on this it&#8217;s spreading like fingers out from there.&#8221;</p>
<div id="attachment_56261" style="width: 777px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56261" loading="lazy" class="size-full wp-image-56261" src="media/ae4ce913.chaingang.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/chaingang.png" alt="" width="767" height="449" /><p id="caption-attachment-56261" class="wp-caption-text">Chain gang members at work on a Texas bank ATM. Image: Texas Bankers Association.</p></div>
<p>It&#8217;s not hard to see why physical attacks against ATMs are on the rise. In 2019, the average amount stolen in a traditional bank robbery was just $1,797, according to the FBI.</p>
<p>In contrast, robbing ATMs is way less risky and potentially far more rewarding for the perpetrators. That&#8217;s because bank ATMs can typically hold hundreds of thousands of dollars in cash.</p>
<p>Dodd said she hopes to see more involvement from federal investigators in fighting chain gang attacks, and that it would help if more of these attacks were prosecuted as bank robberies, which can carry stiff federal penalties. As it is, she said, most incidents are treated as property crimes and left to local investigators.  </p>
<p>&#8220;We had a rash of three attacks recently and contacted the FBI, and were told, &#8216;We don&#8217;t work these,'&#8221; Dodd said. &#8220;The FBI looks at these attacks not as bank robbery, but just the theft of cash.&#8221;</p>
<p>In January, Texas lawmakers are <a href="https://capitol.texas.gov/tlodocs/87R/analysis/html/SB00516I.htm" rel="noopener" target="_blank">introduced legislation</a> that would make destroying an ATM a third degree felony offense. Such a change would mean chain gang members could be prosecuted with <a href="https://www.farmprogress.com/livestock/southwest-ranchers-wary-sharp-rise-livestock-related-crimes" rel="noopener" target="_blank">the same zeal Texas applies to people who steal someone&#8217;s livestock</a>, a crime which is punishable by 2-10 years in prison and a fine of up to $10,000 (or both).  </p>
<p>&#8220;The bottom line is, right now bank robbery is a felony and robbing an unattended ATM is not,&#8221; Santor said. </p>
<p>KrebsOnSecurity checked in with the <strong>European ATM Security Team</strong> (EAST), which maintains statistics about fraud of all kinds targeting ATM operators in Europe. EAST Executive Director <strong>Lachlan Gunn</strong> said overall physical attacks on ATMs in Europe have been a lot quieter since the pandemic started.</p>
<p>&#8220;Attacks fell right away during the lockdowns and have started to pick up a little as the restrictions are eased,&#8221; Gunn said. &#8220;So no major spike here, although [the United States is] further ahead when it comes to the easing of restrictions.&#8221;</p>
<p>Gunn said the most common physical attacks on European ATMs continue to involve explosives &#8212;  such as gas tanks and solid explosives that are typically stolen from mining and construction sites.</p>
<p>&#8220;The biggest physical attack issue in Europe remains solid explosive attacks, due to the extensive collateral damage and the risk to life,&#8221; Gunn said.</p>
<p>The Texas Bankers Association report, available <a href="media/04c7afb0.ATM20Crime20Task20Force20Report20NOV20202020FINAL.pdf" data-original-source="https://texasbankers.informz.net/texasbankers/data/images/ATM%20Crime%20Task%20Force%20Report%20NOV%202020%20(FINAL).pdf" target="_blank" rel="noopener">here</a> (PDF), includes a number of recommended steps financial institutions can take to reduce the likelihood of being targeted by chain gangs.</p>


feed_id: https://krebsonsecurity.com/?p=56103
title: Microsoft Patch Tuesday, July 2021 Edition
uri: Microsoft-Patch-Tuesday-July-2021-Edition
url: https://krebsonsecurity.com/2021/07/microsoft-patch-tuesday-july-2021-edition/
content:
<p><img loading="lazy" class="aligncenter wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="760" height="535" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 760px) 100vw, 760px" /></p>
<p><strong>Microsoft</strong> today released updates to patch at least 116 security holes in its <strong>Windows</strong> operating systems and related software. At least four of the vulnerabilities addressed today are under active attack, according to Microsoft.</p>
<p>Thirteen of the security bugs quashed in this month&#8217;s release earned Microsoft&#8217;s most-dire &#8220;critical&#8221; rating, meaning they can be exploited by malware or miscreants to seize remote control over a vulnerable system without any help from users.</p>
<p>Another 103 of the security holes patched this month were flagged as &#8220;important,&#8221; which Microsoft assigns to vulnerabilities &#8220;whose exploitation could result in compromise of the confidentiality, integrity, or availability of user data, or of the integrity or availability of processing resources.&#8221;</p>
<p>Among the critical bugs is of course the official fix for the <strong>PrintNightmare</strong> print spooler flaw in most versions of Windows (<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34527" target="_blank" rel="noopener">CVE-2021-34527</a>) that prompted Microsoft <a href="https://krebsonsecurity.com/2021/07/microsoft-issues-emergency-patch-for-windows-flaw/" target="_blank" rel="noopener">to rush out a patch for a week ago</a> in response to exploit code for the flaw that got accidentally published online. That patch seems to have caused a number of problems for Windows users. Here&#8217;s hoping the updated fix resolves some of those issues for readers who&#8217;ve been holding out.</p>
<p><a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34448" target="_blank" rel="noopener">CVE-2021-34448</a> is a critical remote code execution vulnerability in the scripting engine built into every supported version of Windows &#8212; including server versions. Microsoft says this flaw is being exploited in the wild.</p>
<p>Both <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-33771" target="_blank" rel="noopener">CVE-2021-33771</a> and <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31979" target="_blank" rel="noopener">CVE-2021-31979</a> are elevation of privilege flaws in the Windows kernel. Both are seeing active exploitation, according to Microsoft.<span id="more-56103"></span></p>
<p><strong>Chad McNaughton</strong>, technical community manager at <strong>Automox</strong>, called attention to <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34458" target="_blank" rel="noopener">CVE-2021-34458</a>, a remote code execution flaw in the deepest areas of the operating system. McNaughton said this vulnerability is likely to be exploited because it is a &#8220;low-complexity vulnerability requiring low privileges and no user interaction.&#8221;</p>
<p>Another concerning critical vulnerability in the July batch is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34494" target="_blank" rel="noopener">CVE-2021-34494</a>, a dangerous bug in the Windows DNS Server that earned a CVSS score (severity) of 9.8 out of a possible 10.</p>
<p>&#8220;Both core and full installations are affected back to Windows Server 2008, including versions 2004 and 20H2,&#8221; said <strong>Aleks Haugom</strong>, also with Automox.</p>
<p>&#8220;DNS is used to translate IP addresses to more human-friendly names, so you don’t have to remember the jumble of numbers that represents your favorite social media site,&#8221; Haugom said. &#8220;In a Windows Domain environment, Windows DNS Server is critical to business operations and often installed on the domain controller. This vulnerability could be particularly dangerous if not patched promptly.&#8221;</p>
<p>Microsoft also patched six vulnerabilities in <strong>Exchange Server</strong>, an email product that has been under siege all year from attackers. <strong>Satnam Narang</strong>, staff research engineer at <strong>Tenable</strong>, noted that while Microsoft says two of the Exchange bugs tackled this month (<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34473" target="_blank" rel="noopener">CVE-2021-34473</a> and <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34523" target="_blank" rel="noopener">CVE-2021-34523</a>) were addressed as part of its security updates from April 2021, both CVEs were somehow omitted from that April release. Translation: If you already applied the bevy of Exchange updates Microsoft made available in April, your Exchange systems have protection against these flaws.</p>
<p>Other products that got patches today include <strong>Microsoft Office</strong>, <strong>Bing</strong>, <strong>SharePoint Server</strong>, <strong>Internet Explorer</strong>, and <strong>Visual Studio</strong>. The <strong>SANS Internet Storm Center</strong> as always has <a href="https://isc.sans.org/forums/diary/Microsoft+July+2021+Patch+Tuesday/27628/" target="_blank" rel="noopener">a nice visual breakdown of all the patches by severity</a>.</p>
<p><strong>Adobe</strong> also <a href="https://helpx.adobe.com/security.html" target="_blank" rel="noopener">issued security updates today</a> for <strong>Adobe Acrobat</strong> and <strong>Reader</strong>, as well as <strong>Dimension</strong>, <strong>Illustrator</strong>, Framemaker and Adobe Bridge.</p>
<p><strong>Chrome</strong> and <strong>Firefox</strong> also recently have shipped important security updates, so if you haven&#8217;t done so recently take a moment to save your tabs/work, completely close out and restart the browser, which should apply any pending updates.</p>
<p>The usual disclaimer:</p>
<p>Before you update with this month’s patch batch, please make sure you have backed up your system and/or important files. It’s not uncommon for Windows updates to hose one’s system or prevent it from booting properly, and some updates even have been known to erase or corrupt files.</p>
<p>So do yourself a favor and backup <em>before</em> installing any patches. Windows 10 even has <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">some built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, see <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">this guide</a>.</p>
<p>As always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips. Also, check out <a href="https://www.askwoody.com/" target="_blank" rel="noopener">AskWoody</a>, which keeps a close eye out for specific patches that may be causing problems for users.</p>


feed_id: https://krebsonsecurity.com/?p=55992
title: Don’t Wanna Pay Ransom Gangs? Test Your Backups.
