# articles

feed_id: https://krebsonsecurity.com/?p=51435
title: Would You Have Fallen for This Phone Scam?
uri: Would-You-Have-Fallen-for-This-Phone-Scam
url: https://krebsonsecurity.com/2020/04/would-you-have-fallen-for-this-phone-scam/
content:
<p>You may have heard that today&#8217;s phone fraudsters like to use use caller ID spoofing services to make their scam calls seem more believable. But you probably didn&#8217;t know that these fraudsters also can use caller ID spoofing to trick your bank into giving up information about recent transactions on your account &#8212; data that can then be abused to make their phone scams more believable and expose you to additional forms of identity theft.</p>
<p><img class="wp-image-26175 alignright" src="media/7e2f6781.phonetap-e1401312801926.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/05/phonetap-e1401312801926.png" alt="" width="248" height="356" /></p>
<p>Last week, KrebsOnSecurity told the harrowing tale of a reader (a security expert, no less) who tried to turn the tables on his telephonic tormentors <a href="https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/" target="_blank" rel="noopener">and failed spectacularly</a>. In that episode, the people impersonating his bank not only spoofed the bank&#8217;s real phone number, but they were also pretending to be him in a separate call at the same time with his bank.</p>
<p>This foiled his efforts to make sure it was really his bank that called him, because he called his bank with another phone and the bank confirmed they currently were in a separate call with him discussing fraud on his account (however, the other call was the fraudster pretending to be him).</p>
<p>Shortly after that story ran, I heard from another reader &#8212; we&#8217;ll call him &#8220;Jim&#8221; since he didn&#8217;t want his real name used for this story &#8212; whose wife was the target of a similar scam, albeit with an important twist: The scammers were armed with information about a number of her recent financial transactions, which he claims they got from the bank&#8217;s own automated phone system just by spoofing her phone number.</p>
<p>&#8220;When they originally called my wife, there were no fraudulent transactions on her account, but they were able to specify the last three transactions she had made, which combined with the caller-ID had mistakenly earned her trust,&#8221; Jim explained. &#8220;After we figured out what was going on, we were left asking ourselves how the crooks had obtained her last three transactions without breaking into her account online. As it turned out, calling the phone number on the back of the credit card from the phone number linked with the card provided the most recent transactions without providing any form of authentication.&#8221;</p>
<p>Jim said he was so aghast at this realization that he called the same number from his phone and tried accessing his account, which is also at Citi but wholly separate from his spouse&#8217;s. Sure enough, he said, as long as he was calling from the number on file for his account, the automated system let him review recent transactions without any further authentication.</p>
<p>&#8220;I confirmed on my separate Citi card that they often (but not quite always) were providing the transaction details,&#8221; Jim said. &#8220;I was appalled that Citi would do that. <span class="pullquote pqleft">So, it seemed the crooks would spoof caller ID when calling Citibank, as well as when calling the target/victim.</span>&#8221;</p>
<p>The incident Jim described happened in late January 2020, and Citi may have changed its procedures since then. The company has not yet responded to requests for comment.</p>
<p>But in a phone interview with KrebsOnSecurity earlier this week, Jim made a call to Citi&#8217;s automated system from his mobile phone on file with the bank, and I could hear Citi&#8217;s systems asking him to enter the last four digits of his credit card number before he could review recent transactions.</p>
<p>The request for the last four of the customer&#8217;s credit card number was consistent with my own testing, which relied upon on a caller ID spoofing service advertised in the cybercrime underground and aimed at a Citi account controlled by this author.</p>
<p>In one test, the spoofed call let KrebsOnSecurity hear recent transaction data &#8212; where and when the transaction was made, and how much was spent &#8212; after providing the automated system the last four digits of the account&#8217;s credit card number. In another test, the automated system asked for the account holder&#8217;s full Social Security number.</p>
<h4>PREGNANT PAUSES AND BULGING EMAIL BOMBS</h4>
<p>Jim said the fraudster who called his wife clearly already knew her mailing and email addresses, her mobile number and the fact that her card was an American Airlines-branded Citi card. The caller said there had been a series of suspicious transactions, and proceeded to read back details of several recent transactions to verify if those were purchases she&#8217;d authorized.</p>
<div id="attachment_51449" style="width: 210px" class="wp-caption alignleft"><a class="lightbox" href="media/5ee8e085.sipssn.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/sipssn.png"><img class="wp-image-51449" src="media/5ee8e085.sipssn.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/sipssn.png" alt="" width="200" height="518" /></a><p class="wp-caption-text">A list of services offered by one of several underground stores that sell caller ID spoofing and email bombing services.</p></div>
<p>Jim&#8217;s wife quickly logged on to her Citi account and saw that the amounts, dates and places of the transactions referenced by the caller indeed corresponded to recent legitimate transactions. But she didn&#8217;t see any signs of unauthorized charges.</p>
<p>After verifying the recent legitimate transactions with the caller, the person on the phone asked for her security word. When she provided it, there was a long hold before the caller came back and said she&#8217;d provided the wrong answer.</p>
<p>When she corrected herself and provided a different security word, there was another long pause before the caller said the second answer she provided was correct. At that point, the caller said Citi would be sending her a new card and that it had prevented several phony charges from even posting to her account.</p>
<p>She didn&#8217;t understand until later that the pauses were points at which the fraudsters had to put her on hold to relay her answers in their own call posing as her to Citi&#8217;s customer service department.</p>
<p>Not long after Jim&#8217;s spouse hung up with the caller, her inbox quickly began filling up with hundreds of automated messages from various websites trying to confirm an email newsletter subscription she&#8217;d supposedly requested.</p>
<p>As the recipient of <a href="https://krebsonsecurity.com/2012/07/cyberheist-smokescreen-email-phone-sms-floods/" target="_blank" rel="noopener">several of these</a> &#8220;<a href="https://krebsonsecurity.com/2016/08/massive-email-bombs-target-gov-addresses/" target="_blank" rel="noopener">email bombing</a>&#8221; attacks, I can verify that crooks often will use services offered in the cybercrime underground to flood a target&#8217;s inbox with these junk newsletter subscriptions shortly after committing fraud in the target&#8217;s name when they wish to bury an email notification from a target&#8217;s bank.</p>
<h4>&#8216;OVERPAYMENT REIMBURSEMENT&#8217;</h4>
<p>In the case of Jim&#8217;s wife, the inbox flood backfired, and only made her more suspicious about the true nature of the recent phone call. So she called the number on the back of her Citi card and was told that she had indeed just called Citi and requested what&#8217;s known as an &#8220;overpayment reimbursement.&#8221; The couple have long had their credit cards on auto-payment, and the most recent payment was especially high &#8212; nearly $4,000 &#8212; thanks to a flurry of Christmas present purchases for friends and family.</p>
<p>In an overpayment reimbursement, a customer can request that the bank refund any amount paid toward a previous bill that exceeds the minimum required monthly payment. Doing so causes any back-due interest on that unpaid amount to accrue to the account as well.</p>
<p>In this case, the caller posing as Jim&#8217;s wife requested an overpayment reimbursement to the tune of just under $4,000. It&#8217;s not clear how or where the fraudsters intended this payment to be sent, but for whatever reason Citi ended up saying they would cut a physical check and mail it to the address on file. Probably not what the fraudsters wanted, although since then Jim and his wife say they have been on alert for anyone suspicious lurking near their mailbox.</p>
<p>&#8220;The person we spoke with at Citi&#8217;s fraud department kept insisting that yes, it was my wife that called because the call came from her mobile number,&#8221; Jim said. &#8220;The Citi employee was alarmed because she didn&#8217;t understand the whole notion of caller ID spoofing. And we both found it kind of disturbing that someone in fraud at such a major bank didn&#8217;t even understand that such a thing was possible.&#8221;<span id="more-51435"></span></p>
<h4>SHOPPING FOR &#8216;CVVs&#8217;</h4>
<p>Fraud experts say the scammers behind the types of calls that targeted Jim&#8217;s family are most likely fueled by the rampant sale of credit card records <a href="https://krebsonsecurity.com/2019/04/data-e-retail-hacks-more-lucrative-than-ever/" target="_blank" rel="noopener">stolen from hacked online merchants</a>. This data, known as &#8220;CVVs&#8221; in the cybercrime underground, is sold in packages for about $15 per record, and very often includes the customer&#8217;s name, address, phone number, email address and full credit or debit card number, expiration date, and card verification value (CVV) printed on the back of the card.</p>
<div id="attachment_51447" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/b0228377.cvvcardshopsample.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/cvvcardshopsample.png"><img class="wp-image-51447" src="media/b0228377.cvvcardshopsample.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/cvvcardshopsample.png" alt="" width="595" height="222" /></a><p class="wp-caption-text">A screen shot from an underground store selling CVV records. Note that all of these records come with the cardholder&#8217;s address, email, phone number and zip code. Click to enlarge. Image: Gemini Advisory.</p></div>
<p>Dozens of cybercrime shops traffic in this stolen data, which is more traditionally used to defraud online merchants. But such records are ideally suited for criminals engaged in the type of phone scams that are the subject of this article.</p>
<p>That&#8217;s according to <strong>Andrei Barysevich</strong>, CEO and co-founder of <a href="https://geminiadvisory.io/" target="_blank" rel="noopener">Gemini Advisory</a>, a New York-based company that monitors dozens of underground shops selling stolen card data.</p>
<p>&#8220;If the fraudsters already have the target&#8217;s cell phone number, in many cases they already have the target&#8217;s credit card information as well,&#8221; Barysevich said.</p>
<p>Gemini estimates there are currently some 13 million CVV records for sale across the dark web, and that more than 40 percent of these records put up for sale over the past year included the cardholder&#8217;s phone number.</p>
<p>Data from recent financial transactions can not only help fraudsters better impersonate your bank, <em>it can also be useful in <a href="https://krebsonsecurity.com/2019/08/the-risk-of-weak-online-banking-passwords/" target="_blank" rel="noopener">linking a customer&#8217;s account to another account the fraudsters control</a></em>. That&#8217;s because PayPal and a number of other pure-play online financial institutions allow customers to link accounts by verifying the value of microdeposits.</p>
<p>For example, if you wish to be able to transfer funds between PayPal and a bank account, the company will first send a couple of tiny deposits — a few cents, usually — to the account you wish to link. Only after verifying those exact amounts will the account-linking request be granted.</p>
<h4>JUST HANG UP</h4>
<p>Both this and last week&#8217;s story illustrate why the only sane response to a call purporting to be from your bank is to hang up, look up your bank&#8217;s customer service number from their Web site or from the back of your card, and call them back yourself.</p>
<p>Meanwhile, fraudsters who hack peoples&#8217; finances with nothing more than a telephone have been significantly upping the volume of attacks in recent months, <a href="https://nextcaller.com/blog/next-callers-fraud-covid-19-report-week-4-5/" target="_blank" rel="noopener">new research suggests</a>. Fraud prevention company <strong>Next Caller</strong> said this week it has tracked &#8220;massive increases in call volumes and high-risk calls across Fortune 500 companies as a result of COVID-19.&#8221;</p>
<div id="attachment_51463" style="width: 598px" class="wp-caption aligncenter"><a class="lightbox" href="media/86983368.nextcaller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/nextcaller.png"><img class="wp-image-51463 size-full" src="media/86983368.nextcaller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/nextcaller.png" alt="" width="588" height="461" /></a><p class="wp-caption-text">Image: Next Caller.</p></div>
<p>&#8220;After a brief reprieve in Week 4 (April 6-12), Week 5 (April 13-19) saw call volume across Next Caller&#8217;s clients in the telecom and financial services sectors spike 40% above previous highs,&#8221; the company found. &#8220;Particularly worrisome is the activity taking place in the financial services sector, where call traffic topped previous highs by 800%.&#8221;</p>
<p>Next Caller said it&#8217;s likely some of that increase was due to numerous online and mobile app outages for many major financial institutions at a time when more than 80 million Americans were simultaneously trying to track the status of their stimulus deposits. But it said that surge also brought with it an influx of fraudsters looking to capitalize on all the chaos.</p>
<p>&#8220;High-risk calls to financial services surged to 50% above pre-COVID levels, with one Fortune 100 bank suffering a high-risk increase of 60% during Week 5,&#8221; the company wrote in a recent report.</p>


feed_id: https://krebsonsecurity.com/?p=51496
title: How Cybercriminals are Weathering COVID-19
uri: How-Cybercriminals-are-Weathering-COVID-19
url: https://krebsonsecurity.com/2020/04/how-cybercriminals-are-weathering-covid-19/
content:
<p>In many ways, the COVID-19 pandemic has been a boon to cybercriminals: With unprecedented numbers of people working from home and anxious for news about the virus outbreak, it&#8217;s hard to imagine a more target-rich environment for phishers, scammers and malware purveyors. In addition, many crooks are finding the outbreak has helped them better market their cybercriminal wares and services. But it&#8217;s not all good news: The Coronavirus also has driven up costs and disrupted key supply lines for many cybercriminals. Here&#8217;s a look at how they&#8217;re adjusting to these new realities.</p>
<h4>FUELED BY MULES</h4>
<p>One of the more common and perennial cybercriminal schemes is &#8220;reshipping fraud,&#8221; wherein crooks buy pricey consumer goods online using stolen credit card data and then enlist others to help them collect or resell the merchandise.</p>
<p>Most online retailers years ago stopped shipping to regions of the world most frequently associated with credit card fraud, including Eastern Europe, North Africa, and Russia. These restrictions have created a burgeoning underground market for reshipping scams, which rely on willing or unwitting residents in the United States and Europe &#8212; derisively referred to as &#8220;<a href="https://krebsonsecurity.com/?s=reshipping+mules&amp;x=0&amp;y=0" target="_blank" rel="noopener">reshipping mules</a>&#8221; &#8212; to receive and relay high-dollar stolen goods to crooks living in the embargoed areas.</p>
<div id="attachment_51503" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/cd65330b.snowden.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/snowden.png"><img class="wp-image-51503" src="media/cd65330b.snowden.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/snowden.png" alt="" width="595" height="111" /></a><p class="wp-caption-text">A screen shot from a user account at &#8220;Snowden,&#8221; a long-running reshipping mule service.</p></div>
<p>But apparently a number of criminal reshipping services are reporting difficulties due to the increased wait time when calling FedEx or UPS (to divert carded goods that merchants end up shipping to the cardholder&#8217;s address instead of to the mule&#8217;s). In response, these operations are raising their prices and warning of longer shipping times, which in turn could hamper the activities of other actors who depend on those services.</p>
<p>That&#8217;s according to <a href="https://intel471.com" target="_blank" rel="noopener">Intel 471</a>, a cyber intelligence company that closely monitors hundreds of online crime forums. In <a href="https://blog.intel471.com/2020/04/30/covid-19-pandemic-through-the-cybercriminals-eyes/" target="_blank" rel="noopener">a report</a> published today, the company said since late March 2020 it has observed several crooks complaining about COVID-19 interfering with the daily activities of their various <a href="https://krebsonsecurity.com/?s=money+mules&amp;x=0&amp;y=0" target="_blank" rel="noopener">money mules</a> (people hired to help launder the proceeds of cybercrime).</p>
<p>&#8220;One Russian-speaking actor running a fraud network complained about their subordinates (“money mules”) in Italy, Spain and other countries being unable to withdraw funds, since they currently were afraid to leave their homes,&#8221; Intel 471 <a href="https://blog.intel471.com/2020/04/30/covid-19-pandemic-through-the-cybercriminals-eyes/" target="_blank" rel="noopener">observed</a>. &#8220;Also some actors have reported that banks’ customer-support lines are being overloaded, making it difficult for fraudsters to call them for social-engineering activities (such as changing account ownership, raising withdrawal limits, etc).&#8221;</p>
<p>Still, every dark cloud has a silver lining: Intel 471 noted many cybercriminals appear optimistic that the impending global economic recession (and resultant unemployment) &#8220;will make it easier to recruit low-level accomplices such as money mules.&#8221;</p>
<p><strong>Alex Holden</strong>, founder and CTO of <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>, agreed. He said while the Coronavirus has forced reshipping operators to make painful shifts in several parts of their business, the overall market for available mules has never looked brighter.</p>
<p>&#8220;Reshipping is way up right now, but there are some complications,&#8221; he said.</p>
<p>For example, reshipping scams have over the years become easier for both reshipping mule operators and the mules themselves. Many reshipping mules are understandably concerned about receiving stolen goods at their home and risking a visit from the local police. But increasingly, mules have been instructed to retrieve carded items from third-party locations.</p>
<p>&#8220;The mules don&#8217;t have to receive stolen goods directly at home anymore,&#8221; Holden said. &#8220;They can pick them up at Walgreens, Hotel lobbies, etc. There are a ton of reshipment tricks out there.&#8221;</p>
<p>But many of those tricks got broken with the emergence of COVID-19 and social distancing norms. In response, more mule recruiters are asking their hires to do things like reselling goods shipped to their homes on platforms like eBay and Amazon.</p>
<p>&#8220;Reshipping definitely has become more complicated,&#8221; Holden said. &#8220;Not every mule will run 10 times a day to the post office, and some will let the goods sit by the mailbox for days. But on the whole, mules are more compliant these days.&#8221;</p>
<h4>GIVE AND TAKE</h4>
<p>KrebsOnSecurity recently came to a similar conclusion: Last month&#8217;s story, &#8220;<a href="https://krebsonsecurity.com/2020/03/coronavirus-widens-the-money-mule-pool/" target="_blank" rel="noopener">Coronavirus Widens the Money Mule Pool</a>,&#8221; looked at one money mule operation that had ensnared dozens of mules with phony job offers in a very short period of time. Incidentally, the fake charity behind that scheme &#8212; which promised to raise money for Coronavirus victims &#8212; has since closed up shop and apparently re-branded itself as <a href="https://tessaris.com/" target="_blank" rel="noopener">the Tessaris Foundation</a>.</p>
<p>Charitable cybercriminal endeavors were the subject of <a href="https://www.digitalshadows.com/blog-and-research/charitable-endeavors-on-cybercriminal-forums/" target="_blank" rel="noopener">a report released this week</a> by cyber intel firm <strong>Digital Shadows</strong>, which looked at various ways computer crooks are promoting themselves and their hacking services using COVID-19 themed discounts and giveaways.</p>
<p>Like many commercials on television these days, such offers obliquely or directly reference the economic hardships wrought by the virus outbreak as a way of connecting on an emotional level with potential customers.</p>
<p>&#8220;The illusion of philanthropy recedes further when you consider the benefits to the threat actors giving away goods and services,&#8221; the report notes. &#8220;These donors receive a massive boost to their reputation on the forum. In the future, they may be perceived as individuals willing to contribute to forum life, and the giveaways help establish a track record of credibility.&#8221;</p>
<p><a href="https://krebsonsecurity.com/?s=brians+club&amp;x=0&amp;y=0" target="_blank" rel="noopener">Brian&#8217;s Club</a> &#8212; one of the underground&#8217;s largest bazaars for selling stolen credit card data and one that has misappropriated this author&#8217;s likeness and name in its advertising &#8212; recently began offering &#8220;pandemic support&#8221; in the form of discounts for its most loyal customers.</p>
<p><img class="aligncenter wp-image-51500" src="media/f8a77acd.bc-pandemic.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/bc-pandemic.png" alt="" width="596" height="240" /></p>
<p><span id="more-51496"></span>It stands to reason that the virus outbreak might depress cybercriminal demand for &#8220;dumps,&#8221; or stolen account data that can be used to create physical counterfeit credit cards. After all, dumps are mainly used to buy high-priced items from electronics stores and other outlets that may not even be open now thanks to the widespread closures from the pandemic.</p>
<p>If that were the case, we&#8217;d also expect to see dumps prices fall significantly across the cybercrime economy. But so far, those price changes simply haven&#8217;t materialized, says <a href="https://geminiadvisory.io" target="_blank" rel="noopener">Gemini Advisory</a>, a New York based company that monitors the sale of stolen credit card data across dozens of stores in the cybercrime underground.</p>
<div>
<p><strong>Stas Alforov</strong>, Gemini&#8217;s director of research and development, said there&#8217;s been no notable dramatic changes in pricing for both dumps and card data stolen from online merchants (a.k.a. &#8220;CVVs&#8221;) &#8212; even though many cybercrime groups appear to be massively shifting their operations toward targeting online merchants and their customers.</p>
<p><img class="aligncenter size-full wp-image-51501" src="media/57d27049.dumpscvv-prices.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/dumpscvv-prices.png" alt="" width="568" height="345" /></p>
<p>&#8220;Usually, the huge spikes upward or downward during a short period is reflected by a large addition of cheap records that drive the median price change,&#8221; Alforov said, referring to the small and temporary price deviations depicted in the graph above.</p>
<p>Intel 471 said it came to a similar conclusion.</p>
<p>&#8220;You might have thought carding activity, to include support aspects such as checker services, would decrease due to both the global lockdown and threat actors being infected with COVID-19,&#8221; the company said. &#8220;We’ve even seen some actors suggest as much across some shops, but the reality is there have been no observations of major changes.&#8221;</p>
<h4>CONSCIENCE VS. COMMERCE</h4>
<p>Interestingly, the Coronavirus appears to have prompted discussion on a topic that seldom comes up in cybercrime communities &#8212; i.e., the moral and ethical ramifications of their work. Specifically, there seems to be much talk these days about the potential karmic consequences of cashing in on the misery wrought by a global pandemic.</p>
<p>For example, Digital Shadows said some have started to question the morality of targeting healthcare providers, or collecting funds in the name of Coronavirus causes and then pocketing the money.</p>
<p>&#8220;One post on the gated Russian-language cybercriminal forum Korovka laid bare the question of threat actors’ moral obligation,&#8221; the company wrote. &#8220;A user initiated a thread to canvass opinion on the feasibility of faking a charitable cause and collecting donations. They added that while they recognized that such a plan was &#8216;cruel,&#8217; they found themselves in an &#8216;extremely difficult financial situation.&#8217; Responses to the proposal were mixed, with one forum user calling the plan &#8216;amoral,&#8217; and another pointing out that cybercrime is inherently an immoral affair.&#8221;</p>
</div>


feed_id: https://krebsonsecurity.com/?p=51522
title: Europe’s Largest Private Hospital Operator Fresenius Hit by Ransomware
uri: Europe-s-Largest-Private-Hospital-Operator-Fresenius-Hit-by-Ransomwa
url:
https://krebsonsecurity.com/2020/05/europes-largest-private-hospital-operator-fresenius-hit-by-ransomware/

content:
<p><strong>Fresenius</strong>, Europe&#8217;s largest private hospital operator and a major provider of dialysis products and services that are in such high demand thanks to the <strong>COVID-19</strong> pandemic, has been hit in a ransomware cyber attack on its technology systems. The company said the incident has limited some of its operations, but that patient care continues.</p>
<p><img class="aligncenter wp-image-51528" src="media/c6a47910.fresenius.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/fresenius.png" alt="" width="597" height="282" /></p>
<p>Based in Germany, the <a href="https://www.fresenius.com/Group-Overview" target="_blank" rel="noopener noreferrer">Fresenius Group</a> includes four independent businesses: <strong>Fresenius Medical Care</strong>, a leading provider of care to those suffering from kidney failure; <strong>Fresenius Helios</strong>, Europe&#8217;s largest private hospital operator (according to the company&#8217;s Web site); <strong>Fresenius Kabi</strong>, which supplies pharmaceutical drugs and medical devices; and <strong>Fresenius Vamed</strong>, which manages healthcare facilities.</p>
<p>Overall, Fresenius employs nearly 300,000 people across more than 100 countries, and is ranked 258th on the Forbes Global 2000. The company provides products and services for dialysis, hospitals, and inpatient and outpatient care, with nearly <a href="https://en.wikipedia.org/wiki/Fresenius_(company)" target="_blank" rel="noopener noreferrer">40 percent of the market share</a> for dialysis in the United States. This is worrisome because COVID-19 causes many patients to experience kidney failure, which has led to <a href="https://www.cnn.com/2020/04/17/health/coronavirus-kidney-dialysis-need/index.html" target="_blank" rel="noopener noreferrer">a shortage of dialysis machines and supplies</a>.</p>
<p>On Tuesday, a KrebsOnSecurity reader who asked to remain anonymous said a relative working for Fresenius Kabi&#8217;s U.S. operations reported that computers in his company&#8217;s building had been roped off, and that a cyber attack had affected every part of the company&#8217;s operations around the globe.</p>
<p>The reader said the apparent culprit was the <strong>Snake ransomware</strong>, a relatively new strain <a href="https://www.bleepingcomputer.com/news/security/snake-ransomware-is-the-next-threat-targeting-business-networks/" target="_blank" rel="noopener noreferrer">first detailed earlier this year</a> that is being used to shake down large businesses, holding their IT systems and data hostage in exchange for payment in a digital currency such as bitcoin.</p>
<p>Fresenius spokesperson <strong>Matt Kuhn</strong> confirmed the company was struggling with a computer virus outbreak.</p>
<p>&#8220;I can confirm that Fresenius’ IT security detected a computer virus on company computers,&#8221; Kuhn said in a written statement shared with KrebsOnSecurity. &#8220;As a precautionary measure in accordance with our security protocol drawn up for such cases, steps have been taken to prevent further spread. We have also informed the relevant investigating authorities and while some functions within the company are currently limited, patient care continues. Our IT experts are continuing to work on solving the problem as quickly as possible and ensuring that operations run as smoothly as possible.&#8221;<span id="more-51522"></span></p>
<p>The assault on Fresenius comes amid increasingly targeted attacks against healthcare providers on the front lines of responding to the COVID-19 pandemic. In April, the international police organization <strong>INTERPOL</strong> <a href="https://www.interpol.int/en/News-and-Events/News/2020/Cybercriminals-targeting-critical-healthcare-institutions-with-ransomware" target="_blank" rel="noopener noreferrer">warned</a> it &#8220;has detected a significant increase in the number of attempted ransomware attacks against key organizations and infrastructure engaged in the virus response. Cybercriminals are using ransomware to hold hospitals and medical services digitally hostage, preventing them from accessing vital files and systems until a ransom is paid.</p>
<p>On Tuesday, the <strong>Department of Homeland Security</strong>&#8216;s <strong>Cybersecurity and Infrastructure Security Agency</strong> (CISA) issued <a href="https://www.us-cert.gov/ncas/alerts/AA20126A" target="_blank" rel="noopener noreferrer">an alert</a> along with the U.K.&#8217;s <strong>National Cyber Security Centre</strong> warning that so-called &#8220;advanced persistent threat&#8221; groups &#8212; state-sponsored hacking teams &#8212; are actively targeting organizations involved in both national and international COVID-19 responses.</p>
<p>&#8220;APT actors frequently target organizations in order to collect bulk personal information, intellectual property, and intelligence that aligns with national priorities,&#8221; the alert reads. &#8220;The pandemic has likely raised additional interest for APT actors to gather information related to COVID-19. For example, actors may seek to obtain intelligence on national and international healthcare policy, or acquire sensitive data on COVID-19-related research.&#8221;</p>
<p>Once considered by many to be isolated extortion attacks, ransomware infestations have become de facto data breaches for many victim companies. That’s because some of the more active ransomware gangs have taken to downloading reams of data from targets before launching the ransomware inside their systems. Some or all of this data is then <a href="https://krebsonsecurity.com/2019/12/ransomware-gangs-now-outing-victim-businesses-that-dont-pay-up/" target="_blank" rel="noopener noreferrer">published on victim-shaming sites</a> set up by the ransomware gangs as a way to pressure victim companies into paying up.</p>
<p>Security researchers <a href="https://labs.sentinelone.com/new-snake-ransomware-adds-itself-to-the-increasing-collection-of-golang-crimeware/" target="_blank" rel="noopener noreferrer">say</a> the Snake ransomware is somewhat unique in that it seeks to identify IT processes tied to enterprise management tools and large-scale industrial control systems (ICS), such as production and manufacturing networks.</p>
<p>While some ransomware groups targeting businesses have publicly pledged not to single out healthcare providers for the duration of the pandemic, attacks on medical care facilities have continued nonetheless. In late April, <strong>Parkview Medial Center</strong> in Pueblo, Colo. was hit in a ransomware attack that <a href="https://www.techrepublic.com/article/ransomware-attack-on-colorado-hospital-highlights-fears-of-more-healthcare-hostage-situations/" target="_blank" rel="noopener noreferrer">reportedly</a> rendered inoperable the hospital&#8217;s system for storing patient information.</p>
<p>Fresenius declined to answer questions about specifics of the attack, saying it does not provide detailed information or comments on IT security matters. It remains unclear whether the company will pay a ransom demand to recover from the infection. But if it does so, it may not be the first time: According to my reader source, Fresenius paid $1.5 million to resolve a previous ransomware infection.</p>
<p>&#8220;This new attack is on a far greater scale, though,&#8221; the reader said.</p>


feed_id: https://krebsonsecurity.com/?p=51548
title: Tech Support Scam Uses Child Porn Warning
uri: Tech-Support-Scam-Uses-Child-Porn-Warning
url: https://krebsonsecurity.com/2020/05/tech-support-scam-uses-child-porn-warning/
content:
<p>A new email scam is making the rounds, warning recipients that someone using their Internet address has been caught viewing child pornography. The message claims to have been sent from <strong>Microsoft Support</strong>, and says the recipient&#8217;s <strong>Windows</strong> license will be suspended unless they call an &#8220;MS Support&#8221; number to reinstate the license, but the number goes to a phony tech support scam that tries to trick callers into giving fraudsters direct access to their PCs.</p>
<p><img class="aligncenter wp-image-46333" src="media/818bf502.spamwall.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/spamwall.jpg" alt="" width="596" height="559" /></p>
<p>The fraudulent message tries to seem more official by listing what are supposed to be the recipient&#8217;s IP address and <a href="https://en.wikipedia.org/wiki/MAC_address" target="_blank" rel="noopener noreferrer">MAC address</a>. The latter term stands for &#8220;Media Access Control&#8221; and refers to a unique identifier assigned to a computer&#8217;s network interface.</p>
<p>However, this address is not visible to others outside of the user&#8217;s local network, and in any case the MAC address listed in the scam email is not even a full MAC address, which normally includes six groups of two alphanumeric characters separated by a colon. Also, the IP address cited in the email does not appear to have anything to do with the actual Internet address of the recipient.</p>
<p>Not that either of these details will be obvious to many people who receive this spam email, which states:</p>
<blockquote><p>&#8220;We have found instances of child pornography accessed from your IP address &amp; MAC Address.<br />
IP Address: 206.19.86.255<br />
MAC Address : A0:95:6D:C7</p>
<p>This is violation of Information Technology Act of 1996. For now we are Cancelling your Windows License, which means stopping all windows activities &amp; updates on your computer.</p>
<p>If this was not You and would like to Reinstate the Windows License, Please call MS Support Team at 1-844-286-1916 for further help.</p>
<p>Microsoft Support<br />
1 844 286 1916&#8221;</p></blockquote>
<p>KrebsOnSecurity called the toll-free number in the email and was connected after a short hold to a man who claimed to be from MS Support. Immediately, he wanted me to type a specific Web addresses into my browser so he could take remote control over my computer. I was going to play along for a while but for some reason our call was terminated abruptly after several minutes.<span id="more-51548"></span></p>
<p>These kinds of support scams are <a href="https://krebsonsecurity.com/2012/08/tech-support-phone-scams-surge/" target="_blank" rel="noopener noreferrer">a dime a dozen</a>, unfortunately. They prey mainly on elderly and unsophisticated Internet users, walking the frightened caller through a series of steps that allow the fraudsters to take complete, remote control over the system. Once inside the target&#8217;s PC, the scammer invariably finds all kinds of imaginary problems that need fixing, at which point the caller is asked for a credit card number or some form of payment and charged an exorbitant fee for some dubious service or software.</p>
<p>What seems new about this scam is the child porn angle, which I&#8217;m sure will worry quite a few recipients. I say this because over the past few weeks, someone has massively started sending the same type of <a href="https://krebsonsecurity.com/2018/07/sextortion-scam-uses-recipients-hacked-passwords/" target="_blank" rel="noopener noreferrer">sextortion emails that first began in earnest in the summer of 2018</a>, and incredibly over the past few days I&#8217;ve received almost a dozen emails from readers wondering if they should be concerned or if they should pay the extortion demand.</p>
<p>Here&#8217;s a hard and fast rule: Never respond to spam, and certainly not to any email that threatens some negative consequence unless you respond. Doing otherwise only invites more spammy and scammy emails. On the other hand, I fully support the idea of tying up this scammer&#8217;s toll-free number with time-wasting calls.</p>


feed_id: https://krebsonsecurity.com/?p=51545
title: Meant to Combat ID Theft, Unemployment Benefits Letter Prompts ID Theft Worries
uri: Meant-to-Combat-ID-Theft-Unemployment-Benefits-Letter-Prompts-ID-Thef
url:
https://krebsonsecurity.com/2020/05/meant-to-combat-id-theft-unemployment-benefits-letter-prompts-id-theft-worries/