uri: Don-t-Wanna-Pay-Ransom-Gangs-Test-Your-Backups
url: https://krebsonsecurity.com/2021/07/dont-wanna-pay-ransom-gangs-test-your-backups/
content:
<p>Browse the comments on virtually any story about a ransomware attack and you will almost surely encounter the view that the victim organization could have avoided paying their extortionists if only they&#8217;d had proper data backups. But the ugly truth is there are many non-obvious reasons why victims end up paying even when they have done nearly everything right from a data backup perspective.</p>
<p><img loading="lazy" class="aligncenter wp-image-53514" src="media/0df06f89.ransomware.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware.png" alt="" width="763" height="572" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware.png 1016w, https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware-768x575.png 768w" sizes="(max-width: 763px) 100vw, 763px" /></p>
<p>This story isn&#8217;t about what organizations do in response to <a href="https://krebsonsecurity.com/2020/11/why-paying-to-delete-stolen-data-is-bonkers/" target="_blank" rel="noopener">cybercriminals holding their data for hostage</a>, which has become something of a best practice among most of the top ransomware crime groups today. Rather, it&#8217;s about why victims still pay for a key needed to decrypt their systems even when they have the means to restore everything from backups on their own.</p>
<p>Experts say the biggest reason ransomware targets and/or their insurance providers still pay when they already have reliable backups is that <em>nobody at the victim organization bothered to test in advance how long this data restoration process might take.</em></p>
<p>&#8220;In a lot of cases, companies do have backups, but they never actually tried to restore their network from backups before, so they have no idea how long it&#8217;s going to take,&#8221; said <strong>Fabian Wosar</strong>, chief technology officer at <a href="https://www.emsisoft.com" target="_blank" rel="noopener">Emsisoft</a>. &#8220;Suddenly the victim notices they have a couple of petabytes of data to restore over the Internet, and they realize that even with their fast connections it&#8217;s going to take three months to download all these backup files. A lot of IT teams never actually make even a back-of-the-napkin calculation of how long it would take them to restore from a data rate perspective.&#8221;</p>
<p>Wosar said the next most-common scenario involves victims that have off-site, encrypted backups of their data but discover that the digital key needed to decrypt their backups was stored on the same local file-sharing network that got encrypted by the ransomware.</p>
<p>The third most-common impediment to victim organizations being able to rely on their backups is that the ransomware purveyors manage to corrupt the backups as well.</p>
<p>&#8220;That is still somewhat rare,&#8221; Wosar said. &#8220;It does happen but it&#8217;s more the exception than the rule. Unfortunately, it is still quite common to end up having backups in some form and one of these three reasons prevents them from being useful.&#8221;<span id="more-55992"></span></p>
<p><strong>Bill Siegel</strong>, CEO and co-founder of <a href="https://www.coveware.com" target="_blank" rel="noopener">Coveware</a>, a company that negotiates ransomware payments for victims, said most companies that pay either don’t have properly configured backups, or they haven’t tested their resiliency or the ability to recover their backups against the ransomware scenario.</p>
<p>&#8220;It can be [that they] have 50 petabytes of backups … but it’s in a … facility 30 miles away.… And then they start [restoring over a copper wire from those remote backups] and it’s going really slow … and someone pulls out a calculator and realizes it’s going to take 69 years [to restore what they need],&#8221; Siegel told <strong>Kim Zetter</strong>, a veteran <em>Wired</em> reporter who recently launched <a href="https://zetter.substack.com/p/negotiating-ransoms-when-to-play" target="_blank" rel="noopener">a cybersecurity newsletter on Substack</a>.</p>
<p>&#8220;Or there’s lots of software applications that you actually use to do a restore, and some of these applications are in your network [that got] encrypted,&#8221; Siegel continued. &#8220;So you’re like, &#8216;Oh great. We have backups, the data is there, but the application to actually do the restoration is encrypted.&#8217; So there’s all these little things that can trip you up, that prevent you from doing a restore when you don’t practice.&#8221;</p>
<p>Wosar said all organizations need to both test their backups and develop a plan for prioritizing the restoration of critical systems needed to rebuild their network.</p>
<p>&#8220;In a lot of cases, companies don&#8217;t even know their various network dependencies, and so they don&#8217;t know in which order they should restore systems,&#8221; he said. &#8220;They don&#8217;t know in advance, &#8216;Hey if we get hit and everything goes down, these are the services and systems that are priorities for a basic network that we can build off of.'&#8221;</p>
<p>Wosar said it&#8217;s essential that organizations drill their breach response plans in periodic tabletop exercises, and that it is in these exercises that companies can start to refine their plans. For example, he said, if the organization has physical access to their remote backup data center, it might make more sense to develop processes for physically shipping the backups to the restoration location.</p>
<p>&#8220;Many victims see themselves confronted with having to rebuild their network in a way they didn&#8217;t anticipate. And that&#8217;s usually not the best time to have to come up with these sorts of plans. That&#8217;s why tabletop exercises are incredibly important. We recommend creating an entire playbook so you know what you need to do to recover from a ransomware attack.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=56098
title: Spam Kingpin Peter Levashov Gets Time Served
uri: Spam-Kingpin-Peter-Levashov-Gets-Time-Served
url: https://krebsonsecurity.com/2021/07/spam-kingpin-peter-levashov-gets-time-served/
content:
<div id="attachment_56336" style="width: 318px" class="wp-caption alignright"><img aria-describedby="caption-attachment-56336" loading="lazy" class=" wp-image-56336" src="media/cf3c4c88.levashov-sentence.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/levashov-sentence.png" alt="" width="308" height="236" /><p id="caption-attachment-56336" class="wp-caption-text"><br />Peter Levashov, appearing via Zoom at his sentencing hearing today.</p></div>
<p>A federal judge in Connecticut today handed down a sentence of time served to spam kingpin<strong> <a href="https://krebsonsecurity.com/?s=peter+severa&amp;x=0&amp;y=0" target="_blank" rel="noopener">Peter “Severa” Levashov</a>, </strong>a prolific purveyor of malicious and junk email, and the creator of malware strains that infected millions of Microsoft computers globally. Levashov has been in federal custody since his extradition to the United States and guilty plea in 2018, and was facing up to 12 more years in prison. Instead, he will go free under three years of supervised release and a possible fine.</p>
<p>A native of St. Petersburg, Russia, the 40-year-old Levashov operated under the hacker handle &#8220;Severa.&#8221; Over the course of his 15-year cybercriminal career, Severa would emerge as a pivotal figure in the cybercrime underground</a>, serving as the primary moderator of a spam community that spanned multiple top Russian cybercrime forums.</p>
<p>Severa created and then leased out to others some of the nastiest cybercrime engines in history — including the <a href="https://en.wikipedia.org/wiki/Storm_Worm" target="_blank" rel="noopener">Storm worm</a>, and the <a href="https://krebsonsecurity.com/?s=waledac&amp;x=0&amp;y=0" target="_blank" rel="noopener">Waledac</a> and <a href="https://krebsonsecurity.com/?s=kelihos&amp;x=0&amp;y=0" target="_blank" rel="noopener">Kelihos</a> spam botnets. His central role in the spam forums gave Severa a prime spot to advertise the services tied to his various botnets, while allowing him to keep tabs on the activities of other spammers.</p>
<p>Severa rented out segments of his Waledac botnet to anyone seeking a vehicle for sending spam. For $200, vetted users could hire his botnet to blast one million emails containing malware or ads for male enhancement drugs. Junk email campaigns touting employment or “money mule” scams cost $300 per million, and phishing emails could be blasted out through Severa’s botnet for the bargain price of $500 per million.</p>
<div id="attachment_13548" style="width: 783px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-13548" loading="lazy" class=" wp-image-13548" src="media/5590783c.SeveraSpamdot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2012/01/SeveraSpamdot.png" alt="" width="773" height="534" srcset="https://krebsonsecurity.com/wp-content/uploads/2012/01/SeveraSpamdot.png 1249w, https://krebsonsecurity.com/wp-content/uploads/2012/01/SeveraSpamdot-600x414.png 600w, https://krebsonsecurity.com/wp-content/uploads/2012/01/SeveraSpamdot-1024x706.png 1024w" sizes="(max-width: 773px) 100vw, 773px" /><p id="caption-attachment-13548" class="wp-caption-text">Severa was a moderator on the Russian spam community Spamdot[.]biz. In this paid ad from 2004, Severa lists prices to rent his spam botnet.</p></div>
<p>Early in his career, Severa worked very closely with two major purveyors of spam. One was <strong>Alan Ralsky</strong>, an American spammer who was <a href="https://en.wikipedia.org/wiki/Alan_Ralsky" target="_blank" rel="noopener">convicted in 2009</a> of paying Severa and other spammers to promote pump-and-dump stock scams.</p>
<p>The other was a major spammer who went by the nickname “<a href="https://krebsonsecurity.com/2011/06/rustock-botnet-suspect-sought-job-at-google/" target="_blank" rel="noopener"><strong>Cosma</strong></a>,” the cybercriminal thought to be responsible for managing the <strong>Rustock</strong> botnet (so named because it was a Russian botnet frequently used to send pump-and-dump stock spam). Microsoft, which has battled to scrub botnets like Rustock off of millions of PCs, later <a href="https://krebsonsecurity.com/2011/07/microsoft-offers-250k-bounty-for-rustock-author/" target="_blank" rel="noopener">offered a still-unclaimed $250,000 reward</a> for information leading to the arrest and conviction of the Rustock author.</p>
<p>Severa ran several affiliate programs that paid cybercriminals to trick people into installing fake antivirus software. In 2011, <a href="https://krebsonsecurity.com/2011/07/spam-fake-av-like-ham-eggs/" target="_blank" rel="noopener">KrebsOnSecurity dissected &#8220;SevAntivir&#8221;</a> &#8212; Severa&#8217;s eponymous fake antivirus affiliate program  &#8212; showing it was used to deploy new copies of the Kelihos spam botnet.</p>
<div id="attachment_10861" style="width: 711px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-10861" loading="lazy" class=" wp-image-10861" src="media/8bccddc8.sevdownload.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2011/07/sevdownload.png" alt="" width="701" height="692" srcset="https://krebsonsecurity.com/wp-content/uploads/2011/07/sevdownload.png 557w, https://krebsonsecurity.com/wp-content/uploads/2011/07/sevdownload-300x296.png 300w" sizes="(max-width: 701px) 100vw, 701px" /><p id="caption-attachment-10861" class="wp-caption-text">A screenshot of the &#8220;SevAntivir&#8221; fake antivirus or &#8220;scareware&#8221; affiliate program run by Severa.</p></div>
<p>In 2010, <strong>Microsoft</strong> — in tandem with a number of security researchers — launched a <a href="https://krebsonsecurity.com/2010/02/microsoft-ambushes-waledac-botnet-shutters-whistleblower-site/" target="_blank" rel="noopener">combined technical and legal sneak attack</a> on the Waledac botnet, successfully dismantling it. The company would later do the same <a href="https://krebsonsecurity.com/2012/03/researchers-clobber-khelios-spam-botnet/" target="_blank" rel="noopener">to the Kelihos botnet</a>, a global spam machine which shared a great deal of code with Waledac and infected more than 110,000 Microsoft Windows PCs.</p>
<p>Levashov was <a href="https://krebsonsecurity.com/2017/04/alleged-spam-king-pyotr-levashov-arrested/" target="_blank" rel="noopener">arrested in 2017</a> while in Barcelona, Spain with his family. According to <a href="https://www.wired.com/2017/04/fbi-took-russias-spam-king-massive-botnet/" target="_blank" rel="noopener">a lengthy April 2017 story in Wired.com</a>, he got caught because he <a href="https://krebsonsecurity.com/2021/05/the-wages-of-password-re-use-your-money-or-your-life/" target="_blank" rel="noopener">violated a basic security no-no</a>: He used the same log-in credentials to both run his criminal enterprise and log into sites like <strong>iTunes</strong>.</p>
<p>In fighting his extradition to the United States, Levashov famously told the media, &#8220;If I go to the U.S., I will die in a year.&#8221; But a few months after his extradition, Levashov would plead guilty to four felony counts, including intentional damage to protected computers, conspiracy, wire fraud and aggravated identity theft. </p>
<p>At his sentencing hearing today, Levashov thanked his wife, attorney and the large number of people who wrote the court in support of his character, but otherwise declined to make a statement. His attorney read a lengthy statement explaining that Levashov got into spamming as a way to provide for his family, and that over a period of many years that business saw him supporting countless cybercrime operations. <span id="more-56098"></span></p>
<p>The plea agreement Levashov approved in 2018 gave <strong>Judge Robert Chatigny</strong> broad latitude to impose a harsh prison sentence. The government argued that <a href="https://www.ussc.gov/guidelines/2018-guidelines-manual/2018-chapter-5" rel="noopener" target="_blank">under U.S. federal sentencing guidelines</a>, Levashov&#8217;s crimes deserved an &#8220;offense level&#8221; of 32, which for a first-time offender means a sentence of anywhere from 121 to 151 months (10 to 12 years).</p>
<p>But Judge Chatigny said he had concerns that &#8220;the total offense level does overstate the seriousness of Mr. Levashov&#8217;s crimes and his criminal culpability,&#8221; and said he believed Levashov was unlikely to offend again.</p>
<p>&#8220;33 months is a long time and I&#8217;m sure it was especially difficult for you considering that you were away from your wife and child and home,&#8221; Chatigny told the defendant. &#8220;I believe you have a lot to offer and hope that you will do your best to be a positive and contributing member of society.&#8221;</p>
<p><strong>Mark Rasch</strong>, a former federal prosecutor with the U.S. Justice Department, the sentencing guidelines are no longer mandatory, but they do reflect the position of Congress, the U.S. Sentencing Commission, and the Administrative Office of the U.S. Courts about what seriousness of the offenses. </p>
<p>&#8220;One of the problems you have here is it&#8217;s hard enough to catch and prosecute and convict cybercriminals, but at the end of the day the courts often don&#8217;t take these offenses seriously,&#8221; Rasch said. &#8220;One the one hand, sentences like these do tend to diminish the deterrent effect, but also I doubt there are any hackers in St. Petersburg right now who are watching this case and going, &#8216;Okay, great now I can keep doing what I&#8217;m doing.'&#8221;</p>
<p>Judge Chatigny deferred ruling on what &#8212; if any &#8212; financial damages Levashov may have to pay as a result of the plea. </p>
<p>The government acknowledged that it was difficult to come to an accurate accounting of how much Levashov&#8217;s various botnets cost companies and consumers. But the plea agreement states a figure of approximately $7 million &#8212; which prosecutors say represents a mix of actual damages and ill-gotten gains. </p>
<p>However, the judge delayed ruling on whether to impose a fine because prosecutors had yet to supply a document to back up the defendant&#8217;s alleged profit/loss figures. The judge also ordered Levashov to submit to three years of supervised release, which includes constant monitoring of his online communications.</p>


feed_id: https://krebsonsecurity.com/?p=56372
title: Serial Swatter Who Caused Death Gets Five Years in Prison
uri: Serial-Swatter-Who-Caused-Death-Gets-Five-Years-in-Prison
url: https://krebsonsecurity.com/2021/07/serial-swatter-who-caused-death-gets-five-years-in-prison/
content:
<p>A 18-year-old Tennessee man who helped set in motion a fraudulent distress call to police that lead to the death of a 60-year-old grandfather in 2020 was sentenced to 60 months in prison today.</p>
<div id="attachment_56376" style="width: 310px" class="wp-caption alignright"><img aria-describedby="caption-attachment-56376" loading="lazy" class=" wp-image-56376" src="media/58333b37.markherring.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/markherring.png" alt="" width="300" height="416" /><p id="caption-attachment-56376" class="wp-caption-text">60-year-old Mark Herring died of a heart attack after police surrounded his home in response to a swatting attack.</p></div>
<p><strong>Shane Sonderman</strong>, of Lauderdale County, Tenn. admitted to conspiring with a group of criminals that&#8217;s been &#8220;swatting&#8221; and harassing people for months in a bid to coerce targets into giving up their valuable <strong>Twitter</strong> and <strong>Instagram</strong> usernames.</p>
<p>At Sonderman&#8217;s sentencing hearing today, prosecutors told the court the defendant and his co-conspirators would text and call targets and their families, posting their personal information online and sending them pizzas and other deliveries of food as a harassment technique.</p>
<p>Other victims of the group told prosecutors their tormentors further harassed them by making false reports of child abuse to social services local to the target&#8217;s area, and false reports in the target&#8217;s name to local suicide prevention hotlines.</p>
<p>Eventually, when subjects of their harassment refused to sell or give up their Twitter and Instagram usernames, Sonderman and others would swat their targets &#8212; or make a false report to authorities in the target&#8217;s name with the intention of sending a heavily armed police response to that person&#8217;s address.</p>
<p>For weeks throughout March and April 2020, 60-year-old <a href="https://www.facebook.com/mark.herring.940641" target="_blank" rel="noopener">Mark Herring</a> of Bethpage, Tenn. started receiving text messages asking him to give up his <strong>@Tennessee</strong> Twitter handle. When he ignored the requests, Sonderman and his buddies began having food delivered to their home via cash on delivery.</p>
<p>At one point, Sonderman posted Herring&#8217;s home address in a Discord chat room used by the group, and a minor in the United Kingdom quickly followed up by directing a swatting attack on Herring&#8217;s home.</p>
<p><strong>Ann Billings</strong> was dating Mr. Herring and was present when the police surrounded his home. She recalled for the Tennessee court today how her friend died shortly thereafter of a heart attack.</p>
<p>Billings said she first learned of the swatting when a neighbor called and asked why the street was lined with police cars. When Mr. Herring stepped out on the back porch to investigate, police told him to put his hands up and to come to the street.</p>
<p>Unable to disengage a lock on his back fence, Herring was instructed to somehow climb over the fence with his hands up.</p>
<p>&#8220;He was starting to get more upset,&#8221; Billings recalled. &#8220;He said, &#8216;I&#8217;m a 60-year-old fat man and I can&#8217;t do that.'&#8221;</p>
<p>Billings said Mr. Herring then offered to crawl under a gap in the fence, but when he did so and stood up, he collapsed of a heart attack. Herring died at a nearby hospital soon after.</p>
<p><strong>Mary Frances Herring</strong>, who was married to Mr. Herring for 28 years, said her late husband was something of a computer whiz in his early years who secured the @Tennessee Twitter handle shortly after Twitter came online. Internet archivist <a href="https://twitter.com/textfiles/status/1417743261125513217" target="_blank" rel="noopener">Jason Scott says</a> Herring was the creator of the successful software products <strong>Sparkware</strong> and <strong>QWIKMail; </strong>Scott has 2 hours worth of interviews with Herring from 20 years ago <a href="https://t.co/aJ3CQ9Fzay?amp=1" target="_blank" rel="noopener">here</a>.</p>