content:
<p>Millions of Americans now filing for unemployment will receive benefits via a prepaid card issued by <strong>U.S. Bank</strong>, a Minnesota-based financial institution that handles unemployment payments for more than a dozen U.S. states. Some of these unemployment applications will trigger an automatic letter from U.S. Bank to the applicant. The letters are intended to prevent identity theft, but many people are mistaking these vague missives for a notification that someone has hijacked their identity.</p>
<p>So far this month, two KrebsOnSecurity readers have forwarded scans of form letters they received via snail mail that mentioned an address change associated with some type of payment card, but which specified neither the entity that issued the card nor any useful information about the card itself.</p>
<p>Searching for snippets of text from the letter online revealed <a href="https://www.scampulse.com/cardholder-services-reviews?__cf_chl_jschl_tk__=18c43cfd27dc7b902976911c7c9effdb6cb3dd5c-1588935966-0-Ad2gnxFhtDi0ssbeHq9AHvjXZ47sbRdX5idSt7UkYaNEAHykGo7NVx-nnuRj4LrrnZm7VB48dxJ8lCqQ4-tVSzSVy1ZM_ofN3x9LfNfEkOGAuDG78EUIURBmuI0ytbP-9SkSY8R6GvLugdZHYohpp6yzstH9tr-JefJz3FqSkNnUdlXwEAVPIN5L98kbv5DsJHhO67BOQyhmTV-MY9uI3V9PrnKe3onzMDnW3O-xGuSRX4WZXQ5WWdctIjUJtcA6TMkttFRH3pzm3uvB0FMCcViSM7C659syDGQlwt4dXhwI1i1faSa77lZ1Tpf4W6jv7w" target="_blank" rel="noopener noreferrer">pages of complaints</a> from consumers who appear confused about the source and reason for the letter, with most dismissing it as either a scam or considering it a notice of attempted identity theft. Here&#8217;s what&#8217;s the letter looks like:</p>
<div id="attachment_51573" style="width: 602px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-51573" class="size-full wp-image-51573" src="media/d192e73f.cardholderservices.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/cardholderservices.png" alt="" width="592" height="633" /><p id="caption-attachment-51573" class="wp-caption-text">A scan of the form letter sent by U.S. Bank to countless people enrolling in state unemployment benefits.</p></div>
<p>My first thought when a reader shared a copy of the letter was that he recently had been the victim of identity theft. It took a fair amount of digging online to discover that the nebulously named &#8220;Cardholder Services&#8221; address in Florida referenced at the top of the letter is an address exclusively used by U.S. Bank.</p>
<p>That digging indicated U.S. Bank currently manages the disbursement of funds for unemployment programs in at least 17 states, including Arkansas, Colorado, Delaware, Idaho, Louisiana, Maine, Minnesota, Nebraska, North Dakota, Ohio, Oregon, Pennsylvania, South Dakota, Texas, Utah, Wisconsin, and Wyoming. The funds are distributed through a prepaid debit card called <a href="https://www.usbank.com/business-banking/business-services/business-prepaid-cards/government-disbursements.html" target="_blank" rel="noopener noreferrer">ReliaCard</a>.</p>
<p>To make matters more confusing, the flood of new unemployment applications from people out of work thanks to the COVID-19 pandemic reportedly <a href="https://www.youtube.com/watch?v=BW8sSnoq0gE" target="_blank" rel="noopener noreferrer">has overwhelmed</a> <a href="https://www.thedenverchannel.com/news/contact7/unemployed-coloradans-having-trouble-accessing-funds-on-reliacard-still-waiting-on-cards-to-arrive" target="_blank" rel="noopener noreferrer">U.S. Bank&#8217;s system</a>, meaning that many people receiving these letters haven&#8217;t yet gotten their ReliaCard and thus lack any frame of reference for having applied for a new payment card.</p>
<p>Reached for comment about the unhelpful letters, U.S. Bank said it automatically mails them to current and former ReliaCard customers when changes in its system are triggered by a customer – including small tweaks to an address &#8212; such as changing &#8220;Street&#8221; to &#8220;St.&#8221;<span id="more-51545"></span></p>
<p>&#8220;This can include letters to people who formerly had a ReliaCard account, but whose accounts are now inactive,&#8221; the company said in a statement shared with KrebsOnSecurity. &#8220;If someone files for unemployment and had a ReliaCard in years past for another claim, we can work with the state to activate that card so the cardholder can use it again.&#8221;</p>
<p>U.S. Bank said the letters are designed to confirm with the cardholder that the address change is valid and to combat identity theft. But clearly, for many recipients they are having the opposite effect.</p>
<p>&#8220;We encourage any cardholders who have questions about the letters to call the number listed on the back of their cards (or 855-282-6161),&#8221; the company said.</p>
<p>That&#8217;s nice to know, because it&#8217;s not obvious from reading the letter which card is being referenced. U.S. Bank said it would take my feedback under advisement, but that the letters were intended to be generic in nature to protect cardholder privacy.</p>
<p>&#8220;We are always seeking to improve our programs, so thank you for bringing this to our attention,&#8221; the company said. &#8220;Our teams are looking at ways to provide more specific information in our communications with cardholders.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=51554
title: Ransomware Hit ATM Giant Diebold Nixdorf
uri: Ransomware-Hit-ATM-Giant-Diebold-Nixdorf
url: https://krebsonsecurity.com/2020/05/ransomware-hit-atm-giant-diebold-nixdorf/
content:
<p><strong>Diebold Nixdorf</strong>, a major provider of automatic teller machines (ATMs) and payment technology to banks and retailers, recently suffered a ransomware attack that disrupted some operations. The company says the hackers never touched its ATMs or customer networks, and that the intrusion only affected its corporate network.</p>
<p><img class="alignright size-full wp-image-51589" src="media/aca31bf0.dn.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/dn.png" alt="" width="266" height="132" />Canton, Ohio-based Diebold [<a href="https://www.marketwatch.com/investing/stock/dbd" target="_blank" rel="noopener noreferrer">NYSE: DBD</a>] is currently the largest ATM provider in the United States, with an estimated 35 percent of the cash machine market worldwide. The 35,000-employee company also produces point-of-sale systems and software used by many retailers.</p>
<p>According to Diebold, on the evening of Saturday, April 25, the company&#8217;s security team discovered anomalous behavior on its corporate network. Suspecting a ransomware attack, Diebold said it immediately began disconnecting systems on that network to contain the spread of the malware.</p>
<p>Sources told KrebsOnSecurity that Diebold&#8217;s response affected services for over 100 of the company&#8217;s customers. Diebold said the company&#8217;s response to the attack did disrupt a system that automates field service technician requests, but that the incident did not affect customer networks or the general public.</p>
<p>&#8220;Diebold has determined that the spread of the malware has been contained,&#8221; Diebold said in a written statement provided to KrebsOnSecurity. &#8220;The incident did not affect ATMs, customer networks, or the general public, and its impact was not material to our business. Unfortunately, cybercrime is an ongoing challenge for all companies. Diebold Nixdorf takes the security of our systems and customer service very seriously. Our leadership has connected personally with customers to make them aware of the situation and how we addressed it.&#8221;<span id="more-51554"></span></p>
<h4>NOT SO PRO LOCK</h4>
<p>An investigation determined that the intruders installed the <strong>ProLock</strong> ransomware, which experts say is a relatively uncommon ransomware strain that has gone through multiple names and iterations over the past few months.</p>
<p>For example, until recently ProLock was better known as &#8220;<a href="https://www.bleepingcomputer.com/news/security/new-pwndlocker-ransomware-targeting-us-cities-enterprises/" target="_blank" rel="noopener noreferrer">PwndLocker</a>,&#8221; which is the name of the ransomware <a href="https://chicago.cbslocal.com/2020/03/04/ransomware-attack-renders-lasalle-county-government-computers-unusable/" target="_blank" rel="noopener noreferrer">that infected servers at Lasalle County, Ill. in March</a>. But the miscreants behind PwndLocker rebranded their malware after security experts at <a href="https://www.emsisoft.com/ransomware-decryption-tools/stop-djvu" target="_blank" rel="noopener noreferrer">Emsisoft</a> released a tool that let PwndLocker victims decrypt their files without paying the ransom.</p>
<p>Diebold claims it did not pay the ransom demanded by the attackers, although the company wouldn&#8217;t discuss the amount requested. But <strong>Lawrence Abrams</strong> of <em>BleepingComputer</em> said the ransom demanded for ProLock victims typically ranges in the six figures, from $175,000 to more than $660,000 depending on the size of the victim network.</p>
<p><strong>Fabian Wosar</strong>, Emsisoft&#8217;s chief technology officer, said if Diebold&#8217;s claims about not paying their assailants are true, it&#8217;s probably for the best: That&#8217;s because current versions of ProLock&#8217;s decryptor tool will corrupt larger files such as database files.</p>
<p>As luck would have it, Emsisoft does <a href="https://www.emsisoft.com/ransomware-decryption-tools/" target="_blank" rel="noopener noreferrer">offer a tool</a> that fixes the decryptor so that it properly recovers files held hostage by ProLock, but it only works for victims who have already paid a ransom to the crooks behind ProLock.</p>
<p>&#8220;We do have a tool that fixes a bug in the decryptor, but it doesn&#8217;t work unless you have the decryption keys from the ransomware authors,&#8221; Wosar said.</p>
<h4>WEEKEND WARRIORS</h4>
<p>BleepingComputer&#8217;s Abrams said the timing of the attack on Diebold &#8212; Saturday evening &#8212; is quite common, and that ransomware purveyors tend to wait until the weekends to launch their attacks because that is typically when most organizations have the fewest number of technical staff on hand. Incidentally, weekends also are the time when <a href="https://krebsonsecurity.com/?s=atm+skimmer+diebold&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">the vast majority of ATM skimming attacks take place</a> &#8212; for the same reason.</p>
<p>&#8220;After hours on Friday and Saturday nights are big, because they want to pull the trigger [on the ransomware] when no one is around,&#8221; Abrams said.</p>
<p>Many ransomware gangs have taken to stealing sensitive data from victims before launching the ransomware, as a sort of virtual cudgel to use against victims who don&#8217;t immediately acquiesce to a ransom demand.</p>
<p>Armed with the victim&#8217;s data &#8212; or data about the victim company&#8217;s partners or customers &#8212; the attackers can then threaten to publish or sell the information if victims refuse to pay up. Indeed, <a href="https://krebsonsecurity.com/2019/12/ransomware-gangs-now-outing-victim-businesses-that-dont-pay-up/" target="_blank" rel="noopener noreferrer">some of the larger ransomware groups are doing just that</a>, constantly updating blogs on the Internet and the dark Web that publish the names and data stolen from victims who decline to pay.</p>
<p>So far, the crooks behind ProLock haven&#8217;t launched their own blog. But Abrams said the crime group behind it has indicated it is at least heading in that direction, noting that in his communications with the group in the wake of the Lasalle County attack they sent him an image and a list of folders suggesting they&#8217;d accessed sensitive data for that victim.</p>
<p>&#8220;I&#8217;ve been saying this ever since last year when the Maze ransomware group started publishing the names and data from their victims: Every ransomware attack has to be treated as a data breach now,&#8221; Abrams said.</p>


feed_id: https://krebsonsecurity.com/?p=51606
title: Microsoft Patch Tuesday, May 2020 Edition
uri: Microsoft-Patch-Tuesday-May-2020-Edition
url: https://krebsonsecurity.com/2020/05/microsoft-patch-tuesday-may-2020-edition/
content:
<p><strong>Microsoft </strong>today issued software updates to plug at least 111 security holes in <strong>Windows</strong> and Windows-based programs. None of the vulnerabilities were labeled as being publicly exploited or detailed prior to today, but as always if you&#8217;re running Windows on any of your machines it&#8217;s time once again to prepare to get your patches on.</p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />May marks the third month in a row that Microsoft has pushed out fixes for more than 110 security flaws in its operating system and related software. At least 16 of the bugs are labeled &#8220;Critical,&#8221; meaning ne&#8217;er-do-wells can exploit them to install malware or seize remote control over vulnerable systems with little or no help from users.</p>
<p>But focusing solely on Microsoft&#8217;s severity ratings may obscure the seriousness of the flaws being addressed this month. <strong>Todd Schell</strong>, senior product manager at security vendor <a href="https://www.ivanti.com/" target="_blank" rel="noopener noreferrer">Ivanti</a>, notes that if one looks at the &#8220;exploitability assessment&#8221; tied to each patch &#8212; i.e., how likely Microsoft considers each can and will be exploited for nefarious purposes &#8212; it makes sense to pay just as much attention to the vulnerabilities Microsoft has labeled with the lesser severity rating of &#8220;Important.&#8221;</p>
<p>Virtually all of the non-critical flaws in this month&#8217;s batch earned Microsoft&#8217;s &#8220;Important&#8221; rating.</p>
<p>&#8220;What is interesting and often overlooked is seven of the ten [fixes] at higher risk of exploit are only rated as Important,&#8221; Schell said. &#8220;It is not uncommon to look to the critical vulnerabilities as the most concerning, but many of the vulnerabilities that end up being exploited are rated as Important vs Critical.&#8221;</p>
<p>For example, <strong>Satnam Narang</strong> from <a href="https://www.tenable.com/" target="_blank" rel="noopener noreferrer">Tenable</a> notes that two remote code execution flaws in Microsoft Color Management (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1117" target="_blank" rel="noopener noreferrer">CVE-2020-1117</a>) and Windows Media Foundation (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1126" target="_blank" rel="noopener noreferrer">CVE-2020-1126</a>) could be exploited by tricking a user into opening a malicious email attachment or visiting a website that contains code designed to exploit the vulnerabilities. However, Microsoft rates these vulnerabilities as “Exploitation Less Likely,” according to their Exploitability Index.</p>
<p>In contrast, three elevation of privilege vulnerabilities that received a rating of “Exploitation More Likely” were also patched, Narang notes. These include a pair of &#8220;Important&#8221; flaws in Win32k (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1054" target="_blank" rel="noopener noreferrer">CVE-2020-1054</a>, <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1143" target="_blank" rel="noopener noreferrer">CVE-2020-1143</a>) and one in the Windows Graphics Component (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1135" target="_blank" rel="noopener noreferrer">CVE-2020-1135</a>). Elevation of Privilege vulnerabilities are used by attackers once they’ve managed to gain access to a system in order to execute code on their target systems with elevated privileges. There are at least 56 of these types of fixes in the May release.</p>
<p>Schell says if your organization&#8217;s plan for prioritizing the deployment of this month&#8217;s patches stops at vendor severity or even <a href="https://www.first.org/cvss/specification-document" target="_blank" rel="noopener noreferrer">CVSS scores</a> above a certain level you may want to reassess your metrics.</p>
<p>&#8220;Look to other risk metrics like Publicly Disclosed, Exploited (obviously), and Exploitability Assessment (Microsoft specific) to expand your prioritization process,&#8221; he advised.</p>
<p><span id="more-51606"></span></p>
<p>As it usually does each month on Patch Tuesday, <strong>Adobe</strong> also has issued updates for some of its products. <a href="https://helpx.adobe.com/security/products/acrobat/apsb20-24.html" target="_blank" rel="noopener noreferrer">An update for Adobe Acrobat and Reader</a> covers two dozen critical and important vulnerabilities. There are no security fixes for Adobe&#8217;s <strong>Flash Player</strong> in this month&#8217;s release.</p>
<p>Just a friendly reminder that while many of the vulnerabilities fixed in today’s Microsoft patch batch affect <strong>Windows 7</strong> operating systems — including all three of the zero-day flaws — this OS is no longer being supported with security updates (unless you’re an enterprise taking advantage of Microsoft’s paid extended security updates program, which is available to Windows 7 Professional and Windows 7 enterprise users).</p>
<p>If you rely on Windows 7 for day-to-day use, it’s time to think about upgrading to something newer. That something might be a PC with<strong> Windows 10</strong>. Or maybe you have always wanted that shiny <strong>MacOS</strong> computer.</p>
<p>If cost is a primary motivator and the user you have in mind doesn’t do much with the system other than browsing the Web, perhaps a <strong>Chromebook</strong> or an older machine with a recent version of <strong>Linux</strong> is the answer (<strong>Ubuntu</strong> may be easiest for non-Linux natives). Whichever system you choose, it’s important to pick one that fits the owner’s needs and provides security updates on an ongoing basis.</p>
<p>Keep in mind that while staying up-to-date on Windows patches is a must, it’s important to make sure you’re updating only after you’ve backed up your important data and files. A reliable backup means you’re not losing your mind when the odd buggy patch causes problems booting the system.</p>
<p>So backup your files <em>before</em> installing any patches. Windows 10 even has some built-in tools to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, see <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">this guide</a>.</p>
<p>As always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips. Also, keep an eye on <a href="https://www.askwoody.com/" target="_blank" rel="noopener noreferrer">the AskWoody blog from Woody Leonhard</a>, who keeps a reliable lookout for buggy Microsoft updates each month.</p>
<p>Further reading:</p>
<p><a href="https://isc.sans.edu/forums/diary/Microsoft+May+2020+Patch+Tuesday/26114/" target="_blank" rel="noopener noreferrer">SANS Internet Storm Center breakdown by vulnerability and severity</a></p>
<p><a href="https://www.catalog.update.microsoft.com/Search.aspx?q=2020-05" target="_blank" rel="noopener noreferrer">Microsoft&#8217;s Security Update catalog</a></p>
<p><a href="https://www.bleepingcomputer.com/news/microsoft/may-2020-patch-tuesday-microsoft-fixes-111-vulnerabilities-13-critical/" target="_blank" rel="noopener noreferrer">BleepingComputer on May 2020 Patch Tuesday</a></p>


feed_id: https://krebsonsecurity.com/?p=51629
title: U.S. Secret Service: “Massive Fraud” Against State Unemployment Insurance Programs
uri: U-S-Secret-Service-Massive-Fraud-Against-State-Unemployment-In
url:
https://krebsonsecurity.com/2020/05/u-s-secret-service-massive-fraud-against-state-unemployment-insurance-programs/