<p>Perhaps the most poignant testimony today came when Ms. Herring said her husband &#8212; who was killed by people who wanted to steal his account &#8212; had a habit of registering new Instagram usernames as presents for friends and family members who&#8217;d just had children.</p>
<p>&#8220;If someone was having a baby, he would ask them, &#8216;What are your naming the baby?&#8217;,&#8221; Ms. Herring said. &#8220;And he would get them that Instagram name and give it to them as a gift.&#8221;<span id="more-56372"></span></p>
<p><strong>Valerie Dozono</strong> also was an early adopter of Instagram, securing the two-letter username &#8220;VD&#8221; for her initials. When Dozono ignored multiple unsolicited offers to buy the account, she and many family and friends started getting unrequested pizza deliveries at all hours.</p>
<p>When Dozono continued to ignore her tormentors, Sonderman and others targeted her with a &#8220;SIM-swapping attack,&#8221; a scheme in which fraudsters trick or bribe employees at wireless phone companies into redirecting the target&#8217;s text messages and phone calls to a device they control. From there, the attackers can reset the password for any online account that allows password resets via SMS.</p>
<p>But it wasn&#8217;t the subsequent bomb threat that Sonderman and friends called in to her home that bothered Dozono most. <em>It was the home invasion that was ordered at her address using strangers on social media.</em></p>
<p>Dozono said Sonderman created an account on <strong>Grindr</strong> &#8212; the location-based social networking and dating app for gay, bi, trans and queer people &#8212; and set up a rendezvous at her address with an unsuspecting Grindr user who was instructed to waltz into her home as if he was invited.</p>
<p>&#8220;This gentleman was sent to my home thinking someone was there, and he was given instructions to walk into my home,&#8221; Dozono said.</p>
<p>The court heard from multiple other victims targeted by Sonderman and friends over a two-year period. Including <strong>Shane Glass</strong>, who started getting harassed in 2019 over his @Shane Instagram handle. Glass told the court that endless pizza deliveries, as well as SIM swapping and swatting attacks left him paranoid for months that his assailant could be someone stalking him nearby.</p>
<p><strong>Judge Mark Norris</strong> said Sonderman&#8217;s agreement to plead to one count of extortion by threat of serious injury or damage carries with it a recommended sentence of 27 to 33 months in prison. However, the judge said other actions by the defendant warranted up to 60 months (5 years) in prison.</p>
<p>Sonderman might have been eligible to knock a few months off his sentence had he cooperated with investigators and refrained from committing further crimes while out on bond.</p>
<p>But prosecutors said that shortly after his release, Sonderman went right back to doing what he was doing when he got caught. Investigators who subpoenaed his online communications found he&#8217;d logged into the Instagram account &#8220;<strong>FreeTheSoldiers</strong>,&#8221; which was known to have been used by the group to harass people for their social media handles.</p>
<p>Sonderman was promptly re-arrested for violating the terms of his release, and prosecutors played for the court today a recording of a phone call Sonderman made from jail in which he brags to a female acquaintance that he wiped his mobile phone two days before investigators served another search warrant on his home.</p>
<p>Sonderman himself read a lengthy statement in which he apologized for his actions, blaming his &#8220;addiction&#8221; on several psychiatric conditions &#8212; including bipolar disorder. While his recitation was initially monotone and practically devoid of emotion, Sonderman eventually broke down in tears that made the rest of his statement difficult to hear over the phone-based conference system the court made available to reporters.</p>
<p>The bipolar diagnoses was confirmed by his mother, who sobbed as she simultaneously begged the court for mercy while saying her son didn&#8217;t deserve any.</p>
<p>Judge Norris said he was giving Sonderman the maximum sentenced allowed by law under the statute &#8212; 60 months in prison followed by three years of supervised release, but implied that his sentence would be far harsher if the law permitted.</p>
<p>&#8220;Although it may seem inadequate, the law is the law,&#8221; Norris said. &#8220;The harm it caused, the death and destruction&#8230;.it&#8217;s almost unspeakable. This is not like cases we frequently have that involve guns and carjacking and drugs. This is a whole different level of insidious criminal behavior here.&#8221;</p>
<p>Sonderman&#8217;s sentence pales in comparison to the 20-year prison time handed down in 2019 to serial swatter <strong>Tyler Barriss</strong>, a California man who admitted making a phony emergency call to police in late 2017 that <a href="https://krebsonsecurity.com/2019/03/man-behind-fatal-swatting-gets-20-years/" target="_blank" rel="noopener">led to the shooting death of an innocent Kansas resident</a>.</p>


feed_id: https://krebsonsecurity.com/?p=56391
title: PlugwalkJoe Does the Perp Walk
uri: PlugwalkJoe-Does-the-Perp-Walk
url: https://krebsonsecurity.com/2021/07/plugwalkjoe-does-the-perp-walk/
content:
<div id="attachment_56400" style="width: 263px" class="wp-caption alignright"><img aria-describedby="caption-attachment-56400" loading="lazy" class="size-full wp-image-56400" src="media/4f795f9c.plugwalkjoe.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/plugwalkjoe.png" alt="" width="253" height="386" /><p id="caption-attachment-56400" class="wp-caption-text">Joseph &#8220;PlugwalkJoe&#8221; O&#8217;Connor, in a photo from a paid <a href="https://www.globenewswire.com/en/news-release/2020/09/02/2087991/0/en/Cryptocurrency-Prodigy-Joseph-PlugWalkJoe-O-Connor-is-Helping-People-Everywhere-Master-Crypto.html#" target="_blank" rel="noopener">press release</a> on Sept. 02, 2020, pitching him as a trustworthy cryptocurrency expert and advisor.</p></div>
<p>One day after last summer&#8217;s mass-hack of <strong>Twitter</strong>, KrebsOnSecurity <a href="https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/" target="_blank" rel="noopener">wrote</a> that 22-year-old British citizen <strong>Joseph &#8220;PlugwalkJoe&#8221; O&#8217;Connor</strong> appeared to have been involved in the incident. When the <strong>U.S. Justice Department</strong> last week announced O&#8217;Connor&#8217;s arrest and indictment, his alleged role in the Twitter compromise was well covered in the media.</p>
<p>But most of the coverage seems to have overlooked the far more sinister criminal charges in the indictment, which involve an underground scene wherein young men turn to extortion, sextortion, SIM swapping, death threats and physical attacks &#8212; all in a frenzied effort to seize control over social media accounts.</p>
<p>Skim the government&#8217;s indictment and you might overlook a footnote on Page 4 that says O&#8217;Connor is part of a group that had exactly zero reservations about using their playbook of harassment tactics against federal agents who were already investigating their alleged crimes.</p>
<p>&#8220;<em>O&#8217;Connor has potentially been linked to additional prior swatting incidents and possibly (although not confirmed and currently still under investigation) the swatting of a U.S. law enforcement officer</em>,&#8221; the footnote reads.</p>
<p><a href="https://krebsonsecurity.com/tag/swatting/" target="_blank" rel="noopener">Swatting</a> involves making a false report to authorities in a target&#8217;s name with the intention of sending a heavily armed police force to that person&#8217;s address. It&#8217;s a potentially deadly hoax: Earlier this month, a Tennessee man was sentenced to 60 months in prison for setting in motion a swatting attack that <a href="https://krebsonsecurity.com/2021/07/serial-swatter-who-caused-death-gets-five-years-in-prison/" target="_blank" rel="noopener">led to the death of a 60-year-old grandfather</a>.</p>
<p>As for the actual criminal charges, O&#8217;Connor faces ten counts, including conspiracy, computer intrusion, extortive communications, stalking and threatening communications.</p>
<h2>FEMALE TARGETS</h2>
<p>All of those come into play in the case of the <strong>Snapchat</strong> account of actor <strong>Bella Thorne</strong>, who was allegedly targeted by PlugwalkJoe and associates in June 2019.</p>
<p>Investigators say O&#8217;Connor was involved in a &#8220;SIM swap&#8221; against Thorne&#8217;s mobile phone number. <a href="https://krebsonsecurity.com/tag/sim-swapping/" target="_blank" rel="noopener">Unauthorized SIM swapping</a> is a scheme in which fraudsters trick or bribe employees at wireless phone companies into redirecting the target’s text messages and phone calls to a device they control. From there, the attackers can reset the password for any online account that allows password resets via SMS.</p>
<p>In this case, the SIM swap was done to wrest control over Thorne&#8217;s Snapchat account. Once inside, the attackers found nude photos of Thorne, which they then threatened to release unless she agreed to post on social media thanking the hackers using their online handles.</p>
<p>The intruders posted on Thorne&#8217;s Snapchat, &#8220;Will drop nudes if 5000 of you follow @PlugwalkJoe.&#8221; Thorne told the feds her phone lost service shortly before her account was hijacked. Investigators later found the same Internet address used to access Thorne&#8217;s Snapchat account also was used minutes later to access &#8220;@Joe&#8221; on Instagram, which O&#8217;Connor has claimed publicly.</p>
<p>On June 15, 2019, Thorne <a href="https://twitter.com/THR/status/1140327216061878272" target="_blank" rel="noopener">posted on Twitter</a> that she&#8217;d been “threatened with my own nudes,” and posted screenshots of the text message with the individual who had extorted him/her. Thorne said she was releasing the photographs so that the individual would not be able to “take yet another thing from me.”</p>
<p>The indictment alleges O&#8217;Connor also swatted and cyberstalked a 16-year-old girl, sending her nude photos and threatening to rape and/or murder her and her family.</p>
<p>Social media personality <a href="https://en.wikipedia.org/wiki/Addison_Rae" target="_blank" rel="noopener">Addison Rae</a> had 55 million followers when her <strong>TikTok</strong> account got hacked last August. I <a href="https://twitter.com/briankrebs/status/1294464374841761792" target="_blank" rel="noopener">noted on Twitter</a> at the time that PlugWalkJoe had left his calling card yet again. The indictment alleges O&#8217;Connor also was involved in a SIM-swap against Rae&#8217;s mobile number.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-56403" src="media/f86540d6.addisonraeTT.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/addisonraeTT.png" alt="" width="729" height="757" /><br />
<span id="more-56391"></span></p>
<h2>BAD REACTION</h2>
<p>Prosecutors believe that roughly a week after the Twitter hack O&#8217;Connor called in bomb threats and swatting attacks targeting a high school and an airport in California. They&#8217;re confident it was O&#8217;Connor making the swatting and bomb threat calls because his voice is on record in a call he made to federal investigators, as well as to an inmate arrested for SIM swapping. </p>
<p>Curiously left out of the media coverage of O&#8217;Connor&#8217;s alleged crimes is that PlugwalkJoe appears to have admitted in a phone call with the FBI to being part of a criminal conspiracy. In the days following the Twitter mass-hack, O&#8217;Connor was quoted in <em>The New York Times</em> denying any involvement in the Twitter bitcoin scam. &#8220;I don&#8217;t care,&#8221; O&#8217;Connor told The Times. &#8220;They can come arrest me. I would laugh at them. I haven&#8217;t done anything.&#8221;</p>
<p>Speaking with KrebsOnSecurity via Instagram instant message just days after the Twitter hack, O&#8217;Connor demanded that his name be kept out of future blog posts here. After he was told that couldn&#8217;t be promised, he mentioned that some people in his circle of friends had been known to hire others to deliver physical beatings on people they didn&#8217;t like. In nearly the same breath, O&#8217;Connor said he was open to talking to federal investigators and telling his side of the story.</p>
<p>According to the indictment, a week after the Twitter hack a man identifying himself as O&#8217;Connor called federal investigators in Northern California. Specifically, the call went to the <strong>REACT Task Force</strong>. REACT is a team of law enforcement officers and prosecutors based in Santa Clara, Calif. that is <a href="https://krebsonsecurity.com/2018/11/busting-sim-swappers-and-sim-swap-myths/" target="_blank" rel="noopener">focused on catching criminal SIM swappers</a>, and by this point REACT already had plenty of audio from phone calls traced back to O&#8217;Connor in which he allegedly participated in a SIM swapping or swatting attack.</p>
<p>&#8220;REACT began receiving tips in 2018 regarding illegal activity of an individual using the online moniker &#8216;PlugwalkJoe,&#8217; purportedly identified as O&#8217;Connor from the United Kingdom,&#8221; the indictment states. </p>
<p>Prosecutors redacted the name of the law enforcement officer who allegedly was swatted by PlugwalkJoe, referring to him only as &#8220;C.T.,&#8221; a criminal investigator for the Santa Clara District Attorney and a REACT Task Force member. </p>
<p>FBI agents called O&#8217;Connor back at the number he left. O&#8217;Connor told the FBI that on the afternoon of July 15, 2020 he&#8217;d been in contact with other associates who were in communications with the alleged mastermind of the Twitter bitcoin scam. Those intermediaries worked directly with <strong>Graham Clark</strong>, then 17, who pleaded guilty to fraud charges last summer in connection with the Twitter hack and agreed to serve three years in prison followed by three years of probation.</p>
<p>The indictment says O&#8217;Connor told the feds he only wanted his friends to relay his desire for Clark to secure several different short Twitter usernames that belonged to other people, accounts that were to be later sold for a profit. The other associates who allegedly helped PlugwalkJoe interact with Clark also <a href="https://krebsonsecurity.com/2020/07/three-charged-in-july-15-twitter-compromise/" target="_blank" rel="noopener">have since been charged in connection with the Twitter hack</a>.</p>
<p>A copy of the indictment is <a href="media/ccb53b82.O-Connor-complaint.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/O-Connor-complaint.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=56301
title: The Life Cycle of a Breached Database
uri: The-Life-Cycle-of-a-Breached-Database
url: https://krebsonsecurity.com/2021/07/the-life-cycle-of-a-breached-database/
content:
<p>Every time there is another data breach, we are asked to change our password at the breached entity. But the reality is that in most cases by the time the victim organization discloses an incident publicly the information has already been harvested many times over by profit-seeking cybercriminals. Here&#8217;s a closer look at what typically transpires in the weeks or months before an organization notifies its users about a breached database.</p>
<p><img loading="lazy" class="aligncenter wp-image-56446" src="media/50ae02a7.dataspill.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/dataspill.png" alt="" width="615" height="487" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/dataspill.png 1146w, https://krebsonsecurity.com/wp-content/uploads/2021/07/dataspill-768x608.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/dataspill-782x619.png 782w" sizes="(max-width: 615px) 100vw, 615px" /></p>
<p>Our continued reliance on passwords for authentication has contributed to one toxic data spill or hack after another. One might even say passwords are the fossil fuels powering most IT modernization: They&#8217;re ubiquitous because they are cheap and easy to use, but that means they also come with significant trade-offs &#8212; such as polluting the Internet with weaponized data when they&#8217;re leaked or stolen en masse.</p>
<p>When a website&#8217;s user database gets compromised, that information invariably turns up on hacker forums. There, denizens with computer rigs that are built primarily for mining virtual currencies can set to work using those systems to crack passwords.</p>
<p>How successful this password cracking is depends a great deal on the length of one&#8217;s password and the type of password hashing algorithm the victim website uses to obfuscate user passwords. But a decent crypto-mining rig can quickly crack a majority of password hashes generated with <a href="https://en.wikipedia.org/wiki/MD5" target="_blank" rel="noopener">MD5</a> (one of the weaker and more commonly-used password hashing algorithms).</p>
<p>&#8220;You hand that over to a person who used to mine Ethereum or Bitcoin, and if they have a large enough dictionary [of pre-computed hashes] then you can essentially break 60-70 percent of the hashed passwords in a day or two,&#8221; said <strong>Fabian Wosar</strong>, chief technology officer at security firm <a href="https://www.emsisoft.com" target="_blank" rel="noopener">Emsisoft</a>.</p>
<p>From there, the list of email addresses and corresponding cracked passwords will be run through various automated tools that can check how many email address and password pairs in a given leaked data set also work at other popular websites (and heaven help <a href="https://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank" rel="noopener">those who&#8217;ve re-used their email password elsewhere</a>).</p>
<p>This sifting of databases for low-hanging fruit and password re-use most often yields less than a one percent success rate &#8212; and usually far less than one percent.</p>
<p>But even a hit rate below one percent can be a profitable haul for fraudsters, particularly when they&#8217;re password testing databases with millions of users. From there, the credentials are eventually used for fraud and resold in bulk to legally murky online services that index and resell access to breached data.</p>
<p>Much like <a href="https://krebsonsecurity.com/?s=weleakinfo" target="_blank" rel="noopener">WeLeakInfo</a> and others operated before being shut down by law enforcement agencies, these services sell access to anyone who wants to search through billions of stolen credentials by email address, username, password, Internet address, and a variety of other typical database fields.</p>
<h2>TARGETED PHISHING</h2>
<p>So hopefully by this point it should be clear why re-using passwords is generally a bad idea. But the more insidious threat with hacked databases comes not from password re-use but from targeted phishing activity in the early days of a breach, when relatively few ne&#8217;er-do-wells have got their hands on a hot new hacked database.</p>
<p>Earlier this month, customers of the soccer jersey retailer <strong>classicfootballshirts.co.uk</strong> started receiving emails with a &#8220;cash back&#8221; offer. The messages addressed customers by name and referenced past order numbers and payment amounts tied to each account. The emails encouraged recipients to click a link to accept the cash back offer, and the link went to a look-alike domain that requested bank information.</p>
<div id="attachment_56442" style="width: 669px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56442" loading="lazy" class="size-full wp-image-56442" src="media/0d14c1d3.cashback.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/cashback.png" alt="" width="659" height="589" /><p id="caption-attachment-56442" class="wp-caption-text">The targeted phishing message that went out to classicfootballshirts.co.uk customers this month.</p></div>
<p>&#8220;It soon became clear that customer data relating to historic orders had been compromised to conduct this attack,&#8221; Classicfootballshirts said in <a href="https://www.classicfootballshirts.co.uk/data-statement" target="_blank" rel="noopener">a statement</a> about the incident.<span id="more-56301"></span></p>