content:
<p>A well-organized Nigerian crime ring is exploiting the COVID-19 crisis by committing large-scale fraud against multiple state unemployment insurance programs, with potential losses in the hundreds of millions of dollars, according to a new alert issued by the <strong>U.S. Secret Service</strong>.</p>
<p><img class="aligncenter  wp-image-51644" src="media/9a4a6a9f.100mask.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/100mask.jpg" alt="" width="594" height="361" /></p>
<p>A memo seen by KrebsOnSecurity that the Secret Service circulated to field offices around the United States on Thursday says the ring has been filing unemployment claims in different states using Social Security numbers and other personally identifiable information (PII) belonging to identity theft victims, and that &#8220;<em>a substantial amount of the fraudulent benefits submitted have used PII from first responders, government personnel and school employees</em>.&#8221;</p>
<p>&#8220;It is assumed the fraud ring behind this possesses a substantial PII database to submit the volume of applications observed thus far,&#8221; the Secret Service warned. &#8220;The primary state targeted so far is Washington, although there is also evidence of attacks in North Carolina, Massachusetts, Rhode Island, Oklahoma, Wyoming and Florida.&#8221;</p>
<p>The Secret Service said the fraud network is believed to consist of hundred of &#8220;mules,&#8221; a term used to describe willing or unwitting individuals who are recruited to help launder the proceeds of fraudulent financial transactions.</p>
<p>&#8220;In the state of Washington, individuals residing out-of-state are receiving multiple ACH deposits from the State of Washington Unemployment Benefits Program, all in different individuals&#8217; names with no connection to the account holder,&#8221; the notice continues.</p>
<p>The Service&#8217;s memo suggests the crime ring is operating in much the same way as crooks who specialize in <a href="https://krebsonsecurity.com/?s=tax+refund+fraud&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">filing fraudulent income tax refund requests</a> with the states and the U.S. Internal Revenue Service (IRS), a perennial problem that costs the states and the U.S. Treasury hundreds of millions of dollars in revenue each year.</p>
<p>In those schemes, the scammers typically recruit people &#8212; often victims of <a href="https://krebsonsecurity.com/?s=romance+scams&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">online romance scams</a> or those who also are out of work and looking for any source of income &#8212; to receive direct deposits from the fraudulent transactions, and then forward the bulk of the illicit funds to the perpetrators.</p>
<p>A federal fraud investigator who spoke with KrebsOnSecurity on condition of anonymity said many states simply don&#8217;t have enough controls in place to detect patterns that might help better screen out fraudulent unemployment applications, such as looking for multiple applications involving the same Internet addresses and/or bank accounts. The investigator said in some states fraudsters need only to submit someone&#8217;s name, Social Security number and other basic information for their claims to be processed.<span id="more-51629"></span></p>
<p>The alert follows news reports by media outlets in Washington and Rhode Island about millions of dollars in fraudulent unemployment claims in those states. On Thursday, <em>The Seattle Times</em> <a href="https://www.seattletimes.com/business/economy/washington-halts-unemployment-payments-for-two-days-after-finding-1-6-million-in-fraudulent-claims-amid-coronavirus-pandemic/" target="_blank" rel="noopener noreferrer">reported</a> that the activity had halted unemployment payments for two days after officials found more than $1.6 million in phony claims.</p>
<p>&#8220;Between March and April, the number of fraudulent claims for unemployment benefits jumped 27-fold to 700,&#8221; the state Employment Security Department (ESD) told The Seattle Times. The story noted that the ESD&#8217;s fraud hotline has been inundated with calls, and received so many emails last weekend that it temporarily shut down.</p>
<p><em>WPRI</em> in Rhode Island <a href="https://www.wpri.com/news/politics-government/fbi-probing-hundreds-of-ri-unemployment-fraud-claims/" target="_blank" rel="noopener noreferrer">reported</a> on May 4 that the state&#8217;s Department of Labor and Training has received hundreds of complaints of unemployment insurance fraud, and that &#8220;the number of purportedly fraudulent accounts is keeping pace with the unprecedented number of legitimate claims for unemployment insurance.&#8221;</p>
<p>The surge in fraud comes as many states are struggling to process an avalanche of jobless claims filed as a result of the Coronavirus pandemic. The U.S. government reported Thursday that nearly three million people filed unemployment claims last week, bringing the total over the last two months to more than 36 million. The Treasury Department <a href="media/19a792e0.20043000.pdf" data-original-source="https://fsapps.fiscal.treasury.gov/dts/files/20043000.pdf" target="_blank" rel="noopener noreferrer">says</a> unemployment programs delivered $48 billion in payments in April alone.</p>
<p>A few of the states listed as key targets of this fraud ring are experiencing some of the highest levels of unemployment claims in the country. Washington has seen nearly a million unemployment claims, with almost 30 percent of its workforce currently jobless, according to <a href="https://www.uschamber.com/series/above-the-fold/analysis-these-10-states-have-seen-the-highest-share-of-their-workforce-file" target="_blank" rel="noopener noreferrer">figures released</a> by the <strong>U.S. Chamber of Commerce</strong>. Rhode Island is even worse off, with 31.4 percent of its workforce filing for unemployment, the Chamber found.</p>
<p>&#8220;The banks targeted have been at all levels including local banks, credit unions, and large national banks,&#8221; the Secret Service alert concluded. &#8220;It is extremely likely every state is vulnerable to this scheme and will be targeted if they have not been already.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=51656
title: This Service Helps Malware Authors Fix Flaws in their Code
uri: This-Service-Helps-Malware-Authors-Fix-Flaws-in-their-Code
url: https://krebsonsecurity.com/2020/05/this-service-helps-malware-authors-fix-flaws-in-their-code/
content:
<p>Almost daily now there is news about flaws in commercial software that lead to computers getting hacked and seeded with malware. But the reality is most malicious software also has its share of security holes that open the door for security researchers or ne&#8217;er-do-wells to liberate or else seize control over already-hacked systems. Here&#8217;s a look at one long-lived malware vulnerability testing service that is used and run by some of the Dark Web&#8217;s top cybercriminals.</p>
<p><img class="aligncenter wp-image-51669" src="media/3c7e6f05.codereview.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/codereview.jpg" alt="" width="597" height="394" /></p>
<p>It is not uncommon for crooks who sell malware-as-a-service offerings such as trojan horse programs and botnet control panels to include backdoors in their products that let them surreptitiously monitor the operations of their customers and siphon data stolen from victims. More commonly, however, the people writing malware simply make coding mistakes that render their creations vulnerable to compromise.</p>
<p>At the same time, security companies are constantly scouring malware code for vulnerabilities that might allow them peer to inside the operations of crime networks, or to wrest control over those operations from the bad guys. There aren&#8217;t a lot of public examples of this anti-malware activity, in part because it wades into legally murky waters. More importantly, talking publicly about these flaws tends to be <a href="https://www.flashpoint-intel.com/blog/malware-exploit-disclosures-come-with-a-cost/?utm_source=hootsuite&amp;utm_medium=twitter" target="_blank" rel="noopener noreferrer">the fastest way to get malware authors to fix any vulnerabilities</a> in their code.</p>
<p>Enter malware testing services like the one operated by &#8220;<a href="https://twitter.com/krobchik" rel="noopener noreferrer" target="_blank">RedBear</a>,&#8221; the administrator of a Russian-language security site called <strong>Krober[.]biz</strong>, which frequently blogs about security weaknesses in popular malware tools.</p>
<p>For the most part, the vulnerabilities detailed by Krober aren&#8217;t written about until they are patched by the malware&#8217;s author, who&#8217;s paid a small fee in advance for a code review that promises to unmask any backdoors and/or harden the security of the customer&#8217;s product.</p>
<div id="attachment_51702" style="width: 545px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-51702" src="media/78dca9d9.redbear.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/redbear.png" alt="" width="535" height="463" class="size-full wp-image-51702" /><p id="caption-attachment-51702" class="wp-caption-text">RedBear&#8217;s profile on the Russian-language xss[.]is cybercrime forum.</p></div>
<p>RedBear&#8217;s service is marketed not only to malware creators, but to people who rent or buy malicious software and services from other cybercriminals. A chief selling point of this service is that, crooks being crooks, you simply can&#8217;t trust them to be completely honest.</p>
<p>&#8220;We can examine your (or not exactly your) PHP code for vulnerabilities and backdoors,&#8221; reads his offering on several prominent Russian cybercrime forums. &#8220;Possible options include, for example, bot admin panels, code injection panels, shell control panels, payment card sniffers, traffic direction services, exchange services, spamming software, doorway generators, and scam pages, etc.&#8221;</p>
<p>As proof of his service&#8217;s effectiveness, RedBear points to almost a dozen articles on Krober[.]biz which explain in intricate detail flaws found in high-profile malware tools whose authors have used his service in the past, including; the <a href="https://www.vice.com/en_us/article/wnx5yz/the-malware-that-led-to-the-ukrainian-blackout" target="_blank" rel="noopener noreferrer">Black Energy DDoS bot</a> administration panel; malware loading panels tied to the <a href="https://unit42.paloaltonetworks.com/analysis-of-smoke-loader-in-new-tsunami-campaign/" target="_blank" rel="noopener noreferrer">Smoke</a> and <a href="https://www.virusbulletin.com/virusbulletin/2018/02/review-evolution-andromeda-over-years-we-say-goodbye/" target="_blank" rel="noopener noreferrer">Andromeda</a> bot loaders; the <a href="https://cofense.com/double-duty-dridex-banking-malware-delivered-rms-rat/" target="_blank" rel="noopener noreferrer">RMS</a> and <strong>Spyadmin</strong> trojans; and a popular loan scan script.</p>
<p><H4>ESTRANGED BEDFELLOWS</H4></p>
<p>RedBear doesn&#8217;t operate this service on his own. Over the years he&#8217;s had several partners in the project, including two very high-profile cybercriminals (or possibly just one, as we&#8217;ll see in a moment) who until recently operated under the hacker aliases &#8220;<strong>upO</strong>&#8221; and &#8220;<strong>Lebron</strong>.&#8221;</p>
<p>From 2013 to 2016, upO was a major player on Exploit[.]in &#8212; one of the most active and venerated Russian-language cybercrime forums in the underground &#8212;  authoring almost 1,500 posts on the forum and starting roughly 80 threads, mostly focusing on malware. For roughly one year beginning in 2016, Lebron was a top moderator on Exploit.</p>
<div id="attachment_51666" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/86865724.krober-lebron.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/krober-lebron.png"><img aria-describedby="caption-attachment-51666" class="wp-image-51666" src="media/86865724.krober-lebron.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/krober-lebron.png" alt="" width="597" height="504" /></a><p id="caption-attachment-51666" class="wp-caption-text">One of many articles Lebron published on Krober[.]biz that detailed flaws found in malware submitted to RedBear&#8217;s vulnerability testing service.</p></div>
<p>In 2016, several members began accusing upO of stealing source code from malware projects under review, and then allegedly using or incorporating bits of the code into malware projects he marketed to others.</p>
<p>up0 would eventually be banned from Exploit for getting into an argument with another top forum contributor, wherein both accused the other of working for or with Russian and/or Ukrainian federal authorities, and proceeded to publish personal information about the other that allegedly outed their real-life identities.</p>
<div id="attachment_51667" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/8c95c6c4.up0-redbear.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/up0-redbear.png"><img aria-describedby="caption-attachment-51667" class="wp-image-51667" src="media/8c95c6c4.up0-redbear.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/up0-redbear.png" alt="" width="599" height="263" /></a><p id="caption-attachment-51667" class="wp-caption-text">The cybercrime actor &#8220;upO&#8221; on Exploit[.]in in late 2016, complaining that RedBear was refusing to pay a debt owed to him.</p></div>
<p>Lebron first appeared on Exploit in September 2016, roughly two months before upO was banished from the community. After serving almost a year on the forum while authoring hundreds of posts and threads (including many articles first published on Krober), Lebron abruptly disappeared from Exploit.</p>
<p>His departure was prefaced by a series of increasingly brazen accusations by forum members that Lebron was simply upO using a different nickname. His final post on Exploit in May 2017 somewhat jokingly indicated he was joining an upstart ransomware affiliate program.<span id="more-51656"></span></p>
<p><H4>RANSOMWARE DREAMS</H4></p>
<p>According to research from cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener noreferrer">Intel 471</a>, upO had a strong interest in ransomware and had partnered with the developer of the <a href="https://blog.malwarebytes.com/detections/ransom-cerber/" target="_blank" rel="noopener noreferrer">Cerber ransomware strain</a>, an affiliate program operating between Feb. 2016 and July 2017 that sought to corner the increasingly lucrative and competitive market for ransomware-as-a-service offerings.</p>
<p>Intel 471 says a rumor has been circulating on Exploit and other forums upO frequented that he was the mastermind behind <a href="https://www.kaspersky.com/blog/gandcrab-ransomware-is-back/25854/" target="_blank" rel="noopener noreferrer">GandCrab</a>, another ransomware-as-a-service affiliate program that first surfaced in January 2018 and later bragged about extorting billions of dollars from hacked businesses when it closed up shop in June 2019.</p>
<p>Multiple security companies and researchers (<a href="https://krebsonsecurity.com/2019/07/is-revil-the-new-gandcrab-ransomware/" target="_blank" rel="noopener noreferrer">including this author</a>) have concluded that GandCrab didn&#8217;t exactly go away, but instead re-branded to form a more exclusive ransomware-as-a-service offering dubbed &#8220;<a href="https://blog.intel471.com/2020/03/31/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/" target="_blank" rel="noopener noreferrer">REvil</a>&#8221; (a.k.a. &#8220;Sodin&#8221; and &#8220;Sodinokibi&#8221;). REvil was first spotted in April 2019 after being installed by a GandCrab update, but its affiliate program didn&#8217;t kick into high gear until July 2019.</p>
<p>Last month, the public face of the REvil ransomware affiliate program &#8212; a cybercriminal who registered on Exploit in July 2019 using the nickname &#8220;<strong>UNKN</strong>&#8221; (a.k.a. &#8220;Unknown&#8221;) &#8212; found himself the target of a blackmail scheme publicly announced by a fellow forum member who claimed to have helped bankroll UNKN&#8217;s ransomware business back in 2016 but who&#8217;d taken a break from the forum on account of problems with the law.</p>
<p>That individual, using the nickname &#8220;<strong>Vivalamuerte</strong>,&#8221; said UNKN still owed him his up-front investment money, which he reckoned amounted to roughly $190,000. Vivalamuerte said he would release personal details revealing UNKN&#8217;s real-life identity unless he was paid what he claims he is owed. </p>
<div id="attachment_51665" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/18723751.vivalamuerte.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/vivalamuerte.png"><img aria-describedby="caption-attachment-51665" class="wp-image-51665" src="media/18723751.vivalamuerte.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/vivalamuerte.png" alt="" width="597" height="202" /></a><p id="caption-attachment-51665" class="wp-caption-text">In this Google-translated blackmail post by Vivalamuerte to UNKN, the latter&#8217;s former nickname was abbreviated to &#8220;L&#8221;.</p></div>
<p>Vivalamuerte also claimed UNKN has used four different nicknames, and that the moniker he interacted with back in 2016 began with the letter &#8220;L.&#8221; The accused&#8217;s full nickname was likely redacted by forum administrators because <a href="media/403c7b9e.xss-lebron-search.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/xss-lebron-search.png" rel="noopener noreferrer" target="_blank">a search on the forum for &#8220;Lebron&#8221; brings up the same post</a> even though it is not visible in any of Vivalamuerte&#8217;s threatening messages.</p>
<p>Reached by KrebsOnSecurity, Vivalamuerte declined to share what he knew about UNKN, saying the matter was still in arbitration. But he said he has proof that Lebron was the principle coder behind the GandCrab ransomware, and that the person behind the Lebron identity plays a central role in the REvil ransomware extortion enterprise as it exists today.</p>