<p><strong>Allison Nixon</strong>, chief research officer with New York City-based cyber intelligence firm <a href="https://www.unit221b.com" target="_blank" rel="noopener">Unit221B</a>, recalled what happened in the weeks leading up to Dec. 22, 2020, when cryptocurrency wallet company <strong>Ledger</strong> acknowledged that someone had released the names, mailing addresses and phone numbers for 272,000 customers.</p>
<p>Nixon said she and her colleagues noticed in the preceding months a huge uptick in <a href="https://krebsonsecurity.com/category/sim-swapping/" target="_blank" rel="noopener">SIM-swapping attacks</a>, a scheme in which fraudsters trick or bribe employees at wireless phone companies into redirecting the target’s text messages and phone calls to a device they control. From there, the attackers can reset the password for any online account that allows password resets via SMS.</p>
<p>&#8220;A week or two prior to that we were seeing a whole lot of SIM swapping activity,&#8221; Nixon said. &#8220;We knew the information was coming from some database but we couldn&#8217;t figure out what service they all had in common. After the Ledger database got leaked publicly, we started looking at the [SIM swapping] victims and found 100 percent of them were present in the Ledger database.&#8221;</p>
<p>In a statement about the breach, Ledger said the data was likely stolen in June 2020, meaning hackers had roughly six months to launch targeted attacks using extremely detailed information about customers.</p>
<p>&#8220;If you were to look [on cybercrime forums] at the past history of people posting about that Ledger database, you&#8217;d see people were selling it privately for months prior to that,&#8221; Nixon said. &#8220;It seems like this database was slowly percolating out wider and wider, until someone decided to remove a lot of its value by posting the whole thing publicly.&#8221;</p>
<p>Here are some tips to help avoid falling prey to incessant data breaches and increasingly sophisticated phishing schemes:</p>
<p>–<strong>Avoid clicking on links and attachments in email,</strong> even in messages that appear to be sent from someone you have heard from previously. And as the phishing examples above demonstrate, many of today&#8217;s phishing scams use elements from hacked databases to make their lures more convincing.</p>
<p>–<strong>Urgency should be a giant red flag.</strong> Most phishing scams invoke a temporal element that warns of negative consequences should you fail to respond or act quickly. Take a deep breath. If you’re unsure whether the message is legitimate, visit the site or service in question manually (ideally, using a browser bookmark so as to avoid <a href="https://krebsonsecurity.com/?s=typosquatting&amp;x=0&amp;y=0" target="_blank" rel="noopener">potential typosquatting sites</a>).</p>
<p>–<strong>Don’t re-use passwords. </strong>If you’re the kind of person who likes to use the same password across multiple sites, then you definitely need to be using a password manager. That’s because password managers handle the tedious task of creating and remembering unique, complex passwords on your behalf; all you need to do is remember a single, strong master password or passphrase. In essence, you effectively get to use the same password across all Web sites. Some of the more popular password managers include <a href="https://www.dashlane.com/" target="_blank" rel="noopener">Dashlane</a>, <a href="https://keepass.info/" target="_blank" rel="noopener">Keepass</a>, <a href="https://www.lastpass.com/" target="_blank" rel="noopener">LastPass</a> and <a href="https://www.roboform.com/" target="_blank" rel="noopener">Roboform</a>.</p>
<p><strong>–Phone-based phishing uses hacked databases, too:</strong> A great many scams are perpetrated over the phone, leveraging personal and financial information gleaned from past data breaches to make them sound more believable. If you think you&#8217;d never fall for someone trying to scam you over the phone, check out <a href="https://krebsonsecurity.com/2018/10/voice-phishing-scams-are-getting-more-clever/" target="_blank" rel="noopener">this story</a> about how a tech-savvy professional got taken for thousands of dollars by a fraudster masquerading as his credit union. Remember, <a href="https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/" target="_blank" rel="noopener">When in Doubt: Hang Up, Look Up, &amp; Call Back</a>.</p>


feed_id: https://krebsonsecurity.com/?p=56464
title: Ransomware Gangs and the Name Game Distraction
uri: Ransomware-Gangs-and-the-Name-Game-Distraction
url: https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/
content:
<p>It&#8217;s nice when ransomware gangs have their bitcoin stolen, malware servers shut down, or are otherwise forced to disband. We hang on to these occasional victories because history tells us that most ransomware moneymaking collectives don&#8217;t go away so much as reinvent themselves under a new name, with new rules, targets and weaponry. Indeed, some of the most destructive and costly ransomware groups are now in their third incarnation.</p>
<div id="attachment_56482" style="width: 770px" class="wp-caption aligncenter"><a href="media/ad947983.ransmocalendar.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/ransmocalendar.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-56482" loading="lazy" class="wp-image-56482" src="media/ad947983.ransmocalendar.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/ransmocalendar.png" alt="" width="760" height="475" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/08/ransmocalendar.png 1167w, https://krebsonsecurity.com/wp-content/uploads/2021/08/ransmocalendar-768x480.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/08/ransmocalendar-782x488.png 782w" sizes="(max-width: 760px) 100vw, 760px" /></a><p id="caption-attachment-56482" class="wp-caption-text">A rough timeline of major ransomware operations and their reputed links over time.</p></div>
<p>Reinvention is a basic survival skill in the cybercrime business. Among the oldest tricks in the book is to fake one&#8217;s demise or retirement and invent a new identity. A key goal of such subterfuge is to throw investigators off the scent or to temporarily direct their attention elsewhere.</p>
<p>Cybercriminal syndicates also perform similar disappearing acts whenever it suits them. These organizational reboots are an opportunity for ransomware program leaders to set new ground rules for their members &#8212; such as which types of victims aren&#8217;t allowed (e.g., hospitals, governments, critical infrastructure), or how much of a ransom payment an affiliate should expect for bringing the group access to a new victim network.</p>
<p>I put together the above graphic to illustrate some of the more notable ransom gang reinventions over the past five years. What it doesn&#8217;t show is what we already know about the cybercriminals behind many of these seemingly disparate ransomware groups, some of whom were pioneers in the ransomware space almost a decade ago. We&#8217;ll explore that more in the latter half of this story.</p>
<p>One of the more intriguing and recent revamps involves <strong>DarkSide</strong>, the group that extracted a $5 million ransom from <strong>Colonial Pipeline</strong> earlier this year, only to watch <a href="https://krebsonsecurity.com/2021/06/justice-dept-claws-back-2-3m-paid-by-colonial-pipeline-to-ransomware-gang/" target="_blank" rel="noopener">much of it get clawed back in an operation by the U.S. Department of Justice</a>.</p>
<p>After acknowledging someone had also seized their Internet servers, DarkSide <a href="https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/" target="_blank" rel="noopener">announced it was folding</a>. But a little more than a month later, a new ransomware affiliate program called <strong>BlackMatter</strong> emerged, and experts quickly <a href="https://www.bleepingcomputer.com/news/security/darkside-ransomware-gang-returns-as-new-blackmatter-operation/" target="_blank" rel="noopener">determined</a> BlackMatter was using the same unique encryption methods that DarkSide had used in their attacks.</p>
<p>DarkSide&#8217;s demise roughly coincided with that of <strong>REvil</strong>, a long-running ransomware group that claims to have extorted more than $100 million from victims. REvil&#8217;s last big victim was <strong>Kaseya</strong>, a Miami-based company whose products help system administrators manage large networks remotely. That attack let REvil deploy ransomware to as many as 1,500 organizations that used Kaseya.</p>
<p>REvil demanded a whopping $70 million to release a universal decryptor for all victims of the Kaseya attack. Just days later, <strong>President Biden</strong> <a href="https://www.cnbc.com/2021/07/09/ransomware-biden-presses-putin-to-disrupt-cybercriminals-in-russia.html" target="_blank" rel="noopener">reportedly</a> told Russian <strong>President Vladimir Putin</strong> that he expects Russia to act when the United States shares information on specific Russians involved in ransomware activity.</p>
<div id="attachment_56488" style="width: 690px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56488" loading="lazy" class="size-full wp-image-56488" src="media/29666b5f.revil-note.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/revil-note.png" alt="" width="680" height="441" /><p id="caption-attachment-56488" class="wp-caption-text">A REvil ransom note.</p></div>
<p>Whether that conversation prompted actions is unclear. But REvil&#8217;s victim shaming blog would disappear from the dark web just four days later.</p>
<p><strong>Mark Arena</strong>, CEO of cyber threat intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a>, said it remains unclear whether BlackMatter is the REvil crew operating under a new banner, or if it is simply the reincarnation of DarkSide.</p>
<p>But one thing is clear, Arena said: &#8220;Likely we will see them again unless they&#8217;ve been arrested.&#8221;</p>
<p>Likely, indeed. REvil is widely considered a reboot of <a href="https://krebsonsecurity.com/?s=gandcrab" target="_blank" rel="noopener">GandCrab</a>, a prolific ransomware gang that boasted of extorting more than $2 billion over 12 months before abruptly closing up shop in June 2019. &#8220;We are living proof that you can do evil and get off scot-free,&#8221; Gandcrab bragged.</p>