feed_id: https://krebsonsecurity.com/?p=51727
title: Ukraine Nabs Suspect in 773M Password ‘Megabreach’
uri: Ukraine-Nabs-Suspect-in-773M-Password-Megabreach
url: https://krebsonsecurity.com/2020/05/ukraine-nabs-suspect-in-773m-password-megabreach/
content:
<p>In January 2019, dozens of media outlets raised the alarm about a new &#8220;megabreach&#8221; involving the release of some 773 million stolen usernames and passwords that was breathlessly labeled &#8220;the largest collection of stolen data in history.&#8221; A subsequent review by KrebsOnSecurity quickly determined the data was years old and merely a compilation of credentials pilfered from mostly public data breaches. Earlier today, authorities in Ukraine said they&#8217;d apprehended a suspect in the case.</p>
<p>The <strong>Security Service of Ukraine</strong> (SBU) on Tuesday announced the detention of a hacker known as <strong>Sanix</strong> (a.k.a. &#8220;<strong>Sanixer</strong>&#8220;) from the Ivano-Frankivsk region of the country. The SBU said they found on Sanix&#8217;s computer records showing he sold databases with &#8220;logins and passwords to e-mail boxes, PIN codes for bank cards, e-wallets of cryptocurrencies, PayPal accounts, and information about computers hacked for further use in botnets and for organizing distributed denial-of-service (DDoS) attacks.&#8221;</p>
<div id="attachment_51735" style="width: 607px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-51735" class=" wp-image-51735" src="media/2cc887c3.sbu-sanix.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/sbu-sanix.png" alt="" width="597" height="398" /><p id="caption-attachment-51735" class="wp-caption-text">Items SBU authorities seized after raiding Sanix&#8217;s residence. Image: SBU.</p></div>
<p>Sanix became famous last year for posting to hacker forums that he was selling the 87GB password dump, labeled “<strong>Collection #1.</strong>” Shortly after his sale was first detailed by <strong>Troy Hunt</strong>, who operates the <a href="https://haveibeenpwned.com/" target="_blank" rel="noopener noreferrer">HaveIBeenPwned</a> breach notification service, KrebsOnSecurity contacted Sanix to find out what all the fuss was about. From <a href="https://krebsonsecurity.com/2019/01/773m-password-megabreach-is-years-old/" target="_blank" rel="noopener noreferrer">that story</a>:</p>
<p>&#8220;Sanixer said Collection#1 consists of data pulled from a huge number of hacked sites, and was not exactly his &#8216;freshest&#8217; offering. Rather, he sort of steered me away from that archive, suggesting that — unlike most of his other wares — Collection #1 was at least 2-3 years old. His other password packages, which he said are not all pictured in the above screen shot and total more than 4 terabytes in size, are less than a year old, Sanixer explained.&#8221;</p>
<p><strong>Alex Holden</strong>, chief technology officer and founder of Milwaukee-based <a href="https://www.holdsecurity.com" target="_blank" rel="noopener noreferrer">Hold Security</a>, said Sanixer&#8217;s claim to infamy was simply for disclosing the Collection #1 data, which was just one of many credential dumps <a href="https://www.recordedfuture.com/collection-1-data-breach/" target="_blank" rel="noopener noreferrer">amalgamated by other cyber criminals</a>.</p>
<p>&#8220;Today, it is even a more common occurrence to see mixing new and old breached credentials,&#8221; Holden said. &#8220;In fact, large aggregations of stolen credentials have been around since 2013-2014. Even the original attempt to sell the <a href="https://krebsonsecurity.com/2016/12/yahoo-one-billion-more-accounts-hacked/" target="_blank" rel="noopener noreferrer">Yahoo breach data</a> was a large mix of several previous unrelated breaches. Collection #1 was one of many credentials collections output by various cyber criminals gangs.&#8221;<span id="more-51727"></span></p>
<p>Sanix was far from a criminal mastermind, and left a long trail of clues that made it almost child&#8217;s play to trace his hacker aliases to <a href="https://vk.com/id275375997" target="_blank" rel="noopener noreferrer">the real-life identity</a> of a young man in Burshtyn, a city located in Ivano-Frankivsk Oblast in western Ukraine.</p>
<p>Still, perhaps Ukraine&#8217;s SBU detained Sanix for other reasons in addition to his peddling of Collection 1. According to cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener noreferrer">Intel 471</a>, Sanix has stayed fairly busy selling credentials that would allow customers to remotely access hacked resources at several large organizations. For example, as recently as earlier this month, Intel 471 spotted Sanix selling access to nearly four dozen universities worldwide, and to a compromised VPN account for the government of San Bernadino, Calif.</p>
<p>KrebsOnSecurity is covering Sanix&#8217;s detention mainly to close the loop on an incident that received an incredible amount of international attention. But it&#8217;s also another excuse to remind readers about the importance of good password hygiene. A core reason so many accounts get compromised is that far too many people have the nasty habit(s) of choosing poor passwords, re-using passwords and email addresses across multiple sites, and not taking advantage of multi-factor authentication options when available.</p>
<p>By far the most important passwords are those protecting our email inbox(es). That’s because in nearly all cases, the person who is in control of that email address can reset the password of any services or accounts tied to that email address – merely by requesting a password reset link via email. For more on this dynamic, please see <a href="https://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank" rel="noopener noreferrer">The Value of a Hacked Email Account</a>.</p>
<div id="attachment_21036" style="width: 608px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-21036" class=" wp-image-21036" src="media/d1ab042b.HE-1.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/06/HE-1.jpg" alt="" width="598" height="333" srcset="https://krebsonsecurity.com/wp-content/uploads/2013/06/HE-1.jpg 742w, https://krebsonsecurity.com/wp-content/uploads/2013/06/HE-1-285x158.jpg 285w, https://krebsonsecurity.com/wp-content/uploads/2013/06/HE-1-600x333.jpg 600w" sizes="(max-width: 598px) 100vw, 598px" /><p id="caption-attachment-21036" class="wp-caption-text">Your email account may be worth far more than you imagine.</p></div>
<p>And instead of thinking about passwords, consider using unique, lengthy passphrases — collections of words in an order you can remember — when a site allows it. In general, a long, unique passphrase takes far more effort to crack than a short, complex one. Unfortunately, many sites do not let users choose passwords or passphrases that exceed a small number of characters, or they will otherwise allow long passphrases but ignore anything entered after the character limit is reached.</p>
<p>If you are the type of person who likes to re-use passwords, then you definitely need to be using a password manager, which helps you pick and remember strong and unique passwords/passphrases and essentially lets you use the same strong master password/passphrase across all Web sites.</p>
<p>Finally, if you haven’t done so lately, mosey on over to <a href="https://www.twofactorauth.org" target="_blank" rel="noopener noreferrer">twofactorauth.org</a> and see if you are taking full advantage of the strongest available multi-factor authentication option at sites you trust with your data. The beauty of multi-factor is that even if thieves manage to guess or steal your password just because they hacked some Web site, that password will be useless to them unless they can also compromise that second factor — be it your mobile device, phone number, or security key. Not saying these additional security methods aren&#8217;t also vulnerable to compromise (they absolutely are), but they&#8217;re definitely better than just using a password.</p>


feed_id: https://krebsonsecurity.com/?p=51743
title: Riding the State Unemployment Fraud ‘Wave’
uri: Riding-the-State-Unemployment-Fraud-Wave
url: https://krebsonsecurity.com/2020/05/riding-the-state-unemployment-fraud-wave/
content:
<p>When a reliable method of scamming money out of people, companies or governments becomes widely known, underground forums and chat networks tend to light up with activity as more fraudsters pile on to claim their share. And that&#8217;s exactly what appears to be going on right now as multiple U.S. states struggle to combat a tsunami of phony <strong>Pandemic Unemployment Assistance</strong> (PUA) claims. Meanwhile, a number of U.S. states are possibly making it easier for crooks by leaking their citizens&#8217; personal data from the very websites the unemployment scammers are using to file bogus claims.</p>
<p>Last week, the <strong>U.S. Secret Service</strong> <a href="https://krebsonsecurity.com/2020/05/u-s-secret-service-massive-fraud-against-state-unemployment-insurance-programs/" target="_blank" rel="noopener noreferrer">warned of &#8220;massive fraud&#8221; against state unemployment insurance programs</a>, noting that false filings from a well-organized Nigerian crime ring could end up costing the states and federal government hundreds of millions of dollars in losses.</p>
<p>Since then, various online crime forums and Telegram chat channels focused on financial fraud have been littered with posts from people selling tutorials on how to siphon unemployment insurance funds from different states.</p>
<div id="attachment_51750" style="width: 606px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-51750" class=" wp-image-51750" src="media/aac38e25.aiocrime.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/aiocrime.png" alt="" width="596" height="534" /><p id="caption-attachment-51750" class="wp-caption-text">Denizens of a Telegram chat channel newly rededicated to stealing state unemployment funds discussing cashout methods.</p></div>
<p>Yes, for roughly $50 worth of bitcoin, you too can quickly jump on the unemployment fraud &#8220;wave&#8221; and learn how to swindle unemployment insurance money from different states. The channel pictured above and others just like it are selling different &#8220;methods&#8221; for defrauding the states, complete with instructions on how best to avoid getting your phony request flagged as suspicious.</p>
<p>Although, at the rate people in these channels are &#8220;flexing&#8221; &#8212; bragging about their fraudulent earnings with screenshots of recent multiple unemployment insurance payment deposits being made daily &#8212; it appears some states aren&#8217;t doing a whole lot of fraud-flagging.</p>
<div id="attachment_51751" style="width: 454px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-51751" class=" wp-image-51751" src="media/ea8210ad.maycares2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/maycares2.png" alt="" width="444" height="773" /><p id="caption-attachment-51751" class="wp-caption-text">A still shot from a video a fraudster posted to a Telegram channel overrun with people engaged in unemployment insurance fraud shows multiple $800+ payments in one day from Massachusetts&#8217; Department of Unemployment Assistance (DUA).</p></div>
<p>A federal fraud investigator who&#8217;s helping to trace the source of these crimes and who spoke with KrebsOnSecurity on condition of anonymity said many states have few controls in place to spot patterns in fraudulent filings, such as multiple payments going to the same bank accounts, or filings made for different people from the same Internet address.</p>
<p>In too many cases, he said, the deposits are going into accounts where the beneficiary name does not match the name on the bank account. Worse still, the source said, many states have dramatically pared back the amount of information required to successfully request an unemployment filing.</p>
<p>&#8220;The ones we&#8217;re seeing worst hit are the states that aren&#8217;t aren&#8217;t asking where you work,&#8221; the investigator said. &#8220;It used to be they&#8217;d have a whole list of questions about your previous employer, and you had to show you were trying to find work. But now because of the pandemic, there&#8217;s no such requirement. They&#8217;ve eliminated any controls they had at all, and now they&#8217;re just shoveling money out the door based on Social Security number, name, and a few other details that aren&#8217;t hard to find.&#8221;<span id="more-51743"></span></p>
<h4>CANARY IN THE GOLDMINE</h4>
<p>Earlier this week, email security firm <a href="https://www.agari.com/email-security-blog/covid-19-unemployment-fraud-cares-act/" target="_blank" rel="noopener noreferrer">Agari</a> detailed a fraud operation tied to a seasoned Nigerian cybercrime group it dubbed &#8220;<a href="media/3c99dbbd.scattered-canary.pdf" data-original-source="https://www.agari.com/cyber-intelligence-research/whitepapers/scattered-canary.pdf" target="_blank" rel="noopener noreferrer">Scattered Canary</a>,&#8221; which has been busy of late bilking states and the federal government out of economic stimulus and unemployment payments. Agari said this group has been filing hundreds of successful claims, all effectively using the same email address.</p>
<p>&#8220;Scattered Canary uses Gmail &#8216;dot accounts&#8217; to mass-create accounts on each target website,&#8221; Agari&#8217;s <strong>Patrick Peterson</strong> wrote. &#8220;Because Google ignores periods when interpreting Gmail addresses, Scattered Canary has been able to create dozens of accounts on state unemployment websites and the IRS website dedicated to processing CARES Act payments for non-tax filers (freefilefillableforms.com).&#8221;</p>
<div id="attachment_51756" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/b560eff0.agari.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/agari.png"><img aria-describedby="caption-attachment-51756" class="wp-image-51756" src="media/b560eff0.agari.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/agari.png" alt="" width="595" height="91" /></a><p id="caption-attachment-51756" class="wp-caption-text">Image: Agari.</p></div>
<p>Indeed, the very day the IRS unveiled its site for distributing CARES Act payments last month, KrebsOnSecurity <a href="https://krebsonsecurity.com/2020/04/new-irs-site-could-make-it-easy-for-thieves-to-intercept-some-stimulus-payments/" target="_blank" rel="noopener noreferrer">warned</a> that it was very likely to be abused by fraudsters to intercept stimulus payments from U.S. citizens, mainly because the only information required to submit a claim was name, date of birth, address and Social Security number.</p>
<p>Agari notes that since April 29, Scattered Canary has filed at least 174 fraudulent claims for unemployment with the state of Washington.</p>
<p>&#8220;Based on communications sent to Scattered Canary, these claims were eligible to receive up to $790 a week for a total of $20,540 over a maximum of 26 weeks,&#8221; Peterson wrote. &#8220;Additionally, the CARES Act includes $600 in Federal Pandemic Unemployment Compensation each week through July 31. This adds up to a maximum potential loss as a result of these fraudulent claims of $4.7 million.&#8221;</p>
<h4>STATE WEB SITE WOES</h4>
<p>A number of states have suffered security issues with the PUA websites that exposed personal details of citizens filing unemployment insurance claims. Perhaps the most galling example comes from Arkansas, whose site exposed the SSNs, bank account and routing numbers for some 30,000 applicants.</p>
<p>In that instance, <em>The Arkansas Times</em> <a href="https://arktimes.com/arkansas-blog/2020/05/18/governor-shooting-the-messenger-wrong-tact-in-arkansas-pua-data-breach-experts-say" target="_blank" rel="noopener noreferrer">alerted the state</a> after hearing from a computer programmer who was filing for unemployment on the site and found he could see other applicants&#8217; data simply by changing the site&#8217;s URL slightly. State officials reportedly ignored the programmer&#8217;s repeated attempts to get them to fix the issue, and when it was covered by the newspaper the state governor accused the person who found it of breaking the law.</p>
<p>Over the past week, several other states have discovered similar issues with their PUA application sites, including <a href="https://www.thedenverchannel.com/news/local-news/colorados-unemployment-filing-system-potentially-exposed-private-data-of-some-people" target="_blank" rel="noopener noreferrer">Colorado</a>, <a href="https://patch.com/illinois/across-il/illinois-unemployment-website-glitch-leaks-personal-information" target="_blank" rel="noopener noreferrer">Illinois</a>, and <a href="https://www.news5cleveland.com/news/continuing-coverage/coronavirus/local-coronavirus-news/personal-information-of-applicants-in-ohios-pandemic-unemployment-assistance-program-exposed-in-data-breach" target="_blank" rel="noopener noreferrer">Ohio</a>.</p>


feed_id: https://krebsonsecurity.com/?p=51777
title: Report: ATM Skimmer Gang Had Protection from Mexican Attorney General’s Office
uri: 2020-05-27-
url:
https://krebsonsecurity.com/2020/05/report-atm-skimmer-gang-had-protection-from-mexican-attorney-generals-office/