<p>And wouldn&#8217;t you know it: Researchers have found GandCrab <a href="https://research.checkpoint.com/2018/gandcrab-ransomware-mindset/" target="_blank" rel="noopener">shared key behaviors</a> with <strong>Cerber</strong>, an early ransomware-as-a-service operation that stopped claiming new victims at roughly the same time that GandCrab came on the scene.<span id="more-56464"></span></p>
<h2>GOOD GRIEF</h2>
<p>The past few months have been a busy time for ransomware groups looking to rebrand. <em>BleepingComputer</em> recently <a href="https://www.bleepingcomputer.com/news/security/doppelpaymer-ransomware-gang-rebrands-as-the-grief-group/" target="_blank" rel="noopener">reported</a> that the new &#8220;<strong>Grief&#8221;</strong> ransomware startup was just the latest paintjob of <strong>DoppelPaymer</strong>, a ransomware strain that shared most of its code with an earlier iteration from 2016 called <strong>BitPaymer</strong>.</p>
<p>All three of these ransom operations stem from a prolific cybercrime group known variously as <a href="https://attack.mitre.org/groups/G0092/" target="_blank" rel="noopener">TA505,</a> &#8220;<strong>Indrik Spider</strong>&#8221; and (perhaps most memorably) <a href="https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/" target="_blank" rel="noopener"><strong>Evil Corp</strong></a>. According to security firm <strong>CrowdStrike</strong>, Indrik Spider was formed in 2014 by former affiliates of the <a href="https://krebsonsecurity.com/tag/gameover-zeus/" target="_blank" rel="noopener">GameOver Zeus criminal network</a> who internally referred to themselves as &#8220;<a href="https://krebsonsecurity.com/2015/08/inside-the-100m-business-club-crime-gang/" target="_blank" rel="noopener">The Business Club</a>.&#8221;</p>
<p>The Business Club was a notorious Eastern European organized cybercrime gang accused of stealing more than $100 million from banks and businesses worldwide. In 2015, <a href="https://krebsonsecurity.com/2015/02/fbi-3m-bounty-for-zeus-trojan-author/" target="_blank" rel="noopener">the FBI offered a standing $3 million bounty</a> for information leading to the capture of the Business Club&#8217;s leader &#8212; <strong>Evgeniy Mikhailovich Bogachev</strong>. By the time the FBI put a price on his head, Bogachev&#8217;s Zeus trojan and later variants had been infecting computers for nearly a decade.</p>
<div id="attachment_26282" style="width: 730px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-26282" loading="lazy" class=" wp-image-26282" src="media/9fb10233.evgeniy-fbi.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/06/evgeniy-fbi.png" alt="" width="720" height="815" srcset="https://krebsonsecurity.com/wp-content/uploads/2014/06/evgeniy-fbi.png 751w, https://krebsonsecurity.com/wp-content/uploads/2014/06/evgeniy-fbi-285x322.png 285w, https://krebsonsecurity.com/wp-content/uploads/2014/06/evgeniy-fbi-600x679.png 600w" sizes="(max-width: 720px) 100vw, 720px" /><p id="caption-attachment-26282" class="wp-caption-text">The alleged ZeuS Trojan author, Evgeniy Mikhaylovich Bogachev. Source: FBI</p></div>
<p>Bogachev was way ahead of his colleagues in pursuing ransomware. His <a href="https://krebsonsecurity.com/2014/06/backstage-with-the-gameover-botnet-hijackers/" target="_blank" rel="noopener">Gameover Zeus Botnet</a> was a peer-to-peer crime machine that infected between 500,000 and a million <strong>Microsoft Windows</strong> computers. Throughout 2013 and 2014, PCs infected with Gameover were seeded with <a href="https://en.wikipedia.org/wiki/CryptoLocker" target="_blank" rel="noopener">Cryptolocker</a>, an early, much-copied ransomware strain allegedly authored by Bogachev himself.</p>
<p>CrowdStrike notes that shortly after the group’s inception, Indrik Spider developed their own custom malware known as <a href="https://any.run/malware-trends/dridex" target="_blank" rel="noopener">Dridex</a>, which has emerged as a major vector for deploying malware that lays the groundwork for ransomware attacks.</p>
<p>&#8220;Early versions of Dridex were primitive, but over the years the malware became increasingly professional and sophisticated,&#8221; CrowdStrike researchers wrote. &#8220;In fact, Dridex operations were significant throughout 2015 and 2016, making it one of the most prevalent eCrime malware families.&#8221;</p>
<p>That <a href="https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/" target="_blank" rel="noopener">CrowdStrike report</a> was from July 2019. In April 2021, security experts at <strong>Check Point Software</strong> found Dridex <a href="https://blog.checkpoint.com/2021/05/13/april-2021s-most-wanted-malware-dridex-remains-in-top-position-amidst-global-surge-in-ransomware-attacks/" target="_blank" rel="noopener">was still the most prevalent malware</a> (for the second month running). Mainly distributed via well-crafted phishing emails &#8212; such as <a href="https://blog.knowbe4.com/new-quickbooks-themed-phishing-attack-seeks-to-infect-victims-with-dridex-malware" target="_blank" rel="noopener">a recent campaign that spoofed <strong>QuickBooks</strong></a> &#8212; Dridex often serves as the attacker&#8217;s initial foothold in company-wide ransomware attacks, CheckPoint said.</p>
<h2>REBRANDING TO AVOID SANCTIONS</h2>
<p>Another ransomware family tied to Evil Corp. and the Dridex gang is <a href="https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/" target="_blank" rel="noopener"><strong>WastedLocker</strong></a>, which is the latest name of a ransomware strain that has rebranded several times since 2019. That was when the Justice Department put a $5 million bounty on the head of Evil Corp., and the Treasury Department&#8217;s <strong>Office of Foreign Asset Control</strong> (OFAC) said it was prepared to <a href="https://krebsonsecurity.com/2020/10/ransomware-victims-that-pay-up-could-incur-steep-fines-from-uncle-sam/" target="_blank" rel="noopener">impose hefty fines on anyone who paid a ransom to the cybercrime group</a>.</p>
<div id="attachment_49935" style="width: 777px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-49935" loading="lazy" class=" wp-image-49935" src="media/0a225466.yukabets.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/yukabets.png" alt="" width="767" height="625" /><p id="caption-attachment-49935" class="wp-caption-text">Alleged Evil Corp leader Maksim &#8220;Aqua&#8221; Yakubets. Image: FBI</p></div>
<p>In early June 2021, researchers discovered the Dridex gang was once again trying to morph in an effort to evade U.S. sanctions. The drama began when the <a href="https://www.mcafee.com/blogs/other-blogs/mcafee-labs/babuk-ransomware/" target="_blank" rel="noopener">Babuk ransomware group</a> announced in May that they were starting a new platform for data leak extortion, which was intended to appeal to ransomware groups that didn&#8217;t already have a blog where they can publicly shame victims into paying by gradually releasing stolen data.</p>
<p>On June 1, Babuk changed the name of its leaks site to payload[dot]bin, and began leaking victim data. Since then, multiple security experts have spotted what they believe is <a href="https://www.bleepingcomputer.com/news/security/new-evil-corp-ransomware-mimics-payloadbin-gang-to-evade-us-sanctions/" target="_blank" rel="noopener">another version of WastedLocker dressed up as payload.bin-branded ransomware</a>.</p>
<p>&#8220;Looks like EvilCorp is trying to pass off as Babuk this time,&#8221; <a href="https://twitter.com/fwosar/status/1401110845820747797" target="_blank" rel="noopener">wrote</a> <strong>Fabian Wosar</strong>, chief technology officer at security firm <strong>Emsisoft</strong>. &#8220;As Babuk releases their PayloadBin leak portal, EvilCorp rebrands WastedLocker once again as PayloadBin in an attempt to trick victims into violating OFAC regulations.&#8221;</p>
<p>Experts are quick to point out that many cybercriminals involved in ransomware activity are affiliates of more than one distinct ransomware-as-a-service operation. In addition, it is common for a large number of affiliates to migrate to competing ransomware groups when their existing sponsor suddenly gets shut down.</p>
<p>All of the above would seem to suggest that the success of any strategy for countering the ransomware epidemic hinges heavily on the ability to disrupt or apprehend a relatively small number of cybercriminals who appear to wear many disguises.</p>
<p>Perhaps that&#8217;s why the Biden Administration said last month it was <a href="https://www.nytimes.com/2021/07/15/us/biden-reward-ransomware.html" target="_blank" rel="noopener">offering a $10 million reward</a> for information that leads to the arrest of the gangs behind the extortion schemes, and for new approaches that make it easier to trace and block cryptocurrency payments.</p>


feed_id: https://krebsonsecurity.com/?p=56513
title: Phishing Sites Targeting Scammers and Thieves
uri: Phishing-Sites-Targeting-Scammers-and-Thieves
url: https://krebsonsecurity.com/2021/08/phishing-sites-targeting-scammers-and-thieves/
content:
<p>I was preparing to knock off work for the week on a recent Friday evening when a curious and annoying email came in via <a href="https://krebsonsecurity.com/about/" rel="noopener" target="_blank">the contact form</a> on this site:</p>
<p>&#8220;Hello I go by the username Nuclear27 on your site <strong>Briansclub[.]com</strong>,&#8221; wrote &#8220;<strong>Mitch</strong>,&#8221; confusing me with the proprietor of perhaps the underground&#8217;s largest bazaar for stolen credit and identity data. &#8220;I made a deposit to my wallet on the site but nothing has shown up yet and I would like to know why.&#8221;</p>
<div id="attachment_56523" style="width: 772px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56523" loading="lazy" class=" wp-image-56523" src="media/f3c8f142.bchome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/bchome.png" alt="" width="762" height="404" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/08/bchome.png 1528w, https://krebsonsecurity.com/wp-content/uploads/2021/08/bchome-768x407.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/08/bchome-782x414.png 782w" sizes="(max-width: 762px) 100vw, 762px" /><p id="caption-attachment-56523" class="wp-caption-text">The real BriansClub login page.</p></div>