content:
<p>A group of Romanians operating an ATM company in Mexico and suspected of bribing technicians to install sophisticated Bluetooth-based skimmers in cash machines throughout several top Mexican tourist destinations have enjoyed legal protection from a top anti-corruption official in the Mexican attorney general&#8217;s office, according to a new complaint filed with the government&#8217;s internal affairs division.</p>
<p>As <a href="https://www.reforma.com/aplicacioneslibre/preacceso/articulo/default.aspx?urlredirect=https://www.reforma.com/exhiben-en-fgr-proteccion-a-red-de-clonadores/ar1950303?&amp;referer=--7d616165662f3a3a6262623b6770737a6778743b767a783a706d7d7c77707b38707b387372673865677a617076767c7a7b3874386770713871703876797a7b74717a6770663a7467242c20252625262a4a4a676374792824--" target="_blank" rel="noopener noreferrer">detailed this week</a> by the Mexican daily <em>Reforma</em>, several Mexican federal, state and municipal officers filed a complaint saying the attorney general office responsible for combating corruption had initiated formal proceedings against them for investigating Romanians living in Mexico who are thought to be part of the ATM skimming operation.</p>
<div id="attachment_51799" style="width: 606px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-51799" class=" wp-image-51799" src="media/8b72c40c.clonadores.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/clonadores.png" alt="" width="596" height="547" /><p id="caption-attachment-51799" class="wp-caption-text">Florian Tudor (right) and his business associates at a press conference earlier this year. Image: Reforma.</p></div>
<p>Reforma said the complaint centers on <strong>Camilo Constantino Rivera</strong>, who heads the unit in the Mexican Special Prosecutor&#8217;s office responsible for fighting corruption. It alleges Rivera has an inherent conflict of interest because his brother has served as a security escort and lawyer for <strong>Floridan Tudor</strong>, the reputed boss of a Romanian crime syndicate recently <a href="https://www.justice.gov/usao-sdny/pr/18-members-international-fraud-and-money-laundering-conspiracy-charged-manhattan" target="_blank" rel="noopener noreferrer">targeted by the FBI</a> for running an ATM skimming and human trafficking network that operates throughout Mexico and the United States.</p>
<p>Tudor, a.k.a. &#8220;<strong>Rechinu</strong>&#8221; or &#8220;The Shark,&#8221; and his ATM company <strong>Intacash</strong>, were the subject of a <a href="https://krebsonsecurity.com/2015/09/tracking-a-bluetooth-skimmer-gang-in-mexico/" target="_blank" rel="noopener noreferrer">three</a> <a href="https://krebsonsecurity.com/2015/09/tracking-bluetooth-skimmers-in-mexico-part-ii/" target="_blank" rel="noopener noreferrer">part</a> <a href="https://krebsonsecurity.com/2015/09/whos-behind-bluetooth-skimming-in-mexico/" target="_blank" rel="noopener noreferrer">investigation</a> by KrebsOnSecurity published in September 2015. That series tracked the activities of a crime gang which was rumored to be bribing and otherwise coercing ATM technicians into installing Bluetooth-based skimming devices inside cash machines throughout popular tourist destinations in and around Mexico&#8217;s Yucatan Peninsula &#8212; including Cancun, Cozumel, Playa del Carmen and Tulum.</p>
<div align="center"><iframe src="https://www.youtube.com/embed/Pi6y2soOp8Y" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>In 2018, 44-year-old Romanian national <strong>Sorinel Constantin Marcu</strong> was <a href="https://krebsonsecurity.com/2019/04/alleged-chief-of-romanian-atm-skimming-gang-arrested-in-mexico/" target="_blank" rel="noopener noreferrer">found shot dead in his car in Mexico</a>. Marcu&#8217;s older brother told KrebsOnSecurity shortly after the murder that his brother was Tudor&#8217;s personal bodyguard but at some point had a falling out with Tudor and his associates over money. Marcu the elder said his brother was actually killed in front of a new apartment complex being built and paid for by Mr. Tudor, and that the dead man&#8217;s body was moved to make it look like he was slain in his car instead.</p>
<p>On March 31, 2019, police in Cancun, Mexico arrested 42-year-old Tudor and 37-year-old <strong>Adrian Nicholae Cosmin</strong> for the possession of an illegal firearm and cash totaling nearly 500,000 pesos (~USD $26,000) in both American and Mexican denominations. Two months later, a judge authorized the search of several of Tudor&#8217;s properties.</p>
<p>The Reforma report says Rivera&#8217;s office subsequently initiated proceedings against and removed several agents who investigated the crime ring, alleging those agents abused their authority and conducted illegal searches. The complaint against Rivera charges that the criminal protection racket also included the former chief of police in Cancun.</p>
<p>In September 2019, prosecutors with the Southern District of New York <a href="https://www.justice.gov/usao-sdny/pr/18-members-international-fraud-and-money-laundering-conspiracy-charged-manhattan" target="_blank" rel="noopener noreferrer">unsealed indictments and announced arrests</a> against 18 people accused of running an ATM skimming and money laundering operation that netted $20 million. The defendants in that case &#8212; nearly all of whom are Romanians living in the United States and Mexico &#8212; included <strong>Florian Claudio Martin</strong>, described by Romanian newspapers as &#8220;the brother of Rechinu,&#8221; a.k.a. Tudor.<span id="more-51777"></span></p>
<p>The news comes on the heels of a public relations campaign launched by Mr. Tudor, who recently denounced harassment from the news media and law enforcement by taking out a full two-page ad in <em>Novedades</em>, the oldest daily newspaper in the Mexican state of Quintana Roo (where Cancun is located). In a news conference with members of the local press, Tudor also reportedly accused this author of having been hired by his enemies to slander him and ruin his legitimate business.</p>
<div id="attachment_51782" style="width: 603px" class="wp-caption aligncenter"><a class="lightbox" href="media/2f5cca2d.cartaabierta.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/cartaabierta.png"><img aria-describedby="caption-attachment-51782" class="wp-image-51782" src="media/2f5cca2d.cartaabierta.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/cartaabierta.png" alt="" width="593" height="584" /></a><p id="caption-attachment-51782" class="wp-caption-text">A two-page ad taken out earlier this year in a local newspaper by Florian Tudor, accusing the head of the state police department of spying on businessmen in order to extort and harass them.</p></div>
<p>Obviously, there is no truth to Tudor&#8217;s accusations, and this would hardly be the first time the reputed head of a transnational crime syndicate has insinuated that I was <a href="https://krebsonsecurity.com/?s=pharma+wars&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">paid by his enemies to disrupt his operations</a>.</p>
<p>Next week, KrebsOnSecurity will publish highlights from an upcoming lengthy investigation into Tudor and his company by the <a href="https://www.occrp.org/en" target="_blank" rel="noopener noreferrer">Organized Crime and Corruption Reporting Project</a> (OCCRP), a consortium of investigative journalists operating in Eastern Europe, Central Asia and Central America.</p>
<p>Here&#8217;s a small teaser: Earlier this year, I was interviewed on camera by reporters with the OCCRP, who at one point in the discussion handed me a transcript of some text messages shared by law enforcement officials that allegedly occurred between Tudor and his associates directly after the publication of my 2015 investigation into Intacash.</p>
<p>The text messages suggested my story had blown the cover off their entire operation, and that they intended to shut it all down after the series was picked up in the Mexican newspapers. One text exchange seems to indicate the group even briefly contemplated taking out a hit on this author in retribution.</p>
<p>The Mexican attorney general&#8217;s office could not be immediately reached for comment. The &#8220;contact us&#8221; email link on <a href="https://www.gob.mx/fgr#2378" target="_blank" rel="noopener noreferrer">the office&#8217;s homepage</a> leads to a blank email address, and a message sent to the one email address listed there as the main contact for the Mexican government portal (gobmx@funcionpublica.gob.mx) bounced back as an attempt to deliver to a non-existent domain name.</p>
<p>Further reading:</p>
<p><a href="https://krebsonsecurity.com/2019/04/alleged-chief-of-romanian-atm-skimming-gang-arrested-in-mexico/" target="_blank" rel="noopener noreferrer">Alleged Chief of Romanian ATM Skimming Gang Arrested in Mexico</a></p>
<p><a href="https://krebsonsecurity.com/2015/09/tracking-a-bluetooth-skimmer-gang-in-mexico/" target="_blank" rel="noopener noreferrer">Tracking a Bluetooth Skimmer Gang in Mexico</a></p>
<p><a href="https://krebsonsecurity.com/2015/09/tracking-bluetooth-skimmers-in-mexico-part-ii/" target="_blank" rel="noopener noreferrer">Tracking a Bluetooth Skimmer Gang in Mexico, Part II</a></p>
<p><a href="https://krebsonsecurity.com/2015/09/whos-behind-bluetooth-skimming-in-mexico/" target="_blank" rel="noopener noreferrer">Who&#8217;s Behind Bluetooth Skimming in Mexico?</a></p>


feed_id: https://krebsonsecurity.com/?p=51745
title: UK Ad Campaign Seeks to Deter Cybercrime
uri: UK-Ad-Campaign-Seeks-to-Deter-Cybercrime
url: https://krebsonsecurity.com/2020/05/uk-ad-campaign-seeks-to-deter-cybercrime/
content:
<p>The United Kingdom&#8217;s anti-cybercrime agency is running online ads aimed at young people who search the Web for services that enable computer crimes, specifically trojan horse programs and DDoS-for-hire services. The ad campaign follows a similar initiative launched in late 2017 that academics say measurably dampened demand for such services by explaining that their use to harm others is illegal and can land potential customers in jail.</p>
<p>For example, search in Google for the terms &#8220;booter&#8221; or &#8220;stresser&#8221; from a U.K. Internet address, and there&#8217;s a good chance you&#8217;ll see a paid ad show up on the first page of results warning that using such services to attack others online is illegal. The ads are being paid for by the U.K.&#8217;s <a href="https://www.nationalcrimeagency.gov.uk/" target="_blank" rel="noopener noreferrer">National Crime Agency</a>, which saw success with a related campaign for six months starting in December 2017.</p>
<div id="attachment_51806" style="width: 608px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-51806" class=" wp-image-51806" src="media/e1f215d2.nca-booter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/nca-booter.png" alt="" width="598" height="396" /><p id="caption-attachment-51806" class="wp-caption-text">A Google ad campaign paid for by the U.K.&#8217;s National Crime Agency.</p></div>
<p>NCA Senior Manager <strong>David Cox</strong> said the agency is targeting its ads to U.K. males age 13 to 22 who are searching for booter services or different types of remote access trojans (RATs), as part of an ongoing effort to help steer young men away from cybercrime and toward using their curiosity and skills for good. The ads link to advertorials and to the <a href="https://www.cybersecuritychallenge.org.uk/#" target="_blank" rel="noopener noreferrer">U.K.&#8217;s Cybersecurity Challenge</a>, which tries gamify computer security concepts and highlight potential careers in cybersecurity roles.</p>
<p>&#8220;The fact is, those standing in front of a classroom teaching children have less information about cybercrime than those they&#8217;re trying to teach,&#8221; Cox said, noting that the campaign is designed to support so-called &#8220;knock-and-talk&#8221; visits, where investigators visit the homes of young people who&#8217;ve downloaded malware or purchased DDoS-for-hire services to warn them away from such activity. &#8220;This is all about showing people there are other paths they can take.&#8221;</p>
<p>While it may seem obvious to the casual reader that deploying some <a href="https://krebsonsecurity.com/?s=remote+access+trojan+rat&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">malware-as-a-service</a> or using a <a href="https://krebsonsecurity.com/?s=booter+stresser&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">booter</a> to knock someone or something offline can land one in legal hot water, the typical profile of those who frequent these services is young, male, impressionable and participating in online communities of like-minded people in which everyone else is already doing it.</p>
<p>In 2017, the NCA published &#8220;<a href="https://www.nationalcrimeagency.gov.uk/who-we-are/publications/6-pathways-into-cyber-crime-1/file" target="_blank" rel="noopener noreferrer">Pathways into Cyber Crime</a>,&#8221; a report that drew upon interviews conducted with a number of young men who were visited by U.K. law enforcement agents in connection with various cybercrime investigations.</p>
<p>Those findings, which the NCA said came about through knock-and-talk interviews with a number of suspected offenders, found that 61 percent of suspects began engaging in criminal hacking before the age of 16, and that the average age of suspects and arrests of those involved in hacking cases was 17 years old.</p>
<p><span class="pullquote pqleft">The majority of those engaged in, or on the periphery of, cyber crime, told the NCA they became involved via an interest in computer gaming.</span></p>
<p>A large proportion of offenders began to participate in gaming cheat websites and &#8220;modding&#8221; forums, and later progressed to criminal hacking forums.</p>
<p>The NCA learned the individuals visited had just a handful of primary motivations in mind, including curiosity, overcoming a challenge, or proving oneself to a larger group of peers. According to the report, a typical offender faces a perfect storm of ill-boding circumstances, including a perceived low risk of getting caught, and a perception that their offenses in general amounted to victimless crimes.</p>
<p>&#8220;Law enforcement activity does not act as a deterrent, as individuals consider cyber crime to be low risk,&#8221; the NCA report found. &#8220;Debrief subjects have stated that they did not consider law enforcement until someone they knew or had heard of was arrested. For deterrence to work, there must be a closing of the gap between offender (or potential offender) with law enforcement agencies functioning as a visible presence for these individuals.&#8221;</p>
<p>Cox said the NCA will continue to run the ads indefinitely, and that it is seeking funding from outside sources &#8212; including major companies in online gaming industry, whose platforms are perhaps the most targeted by DDoS-for-hire services. He called the program a &#8220;great success,&#8221; noting that in the past 30 days (13 of which the ads weren&#8217;t running for funding reasons), the ads generated some 5.32 million impressions, and more than 57,000 clicks.</p>
<h4>FLATTENING THE CURVE</h4>
<p><strong>Richard Clayton</strong> is director of the <a href="https://www.cambridgecybercrime.uk/" target="_blank" rel="noopener noreferrer">University of Cambridge Cybercrime Centre</a>, which has been monitoring DDoS attacks for several years using a variety of sensors across the Internet that pretend to be the types of systems which are typically commandeered and abused to help launch such assaults.</p>
<p>Last year, Clayton and fellow Cambridge researchers <a href="https://www.repository.cam.ac.uk/handle/1810/297004" target="_blank" rel="noopener noreferrer">published a paper</a> showing that law enforcement interventions &#8212; including the NCA&#8217;s anti-DDoS ad campaign between 2017 and 2018 &#8212; demonstrably slowed the growth in demand for DDoS-for-hire services.</p>
<p>&#8220;Our data shows that by running that ad campaign, the NCA managed to flatten out demand for booter services over that period,&#8221; Clayton said. &#8220;In other words, the demand for these services didn&#8217;t grow over the period as we would normally see, and we didn&#8217;t see more people doing it at the end of the period than at the beginning. When we showed this to the NCA, they were ever so pleased, because that campaign cost them less than ten thousand [pounds sterling] and it stopped this type of cybercrime from growing for six months.&#8221;</p>
<div id="attachment_51807" style="width: 603px" class="wp-caption aligncenter"><a class="lightbox" href="media/432a30ec.bootingthebooters.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/bootingthebooters.png"><img aria-describedby="caption-attachment-51807" class="wp-image-51807" src="media/432a30ec.bootingthebooters.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/bootingthebooters.png" alt="" width="593" height="356" /></a><p id="caption-attachment-51807" class="wp-caption-text">The Cambridge study found various interventions by law enforcement officials had measurable effects on the demand for and damage caused by booter and stresser services. Source: Booting the Booters, 2019.</p></div>
<p>Clayton said part of the problem is that many booter/stresser providers claim they&#8217;re offering lawful services, and many of their would-be customers are all too eager to believe this is true. Also, the price point is affordable: A typical booter service will allow customers to launch fairly high-powered DDoS attacks for just a few dollars per month.</p>
<p>&#8220;There are legitimate companies that provide these types of services in a legal manner, but there are all types of agreements that have to be in place before this can happen,&#8221; Clayton said. &#8220;And you don&#8217;t get that for ten bucks a month.&#8221;<span id="more-51745"></span></p>
<h4>DON&#8217;T BE EVIL</h4>
<p>The NCA&#8217;s ad campaign is competing directly with Google ads taken out by many of the same people running these DDoS-for-hire services. It may surprise some readers to learn that cybercrime services often advertise on Google and other search sites much like any legitimate business would &#8212; paying for leads that might attract new customers.</p>
<p>Several weeks back, KrebsOnSecurity noticed that searching for &#8220;booter&#8221; or &#8220;stresser&#8221; in Google turned up paid ads for booter services prominently on the first page of results. But as I noted in <a href="https://twitter.com/briankrebs/status/1260396524137218048" target="_blank" rel="noopener noreferrer">a tweet about the finding</a>, this is hardly a new phenomenon.</p>
<div id="attachment_51810" style="width: 569px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-51810" class=" wp-image-51810" src="media/bf7f24e6.booterad.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/booterad.png" alt="" width="559" height="453" /><p id="caption-attachment-51810" class="wp-caption-text">A booter ad I reported to Google that the company subsequently took offline.</p></div>
<p>Cambridge&#8217;s Clayton pointed me to <a href="https://www.lightbluetouchpaper.org/2018/08/28/google-doesnt-seem-to-believe-booters-are-illegal/" target="_blank" rel="noopener noreferrer">a blog post he wrote in 2018</a> about the prevalence of such ads, which violate Google&#8217;s policies on acceptable advertisements via its platform. Google says it doesn&#8217;t allow ads for services that &#8220;cause damage, harm or injury,&#8221; and that they don&#8217;t allow adverts for services that &#8220;are designed to enable dishonest behavior.&#8221;</p>
<p>Clayton said Google eventually took down the offending ads. But as my few seconds of Googling revealed, the company appears to have decided to play wack-a-mole when people complain, instead of expressly prohibiting the placement of (and payment for) ads with these terms.</p>
<p>Google told KrebsOnSecurity that it relies on a combination of technology and people to enforce its policies.</p>
<p>&#8220;We have strict ad <a href="https://support.google.com/adspolicy/answer/6020955?hl=en&amp;ref_topic=1626336" target="_blank" rel="noopener noreferrer" data-saferedirecturl="https://www.google.com/url?q=https://support.google.com/adspolicy/answer/6020955?hl%3Den%26ref_topic%3D1626336&amp;source=gmail&amp;ust=1590692184238000&amp;usg=AFQjCNFNJCRWRBYX_0nGwbGXk64YIdcgMA">policies</a> designed to protect users on our platforms,&#8221; Google said in a written statement. &#8220;We prohibit ads that enable dishonest behavior, including services that look to take advantage of or cause harm to users. When we find an ad that violates our policies we take action. In this case, we quickly removed the ads.&#8221;</p>
<p>Google pointed to a recent <a href="https://www.blog.google/products/ads/stopping-bad-ads-to-protect-users/" target="_blank" rel="noopener noreferrer">blog post</a> detailing its enforcement efforts in this regard, which said in 2019 the company took down more than 2.7 billion ads that violated its policies &#8212; or more than 10 million ads per day &#8212; and that it removed a million advertiser accounts for the same reason.</p>
<p>The ad pictured above ceased to appear shortly after my outreach to them. Unfortunately, an ad for a different booter service (shown below) soon replaced the one they took down.</p>
<div id="attachment_51809" style="width: 608px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-51809" class=" wp-image-51809" src="media/afa4c7e8.stresser-5-22.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/stresser-5-22.png" alt="" width="598" height="396" /><p id="caption-attachment-51809" class="wp-caption-text">An ad for a DDoS-for-hire service that appeared shortly after Google took down the ones KrebsOnSecurity reported to them.</p></div>


feed_id: https://krebsonsecurity.com/?p=51836
title: Career Choice Tip: Cybercrime is Mostly Boring
uri: Career-Choice-Tip-Cybercrime-is-Mostly-Boring
url: https://krebsonsecurity.com/2020/05/career-choice-tip-cybercrime-is-mostly-boring/
content:
<p>When law enforcement agencies tout their latest cybercriminal arrest, the defendant is often cast as a bravado outlaw engaged in sophisticated, lucrative, even exciting activity. But new research suggests that as cybercrime has become dominated by pay-for-service offerings, the vast majority of day-to-day activity needed to support these enterprises is in fact mind-numbingly boring and tedious, and that highlighting this reality may be a far more effective way combat cybercrime and steer offenders toward a better path.</p>
<div id="attachment_51844" style="width: 601px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-51844" class=" wp-image-51844" src="media/afab3924.boredhacker.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/boredhacker.jpg" alt="" width="591" height="395" /><p id="caption-attachment-51844" class="wp-caption-text">Yes, I realize hooded hacker stock photos <a href="https://www.fastcompany.com/90422130/here-are-the-winners-of-the-first-contest-to-design-stock-images-of-hackers" target="_blank" rel="noopener noreferrer">have become a meme</a>, but that&#8217;s the point.</p></div>
<p>The findings come in a new paper released by researchers at <a href="https://www.cambridgecybercrime.uk/" target="_blank" rel="noopener noreferrer">Cambridge University&#8217;s Cybercrime Centre</a>, which examined the quality and types of work needed to build, maintain and defend illicit enterprises that make up a large portion of the cybercrime-as-a-service market. In particular, the academics focused on botnets and DDoS-for-hire or &#8220;booter&#8221; services, the maintenance of underground forums, and malware-as-a-service offerings.</p>
<p>In examining these businesses, the academics stress that the romantic notions of those involved in cybercrime ignore the often mundane, rote aspects of the work that needs to be done to support online illicit economies. The researchers concluded that for many people involved, cybercrime amounts to little more than a boring office job sustaining the infrastructure on which these global markets rely, work that is little different in character from the activity of legitimate system administrators.</p>
<p><strong>Richard Clayton</strong>, a co-author of the report and director of Cambridge&#8217;s Cybercrime Centre, said the findings suggest policymakers and law enforcement agencies may be doing nobody a favor when they issue aggrandizing press releases that couch their cybercrime investigations as targeting sophisticated actors.</p>
<p>&#8220;The way in which everyone looks at cybercrime is they&#8217;re all interested in the rockstars and all the exciting stuff,&#8221; Clayton told KrebsOnSecurity. &#8220;The message put out there is that cybercrime is lucrative and exciting, when for most of the people involved it&#8217;s absolutely not the case.&#8221;</p>
<p>From the paper:</p>
<blockquote><p>&#8220;We find that as cybercrime has developed into industrialized illicit economies, so too have a range of tedious supportive forms of labor proliferated, much as in mainstream industrialized economies. We argue that cybercrime economies in advanced states of growth have begun to create their own tedious, low-fulfillment jobs, becoming less about charismatic transgression and deviant identity, and more about stability and the management and diffusion of risk. Those who take part in them, the research literature suggests, may well be initially attracted by exciting media portrayals of hackers and technological deviance.&#8221;</p>
<p>&#8220;However, the kinds of work and practices in which they actually become involved are not reflective of the excitement and exploration which characterized early ‘hacker’ communities, but are more similar to low-level work in drug dealing gangs, involving making petty amounts of money for tedious work in the service of aspirations that they may one day be one of the major players. This creates the same conditions of boredom&#8230;which are found in mainstream jobs when the reality emerges that these status and financial goals are as blocked in the illicit economy as they are in the regular job market.&#8221;</p></blockquote>
<p>The researchers drew on interviews with people engaged in such enterprises, case studies on ex- or reformed criminal hackers, and from scraping posts by denizens of underground forums and chat channels. They focused on the activity needed to keep various crime services operating efficiently and free from disruption from interlopers, internecine conflict, law enforcement or competitors.</p>
<h4>BOOTER BLUES</h4>
<p>For example, running an effective booter service requires a substantial amount of administrative work and maintenance, much of which involves constantly scanning for, commandeering and managing large collections of remote systems that can be used to amplify online attacks.</p>
<p><img class="aligncenter wp-image-51849" src="media/73d82a19.boredhacker2.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/boredhacker2.jpg" alt="" width="588" height="393" /></p>
<p>Booter services (a.k.a. &#8220;stressers&#8221;) &#8212; like many other cybercrime-as-a-service offerings &#8212; tend to live or die by their reputation for uptime, effectiveness, treating customers fairly, and for quickly responding to inquiries or concerns from users. As a result, these services typically require substantial investment in staff needed for customer support work (through a ticketing system or a realtime chat service) when issues arise with payments or with clueless customers failing to understand how to use the service.</p>
<p>In one interview with a former administrator of a booter service, the proprietor told researchers he quit and went on with a normal life after getting tired of dealing with customers who took for granted all the grunt work needed to keep the service running. From the interview:</p>
<p>&#8220;And after doing [it] for almost a year, I lost all motivation, and really didn’t care anymore. So I just left and went on with life. It wasn’t challenging enough at all. Creating a stresser is easy. Providing the power to run it is the tricky part. And when you have to put all your effort, all your attention. When you have to sit in front of a computer screen and scan, filter, then filter again over 30 amps per 4 hours it gets annoying.&#8221;</p>
<p>The researchers note that this burnout is an important feature of customer support work, &#8220;which is characterized less by a progressive disengagement with a once-interesting activity, and more by the gradual build-up of boredom and disenchantment, once the low ceiling of social and financial capital which can be gained from this work is reached.&#8221;<span id="more-51836"></span></p>
<h4>WHINY CUSTOMERS</h4>
<p>Running a malware-as-a-service offering also can take its toll on developers, who quickly find themselves overwhelmed with customer support requests and negative feedback when a well-functioning service has intermittent outages.</p>
<p><img class="aligncenter wp-image-51852" src="media/24c0f330.whinycustomer.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/whinycustomer.jpg" alt="" width="594" height="359" /></p>
<p>Indeed, the author of the infamous ZeuS Trojan &#8212; a powerful password stealing tool that paved the way for <a href="https://krebsonsecurity.com/?s=zeus+small+business&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">hundreds of millions of dollars stolen from hacked businesses</a> &#8212; is <a href="https://krebsonsecurity.com/2012/02/zeus-trojan-author-ran-with-spam-kingpins/" target="_blank" rel="noopener noreferrer">reputed</a> to have quit the job and released the source code for the malware (thus spawning an entire industry of malware-as-a-service offerings) mainly to focus his skills on less tedious work than supporting hundreds of customers.</p>
<p>&#8220;While they may sound glamorous, providing these cybercrime services require the same levels of boring, routine work as is needed for many non-criminal enterprises, such as system administration, design, maintenance, customer service, patching, bug-fixing, account-keeping, responding to sales queries, and so on,&#8221; the report continues.</p>
<p>To some degree, the ZeuS&#8217;s author experience may not be the best example, because his desire to get away from supporting hundreds of customers ultimately led to his focusing attention and resources on building a far more sophisticated malware threat &#8212; the <a href="https://krebsonsecurity.com/?s=gameover+zeus&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">peer-to-peer based Gameover malware</a> that he leased to a small group of organized crime groups.</p>
<p>Likewise, <a href="https://www.wired.com/story/confessions-marcus-hutchins-hacker-who-saved-the-internet/" target="_blank" rel="noopener noreferrer">the cover story</a> in this month&#8217;s <em>Wired</em> magazine profiles <a href="https://krebsonsecurity.com/?s=Marcus+hutchins&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">Marcus Hutchins</a>, who said he &#8220;quickly grew bored with his botnets and his hosting service, which he found involved placating a lot of &#8216;whiny customers.&#8217; So he quit and began to focus on something he enjoyed far more: perfecting his own malware.&#8221;</p>
<h4>BORING THEM OUT OF BUSINESS</h4>
<p>Cambridge&#8217;s Clayton and his colleagues argue the last two examples are more the exception than the rule, and that their research points to important policy implications for fighting cybercrime that are often discounted or overlooked: Namely, interventions that focus on the economics of attention and boredom, and on making such work as laborious and boring as possible.</p>
<p>Many cybersecurity experts often remark that taking down domain names and other infrastructure tied to cybercrime businesses amounts to little more than a game of whack-a-mole, because the perpetrators simply move somewhere else to resume their operations. But the Cambridge researchers note that each takedown creates further repetitive, tedious, work for the administrators to set up their sites anew.</p>
<p>&#8220;Recent research shows that the booter market is particularly susceptible to interventions targeted at this infrastructural work, which make the jobs of these server managers more boring and more risky,&#8221; the researchers note.</p>
<p>The paper takes care to note that its depictions of the ‘boredom’ of the untrained administrative work carried out in the illicit economy should not be taken as impugning the valuable and complex work of legitimate system administrators. &#8220;Rather, it is to recognize that this is a different kind of knowledge and set of skills from engineering work, which needs to be taught, learned, and managed differently.&#8221;</p>
<p>The authors conclude that refocusing interventions in this way might also be supported by changes to the predominant forms of messaging used by law enforcement and policy professionals around cybercrime:</p>
<blockquote><p>&#8220;If participation within these economies is in fact based in deviant aspiration rather than deviant experience, the currently dominant approaches to messaging, which tend to focus on the dangerous and harmful nature of these behaviors, the high levels of technical skill possessed by cybercrime actors, the large amounts of money made in illicit online economies, and the risk of detection, arrest, and prosecution are potentially counterproductive, only feeding the aspiration which drives this work. Conversely, by emphasizing the tedious, low-skilled, low-paid, and low-status reality of much of this work, messaging could potentially dissuade those involved in deviant online subcultures from making the leap from posting on forums to committing low-level crime.&#8221;</p>
<p>&#8220;Additionally, diversionary interventions that emphasize the shortage of sysadmin and ‘pen tester’ workers in the legitimate economy (“you could be paid really good money for doing the same things in a proper job”) need to recognize that pathways, motivations, and experiences may be rather more prosaic than might be expected.&#8221;</p>
<p>&#8220;Conceptualizing cybercrime actors as high-skilled, creative adolescents with a deep love for and understanding of technology may in fact mischaracterize most of the people on whom these markets depend, who are often low-skilled administrators who understand fairly little about the systems they maintain and administer, and whose approach is more akin to the practical knowledge of the maintainer than the systematic knowledge of a software engineer or security researcher. Finding all these bored people appropriate jobs in the legitimate economy may be as much about providing basic training as about parachuting superstars into key positions.&#8221;</p></blockquote>
<p>Further reading: <a href="media/91ac9845.Crime_is_boring.pdf" data-original-source="https://www.cl.cam.ac.uk/~bjc63/Crime_is_boring.pdf" target="_blank" rel="noopener noreferrer">Cybercrime is (often) Boring: Maintaining the Infrastructure of Cybercrime Economies</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=51880
title: Romanian Skimmer Gang in Mexico Outed by KrebsOnSecurity Stole $1.2 Billion
uri: Romanian-Skimmer-Gang-in-Mexico-Outed-by-KrebsOnSecurity-Stole-1-2-Bi
url:
https://krebsonsecurity.com/2020/06/romanian-skimmer-gang-in-mexico-outed-by-krebsonsecurity-stole-1-2-billion/

content:
<p>An exhaustive inquiry published today by a consortium of investigative journalists says a three-part series KrebsOnSecurity published in 2015 on a Romanian ATM skimming gang operating in Mexico&#8217;s top tourist destinations disrupted their highly profitable business, which raked in an estimated $1.2 billion and enjoyed the protection of top Mexican authorities.</p>
<div style="text-align: center;"><iframe src="https://www.youtube.com/embed/O9jf-RtpPXM" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>The multimedia investigation by the <a href="https://www.occrp.org" target="_blank" rel="noopener noreferrer">Organized Crime and Corruption Reporting Project</a> (OCCRP) and several international journalism partners detailed the activities of the so-called <strong>Riviera Maya</strong> crime gang, allegedly a mafia-like group of Romanians who until very recently ran their own ATM company in Mexico called &#8220;<strong>Intacash</strong>&#8221; and installed sophisticated electronic card skimming devices inside at least 100 cash machines throughout Mexico.</p>
<p>According to the OCCRP, Riviera Maya&#8217;s skimming devices allowed thieves to clone the cards, which were used to withdraw funds from ATMs in other countries &#8212; often halfway around the world in places like India, Indonesia, and Taiwan.</p>
<p>Investigators say each skimmer captured on average 1,000 cards per month, siphoning about $200 from individual victim accounts. This allowed the crime gang to steal approximately $20 million monthly.</p>
<p>&#8220;The gang had little tricks,&#8221; OCCRP reporters recounted in their video documentary (above). &#8220;They would use the cards in different cities all over the globe and wait three months so banks would struggle to trace where the card had originally been cloned.&#8221;</p>
<p>In September 2015, I traveled to Mexico&#8217;s Yucatan Peninsula <a href="https://krebsonsecurity.com/2015/09/tracking-a-bluetooth-skimmer-gang-in-mexico/" target="_blank" rel="noopener noreferrer">to find</a> <a href="https://krebsonsecurity.com/2015/09/tracking-bluetooth-skimmers-in-mexico-part-ii/" target="_blank" rel="noopener noreferrer">and document</a> almost two dozen ATMs in the region that were compromised with Bluetooth-based skimming devices. Unlike most skimmers &#8212; which can be detected by looking for out-of-place components attached to the exterior of a compromised cash machine &#8212; these skimmers were hooked to the internal electronics of ATMs operated by Intacash&#8217;s competitors by authorized personnel who&#8217;d reportedly been bribed or coerced by the gang.</p>
<p>But because the skimmers were Bluetooth-based, allowing thieves periodically to collect stolen data just by strolling up to a compromised machine with a mobile device, I was able to detect which ATMs had been hacked using nothing more than a cheap smart phone.</p>
<div id="attachment_32341" style="width: 606px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-32341" class=" wp-image-32341" src="media/e830e869.BTpadskimF2M.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/09/BTpadskimF2M.png" alt="" width="596" height="589" srcset="https://krebsonsecurity.com/wp-content/uploads/2015/09/BTpadskimF2M.png 616w, https://krebsonsecurity.com/wp-content/uploads/2015/09/BTpadskimF2M-580x573.png 580w" sizes="(max-width: 596px) 100vw, 596px" /><p id="caption-attachment-32341" class="wp-caption-text">One of the Bluetooth-enabled PIN pads pulled from a compromised ATM in Mexico. The two components on the left are legitimate parts of the machine. The fake PIN pad made to be slipped under the legit PIN pad on the machine, is the orange bit, top right. The Bluetooth and data storage chips are in the middle.</p></div>
<p>Several days of wandering around Mexico&#8217;s top tourist areas uncovered these sophisticated skimmers inside ATMs in Cancun, Cozumel, Playa del Carmen and Tulum, including a compromised ATM in the lobby of my hotel in Cancun. OCCRP investigators said the gang also had installed the same skimmers in ATMs at tourist hotspots on the western coast of Mexico, in Puerto Vallarta, Sayulita and Tijuana.</p>
<p><a href="https://krebsonsecurity.com/2015/09/whos-behind-bluetooth-skimming-in-mexico/" target="_blank" rel="noopener noreferrer">Part III of my 2015 investigation</a> concluded that Intacash was likely behind the scheme. An ATM industry source told KrebsOnSecurity at the time that his technicians had been approached by ATM installers affiliated with Intacash, offering those technicians many times their monthly salaries if they would provide periodic access to the machines they maintained.</p>
<p>The alleged leader of the Riviera Maya organization and principal owner of Intacash, 43-year-old <strong>Florian &#8220;The Shark&#8221; Tudor</strong>, is a Romanian with permanent residence in Mexico. Tudor claims he&#8217;s an innocent, legitimate businessman who&#8217;s been harassed and robbed by Mexican authorities.</p>
<p>Last year, police in Mexico arrested Tudor for illegal weapons possession, and raided his various properties there in connection with <a href="https://krebsonsecurity.com/2019/04/alleged-chief-of-romanian-atm-skimming-gang-arrested-in-mexico/" target="_blank" rel="noopener noreferrer">an investigation into the 2018 murder of his former bodyguard</a>, <strong>Constantin Sorinel Marcu</strong>.</p>
<p>According to prosecution documents, Marcu and The Shark spotted my reporting shortly after it was published in 2015, and discussed what to do next on a messaging app:</p>
<blockquote><p><strong>The Shark: </strong>Krebsonsecurity.com See this. See the video and everything. There are two episodes. They made a telenovela.</p>
<p><strong>Marcu:</strong> I see. It&#8217;s bad.</p>
<p><strong>The Shark:</strong> They destroyed us. That&#8217;s it. Fuck his mother. Close everything.</p></blockquote>
<p>The intercepted communications indicate The Shark also wanted revenge on whoever was responsible for leaking information about their operations.</p>
<blockquote><p><strong>The Shark:</strong> Tell them that I am going to kill them.</p>
<p><strong>Marcu:</strong> Okay, I can kill them. Any time, any hour.</p>
<p><strong>The Shark:</strong> They are checking all the machines. Even at banks. They found over 20.</p>
<p><strong>Marcu:</strong> Whaaaat?!? They found? Already??</p></blockquote>
<p><span id="more-51880"></span>Throughout my investigation, I couldn&#8217;t be sure whether Intacash&#8217;s shiny new ATMs &#8212; which positively blanketed tourist areas in and around Cancun &#8212; also were used to siphon customer card data. I did write about my suspicions that Intacash&#8217;s ATMs were up to no good when I found they frequently canceled transactions just after a PIN was entered, and typically failed to provide paper receipts for withdrawals made in U.S. dollars.</p>
<p>But citing some of the thousands of official documents obtained in their investigation, the OCCRP says investigators now believe <em>Intacash installed the same or similar skimming devices in its own ATMs prior to deploying them</em> &#8212; despite advertising them as equipped with the latest security features and fraudulent device inhibitors.</p>
<p>Tudor&#8217;s organization &#8220;had the access that gave The Shark&#8217;s crew huge opportunities for fraud,&#8221; the OCCRP reports. &#8220;And on the Internet, the number of complaints grew. Foreign tourists in Mexico fleeced&#8221; by Intacash&#8217;s ATMs.</p>
<p>Many of the compromised ATMs I located in my travels throughout Mexico were at hotels, and while Intacash&#8217;s ATMs could be found on many street locations in the region, it was rare to find them installed at hotels.</p>
<p>The confidential source with whom I drove from place to place at the time said Intacash avoided installing their machines at hotels &#8212; despite such locations being generally far more profitable &#8212; for one simple reason: If one&#8217;s card is cloned from a hotel ATM, the customer can easily complain to the hotel staff. With a street ATM, not so much.</p>
<p>The investigation by the OCCRP and its partners paints a vivid picture of a highly insular, often violent transnational organized crime ring that controlled at least 10 percent of the $2 billion annual global market for skimmed cards.</p>
<p>It also details <a href="https://www.occrp.org/en/how-a-crew-of-romanian-criminals-conquered-the-world-of-atm-skimming/from-bank-machines-to-real-estate-cleaning-the-dirty-money" target="_blank" rel="noopener noreferrer">how the group laundered their ill-gotten gains</a>, and is alleged to have <a href="https://www.occrp.org/en/how-a-crew-of-romanian-criminals-conquered-the-world-of-atm-skimming/across-the-rio-grande-how-romanians-were-smuggled-into-the-us-to-rob-atms" target="_blank" rel="noopener noreferrer">built a human smuggling ring</a> that helped members of the crime gang cross into the U.S. and ply their skimming trade against ATMs in the United States. Finally, the series highlights how the Riviera Maya gang operated with impunity for several years by <a href="https://www.occrp.org/en/how-a-crew-of-romanian-criminals-conquered-the-world-of-atm-skimming/the-corruption-connection-the-sharks-powerful-friends" target="_blank" rel="noopener noreferrer">exploiting relationships with powerful anti-corruption officials in Mexico</a>.</p>
<p>Tudor and many of his associates maintain their innocence and are still living as free men in Mexico, although Tudor is facing charges in Romania for his alleged involvement with organized crime, attempted murder and blackmail. Intacash is no longer operating in Mexico. In 2019, Intacash&#8217;s sponsoring bank in Mexico suspended the company&#8217;s contract to process ATM transactions.</p>
<p>For much more on this investigation, check out OCCRP&#8217;s multi-part series, <a href="https://www.occrp.org/en/how-a-crew-of-romanian-criminals-conquered-the-world-of-atm-skimming/" target="_blank" rel="noopener noreferrer">How a Crew of Romanian Criminals Conquered the World of ATM Skimming</a>.</p>