<p>Several things stood out in Mitch&#8217;s message. For starters, that is not the actual domain for BriansClub. And it&#8217;s easy to see why Mitch got snookered: The real BriansClub site is currently not at the top of search results when one queries that shop name at Google.</p>
<p>Also, this greenhorn criminal clearly had bought into BriansClub&#8217;s advertising, which uses my name and likeness in a series of ads that run on all the top cybercrime forums. In those ads, a crab with my head on it zigs and zags on the sand. This is all meant to be a big joke: Krebs means &#8220;crab&#8221; or &#8220;cancer&#8221; in German, but a &#8220;crab&#8221; is sometimes used in Russian hacker slang to refer to a &#8220;carder,&#8221; or a person who regularly engages in street-level credit card fraud. Like Mitch.</p>
<p>In late 2019, BriansClub changed its homepage to include doctored images of my Social Security and passport cards, credit report and mobile phone bill information. That was right after KrebsOnSecurity broke the news that someone had <a href="https://krebsonsecurity.com/2019/10/briansclub-hack-rescues-26m-stolen-cards/" target="_blank" rel="noopener">hacked BriansClub and siphoned information on 26 million stolen debit and credit accounts</a>. The hacked BriansClub database had <a href="https://krebsonsecurity.com/2019/10/takeaways-from-the-566m-briansclub-breach/" rel="noopener" target="_blank">an estimated collective street value of $566 million</a>, and that data was subsequently shared with thousands of financial institutions. </p>
<p>Mitch said he&#8217;d just made a deposit of $240 worth of bitcoin at BriansClub[.]com, and was wondering when the funds would be reflected in the balance of his account on the shop.</p>
<p>Playing along, I said I was sorry to hear about his ordeal, and asked Mitch if there were any stolen cards issued by a particular bank or to a specific region that he was seeking.</p>
<p>Mitch didn&#8217;t bite, but neither would he be dissuaded that I was at fault for his wayward funds. He shared a picture showing funds he&#8217;d sent to the bitcoin address instructed by BriansClub[.]com &#8212; <a href="https://www.blockchain.com/btc/address/1PLALmM5rrmLTGGVRHHTnB6VnZd3FFwh1Z" target="_blank" rel="noopener">1PLALmM5rrmLTGGVRHHTnB6VnZd3FFwh1Z</a> &#8212; <a href="media/38faf0d8.mitch.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/mitch.png" target="_blank" rel="noopener">using a Bitcoin ATM in Canada</a>.</p>
<p>The real BriansClub uses a dodgy virtual currency exchange service based in St. Petersburg, Russia called <strong>PinPays</strong>. The company&#8217;s website has long featured little more than a brand icon and an instant messenger address to reach the proprietor, and that same address is active on several top Russian cybercrime forums. The fake BriansClub told Mitch the Bitcoin address he was asked to pay was a PinPays address that would change with each transaction.</p>
<div id="attachment_56518" style="width: 771px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56518" loading="lazy" class=" wp-image-56518" src="media/0080fafb.bcpinpays.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/bcpinpays.png" alt="" width="761" height="446" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/08/bcpinpays.png 1206w, https://krebsonsecurity.com/wp-content/uploads/2021/08/bcpinpays-768x450.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/08/bcpinpays-782x458.png 782w" sizes="(max-width: 761px) 100vw, 761px" /><p id="caption-attachment-56518" class="wp-caption-text">The payment message displayed by the carding site phishing domain BriansClub[.]com.</p></div>
<p>However, upon registering at the phishing site and clicking to fund my account, I was presented with the exact same Bitcoin address that Mitch said he paid. Also, the site wasn&#8217;t using PinPays; it was just claiming to do so to further mimic the real BriansClub.</p>
<p>According to the Blockchain, that Bitcoin address Mitch paid has received more than a thousand payments over the past five months totaling more than USD $40,000 worth of Bitcoin. Most are relatively small payments like Mitch&#8217;s.</p>
<div id="attachment_56520" style="width: 295px" class="wp-caption alignright"><img aria-describedby="caption-attachment-56520" loading="lazy" class=" wp-image-56520" src="media/38faf0d8.mitch.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/mitch.png" alt="" width="285" height="628" /><p id="caption-attachment-56520" class="wp-caption-text">The screenshot Mitch sent of his deposit.</p></div>
<p>Unwary scammers like Mitch are a dime a dozen, as are phishing sites that spoof criminal services online. Shortly after it came online as a phishing site last year, BriansClub[.]com was hosted at a company in Moscow with just a handful of other domains phishing popular cybercrime stores, including Jstashbazar[.]com, vclub[.]cards, vclubb[.]com and vclub[.]credit.</p>
<p>Whoever&#8217;s behind these sites is making a decent income fleecing clueless crooks. A review of <a href="https://www.blockchain.com/btc/address/16c3rDKaySmnk5cdnm6xBvSPqs9aZweEG3?page=1" target="_blank" rel="noopener">the Bitcoin wallet</a> listed as the payment address for <strong>BriansClub[.]org</strong>, for example, shows a similar haul: 704 transactions totaling $38,000 in Bitcoin over the past 10 months.</p>
<p>&#8220;Wow, thanks for ripping me off,&#8221; Mitch wrote, after I&#8217;d dozed off for the evening without responding to his increasingly strident emails. &#8220;Should have spent the last money on my bills I&#8217;m trying to pay off. Should have known you were nothing but a thief.&#8221;</p>
<p>Deciding the ruse had gone too far, I confessed to Mitch that I wasn&#8217;t really the administrator of BriansClub, and that the person he&#8217;d reached out to was an independent journalist who writes about cybercrime. I told him not to feel bad, as more than a thousand people had been similarly duped by the carding shop.</p>
<p>But Mitch did not appear to accept my confession.</p>
<p>&#8220;If that&#8217;s the case then why is your name all over it including in the window that opens up when you go to make a deposit?,&#8221; Mitch demanded, referring to the phishing site.</p>
<p>Clearly, nothing I said was going to deter Mitch at this point. He asked in a follow-up email if a link he included in the message was indeed the &#8220;legitimate&#8221; BriansClub address. My only reply was that he should maybe consider another line of work before he got ripped off yet again, or the Royal Canadian Mounted Police showed up at his doorstep.<span id="more-56513"></span></p>
<p>Scammers who fall for fake carding sites can expect to have their accounts taken over at the real shop, which usually means someone spends your balance on stolen cards. But mostly, these imposter carding sites are asking new members to fund their accounts by making deposits in virtual currency like Bitcoin.</p>
<p>In 2018, KrebsOnSecurity examined a huge network of phishing sites masquerading as the top carding stores which <a href="https://krebsonsecurity.com/2018/05/will-the-real-jokers-stash-come-forward/" target="_blank" rel="noopener">all traced back to a web development group in Pakistan that&#8217;s apparently been stealing from thieves for years</a>.</p>
<p>As I noted in that piece, creating a network of fake carding sites is the perfect cybercrime. After all, nobody who gets phished or scammed is going to report the crime to the authorities. Nor will anyone help the poor sucker who gets snookered by one of these fake carding sites. Caveat Emptor!</p>
<p>The most one can hope for is that the occasional enterprising phisher is brought to justice. While it may be hard to believe that authorities would go after crooks stealing from one another, in 2017 a Connecticut man <a href="https://www.cyberscoop.com/hacker-pleads-guilty-to-phishing-dark-net-market-crooks-for-over-365000/" target="_blank" rel="noopener">pleaded guilty to charges of phishing several criminal dark web markets</a> in a scheme that eventually netted over $365,000 and more than 10,000 stolen user credentials.</p>
<p>And what about the provenance of the phishing domain briansclub[.]com? Looking closer at the original WHOIS registration records for briansclub[.]com via <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools</a> (an advertiser on this site), we can see it was registered in November 2015 &#8212; several months after the real BriansClub came online. It was registered to a &#8220;<strong>Brian Billionaire</strong>,&#8221; a.k.a. <a href="https://www.linkedin.com/in/newhotmusic/" target="_blank" rel="noopener">Brian O&#8217;Connor</a>, an apparently accomplished music deejay, rapper and rap music producer in Florida.</p>
<div id="attachment_56524" style="width: 725px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56524" loading="lazy" class="wp-image-56524 size-full" src="media/8cfee8d5.brianbillionaire.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/brianbillionaire.png" alt="" width="715" height="414" /><p id="caption-attachment-56524" class="wp-caption-text">Brian Billionaire.</p></div>
<p>For several years after it came online, BriansClub[.]com and other domains apparently registered to Mr. Billionaire redirected to his main site &#8212; <strong>newhotmusic.com</strong>, which predates the carding shop BriansClub and also has a members-only section of the site called Brian&#8217;s Club.</p>
<p>Mr. Billionaire did not respond to multiple requests for comment, but it looks like his only crime is <a href="https://www.facebook.com/newhotmusic/posts/4146495798749182" target="_blank" rel="noopener">being a somewhat cringeworthy DJ</a>. DomainTools&#8217; <a href="media/b264e92b.briansclubhostinghistory.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/briansclubhostinghistory.png" target="_blank" rel="noopener">record for briansclub[.]com</a> says the domain was abandoned or dormant for a period in 2019, only to be scooped up again by someone in May 2020 when it became a phishing site spoofing the real BriansClub.</p>