feed_id: https://krebsonsecurity.com/?p=51868
title: REvil Ransomware Gang Starts Auctioning Victim Data
uri: REvil-Ransomware-Gang-Starts-Auctioning-Victim-Data
url: https://krebsonsecurity.com/2020/06/revil-ransomware-gang-starts-auctioning-victim-data/
content:
<p>The criminal group behind the <a href="https://krebsonsecurity.com/?s=revil+ransomware&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">REvil ransomware enterprise</a> has begun auctioning off sensitive data stolen from companies hit by its malicious software. The move marks an escalation in tactics aimed at coercing victims to pay up &#8212; and publicly shaming those who don&#8217;t. But it may also signal that ransomware purveyors are searching for new ways to profit from their crimes as victim businesses struggle just to keep the lights on during the unprecedented economic slowdown caused by the COVID-19 pandemic.</p>
<p>Over the past 24 hours, the crooks responsible for spreading the ransom malware &#8220;REvil&#8221; (a.k.a. &#8220;<strong>Sodin</strong>&#8221; and &#8220;<strong>Sodinokibi</strong>&#8220;) used their Dark Web &#8220;Happy Blog&#8221; to announce its first ever stolen data auction, allegedly selling files taken from a Canadian agricultural production company that REvil says has so far declined its extortion demands.</p>
<div id="attachment_51873" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/56729f1e.happyblogauction.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/happyblogauction.png"><img aria-describedby="caption-attachment-51873" class="wp-image-51873" src="media/56729f1e.happyblogauction.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/happyblogauction.png" alt="" width="595" height="213" /></a><p id="caption-attachment-51873" class="wp-caption-text">A partial screenshot from the REvil ransomware group&#8217;s Dark Web blog.</p></div>
<p>The victim firm&#8217;s auction page says a successful bidder will get three databases and more than 22,000 files stolen from the agricultural company. It sets the minimum deposit at $5,000 in virtual currency, with the starting price of $50,000.</p>
<p>Prior to this auction, REvil &#8212; like many other ransomware gangs &#8212; has sought to pressure victim companies into paying up mainly <a href="https://krebsonsecurity.com/2019/12/ransomware-gangs-now-outing-victim-businesses-that-dont-pay-up/" target="_blank" rel="noopener noreferrer">by publishing a handful of sensitive files stolen from their extortion targets</a>, and threatening to release more data unless and until the ransom demand is met.</p>
<p>Experts say the auction is a sign that ransomware groups may be feeling the financial pinch from the current economic crisis, and are looking for new ways to extract value from victims who are now less likely or able to pay a ransom demand.</p>
<p><strong>Lawrence Abrams</strong>, editor of the computer help and news Web site <a href="https://www.bleepingcomputer.com" target="_blank" rel="noopener noreferrer">BleepingComputer</a>, said while some ransomware groups have a history of selling victim data on cybercrime forums, this latest move by REvil may be just another tactic used by criminals to force victims to negotiate a ransom payment.</p>
<p>&#8220;The problem is a lot of victim companies just don&#8217;t have the money [to pay ransom demands] right now,&#8221; Abrams said. &#8220;Others have gotten the message about the need for good backups, and probably don&#8217;t need to pay. But maybe if the victim is seeing their data being actively bid on, they may be more inclined to pay the ransom.&#8221;<span id="more-51868"></span></p>
<p>There is some evidence to suggest that the recent economic downturn wrought by COVID-19 has had a measurable impact on ransomware payouts. <a href="https://blog.chainalysis.com/reports/ransomware-covid-19" target="_blank" rel="noopener noreferrer">A report</a> published in mid-April by cryptocurrency research firm <strong>Chainalysis</strong> found that ransomware payments &#8220;have decreased significantly since the COVID-19 crisis intensified in the U.S. and Europe in early March.&#8221;</p>
<p>Abrams said other ransomware groups have settled on different methods to increase victim payouts, noting that one prominent gang is now doubly extorting targets &#8212; demanding one payment amount in return for a digital key that can unlock files scrambled by the malware, and another payment in exchange for a promise to permanently delete data stolen from the victim.</p>
<p>The implied threat is that victims who pay to recover their files but don&#8217;t bite on the deletion payment can expect to see their private data traded, published or sold on the Dark Web.</p>
<p>&#8220;Some of these [extortion groups] have said if they don&#8217;t get paid they&#8217;re going to sell the victim&#8217;s data on the Dark Web, in order to recoup their costs,&#8221; Abrams said. &#8220;Others are now charging a few not only for the ransomware decryptor, but also a fee to delete the victim&#8217;s data. So it&#8217;s a double vig.&#8221;</p>
<p>The FBI and multiple <a href="https://us.norton.com/internetsecurity-malware-7-tips-to-prevent-ransomware.html" target="_blank" rel="noopener noreferrer">security firms</a> have advised victims not to pay any ransom demands, as doing so just encourages the attackers and in any case may not result in actually regaining access to encrypted files. In practice, however, many cybersecurity consulting firms are quietly urging their customers that paying up is the fastest route back to business-as-usual.</p>
<p>Here are a few tips that can help reduce the likelihood that you or your organization will fall victim to a ransomware attack:</p>
<p><strong>-Patch, early and often:</strong> Many ransomware attacks leverage known security flaws in servers and desktops.</p>
<p><strong>-Disable RDP:</strong> Short for Remote Desktop Protocol, this feature of Windows allows a system to be remotely administered over the Internet. A ridiculous number of businesses — particularly healthcare providers — get hit with ransomware because they leave RDP open to the Internet and secured with easy-to-guess passwords. And there are a number of criminal services that <a href="https://krebsonsecurity.com/2013/12/hacked-via-rdp-really-dumb-passwords/" target="_blank" rel="noopener noreferrer">sell access to brute-forced RDP installations</a>.</p>
<p><strong>-Filter all email:</strong> Invest in security systems that can block executable files at the email gateway.</p>
<p><strong>-Isolate mission-critical systems and data:</strong> This can be harder than it sounds. It may be worth hiring a competent security firm to make sure this is done right.</p>
<p><strong>-Backup key files and databases:</strong> Bear in mind that ransomware can encrypt any network or cloud-based files or folders that are mapped and have been assigned a drive letter. Backing up to a secondary system that is not assigned a drive letter or is disconnected when it’s not backing up data is key. The old “3-2-1” backup rule comes into play here: Wherever possible, keep three backups of your data, on two different storage types, with at least one backup offsite.</p>
<p><strong>-Disable macros in Microsoft Office:</strong> Block external content in Office files. Educate users that ransomware very often succeeds only when a user opens Office file attachment sent via email and manually enables Macros.</p>
<p><strong>-Enable controlled folder access:</strong> <a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard" target="_blank" rel="noopener noreferrer">Create rules</a> to disallow the running of executable files in Windows from local user profile folders (App Data, Local App Data, ProgramData, Temp, etc.)</p>
<p>Sites like <a href="https://www.nomoreransom.org/en/decryption-tools.html" target="_blank" rel="noopener noreferrer">nomoreransom.org</a> distribute free decryptor tools that can help some ransomware victims recover files without paying a ransom demand.</p>


feed_id: https://krebsonsecurity.com/?p=51904
title: Owners of DDoS-for-Hire Service vDOS Get 6 Months Community Service
uri: Owners-of-DDoS-for-Hire-Service-vDOS-Get-6-Months-Community-Service
url:
https://krebsonsecurity.com/2020/06/owners-of-ddos-for-hire-service-vdos-get-6-months-community-service/

content:
<p>The co-owners of <strong>vDOS</strong>, a now-defunct service that for four years helped paying customers launch more than two million distributed denial-of-service (DDoS) attacks that knocked countless Internet users and websites offline, each have been sentenced to six months of community service by an Israeli court.</p>
<div id="attachment_36386" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/6a56208c.vdosloggedin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/09/vdosloggedin.png"><img aria-describedby="caption-attachment-36386" class="wp-image-36386" src="media/6a56208c.vdosloggedin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/09/vdosloggedin.png" alt="" width="596" height="416" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/09/vdosloggedin.png 877w, https://krebsonsecurity.com/wp-content/uploads/2016/09/vdosloggedin-580x405.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/09/vdosloggedin-768x536.png 768w" sizes="(max-width: 596px) 100vw, 596px" /></a><p id="caption-attachment-36386" class="wp-caption-text">vDOS as it existed on Sept. 8, 2016.</p></div>
<p>A judge in Israel handed down the sentences plus fines and probation against <strong>Yarden Bidani</strong> and <strong>Itay Huri</strong>, both Israeli citizens arrested in 2016 at age 18 in connection with an FBI investigation into vDOS.</p>
<p>Until it was shuttered in 2016, vDOS was by far the most reliable and powerful DDoS-for-hire or &#8220;booter&#8221; service on the market, allowing even completely unskilled Internet users to launch crippling assaults capable of knocking most websites offline.</p>
<p>vDOS advertised the ability to launch attacks at up to 50 gigabits of data per second (Gbps) &#8212; well more than enough to take out any site that isn&#8217;t fortified with expensive anti-DDoS protection services. That&#8217;s roughly the equivalent of trying to cram three high-definition Netflix movies down a target&#8217;s network pipe all at the same moment.</p>
<p>The Hebrew-language <a href="media/7a5956a3.16419-08-17.pdf" data-original-source="https://www.gov.il/BlobFolder/dynamiccollectorresultitem/decision16419-08-17/he/16419-08-17.pdf" target="_blank" rel="noopener noreferrer">sentencing memorandum</a> (PDF) has redacted the names of the defendants, but there are more than enough clues in the document to ascertain the identities of the accused. For example, it says the two men earned a little more than $600,000 running vDOS, a fact first reported by this site in September 2016 just prior to their arrest, when <a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank" rel="noopener noreferrer">vDOS was hacked</a> and KrebsOnSecurity obtained a copy of its user database.</p>
<p>In addition, the document says the defendants were initially apprehended on September 8, 2016, arrests which were <a href="https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/" target="_blank" rel="noopener noreferrer">documented here two days later</a>.</p>
<p>Also, the sentencing mentions the supporting role of a U.S. resident named only as &#8220;Jesse.&#8221; This likely refers to 23-year-old <strong>Jesse Wu</strong>, who KrebsOnSecurity <a href="https://krebsonsecurity.com/2016/10/spreading-the-ddos-disease-and-selling-the-cure/" target="_blank" rel="noopener noreferrer">noted in October 2016</a> pseudonymously registered the U.K. shell company used by vDOS, and ran a tiny domain name registrar called <strong>NameCentral</strong> that vDOS and <a href="media/70d5636d.namecentraldomains.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/10/namecentraldomains.pdf" target="_blank" rel="noopener noreferrer">many other booter services employed</a>.</p>
<p>Israeli prosecutors say Wu also <a href="https://krebsonsecurity.com/2017/06/following-the-money-hobbled-vdos-attack-for-hire-service/" target="_blank" rel="noopener noreferrer">set up their payment infrastructure</a>, and received 15 percent of vDOS&#8217;s total revenue for his trouble. NameCentral no longer appears to be in business, and Wu could not be reached for comment.</p>
<p>Although it is clear Bidani and Huri are defendants in this case, it is less clear which is referenced as Defendant #1 or Defendant #2. Both were convicted of &#8220;corrupting/disturbing a computer or computer material,&#8221; charges that the judge said had little precedent in Israeli courts, noting that &#8220;cases of this kind have not been discussed in court so far.&#8221; Defendant #1 also was convicted of sharing nude pictures of a 14 year old girl.<span id="more-51904"></span></p>
<p>vDOS also sold API access to their backend attack infrastructure to other booter services to further monetize their excess firepower, including Vstress, Ustress, and <a href="https://krebsonsecurity.com/2016/10/feds-charge-two-in-lizard-squad-investigation/" target="_blank" rel="noopener noreferrer">PoodleStresser and LizardStresser.</a></p>
<div id="attachment_36294" style="width: 260px" class="wp-caption alignleft"><img aria-describedby="caption-attachment-36294" class=" wp-image-36294" src="media/d5eabcbe.yardbid.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/09/yardbid.png" alt="" width="250" height="276" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/09/yardbid.png 800w, https://krebsonsecurity.com/wp-content/uploads/2016/09/yardbid-580x639.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/09/yardbid-768x847.png 768w" sizes="(max-width: 250px) 100vw, 250px" /><p id="caption-attachment-36294" class="wp-caption-text">Yarden Bidani. Image: Facebook.</p></div>
<p>Both defendants received the lowest possible sentence (the maximum was two years in prison) &#8212; six months of community service under the watch of the Israeli prison service &#8212; mainly because the accused were minors during the bulk of their offenses. The judge also imposed small fines on each, noting that more than $175,000 dollars worth of profits had already been seized from their booter business.</p>
<p>The judge observed that while Defendant #2 had shown remorse for his crimes and an understanding of how his actions affected others &#8212; even sobbing throughout one court proceeding &#8212; Defendant #1 failed to participate in the therapy sessions previously ordered by the court, and that he has &#8220;a clear and daunting boundary for recurrence of further offenses in the future.&#8221;</p>
<p><strong>Boaz Dolev</strong>, CEO of <a href="https://www.clearskysec.com" target="_blank" rel="noopener noreferrer">ClearSky Cyber Security</a>, said he&#8217;s disappointed in the lightness of the sentences given how much damage the young men caused.</p>
<p>&#8220;I think that such an operation that caused big damage to so many companies should have been dealt differently by the Israeli justice system,&#8221; Dolev said. &#8220;The fact that they were under 18 when committing their crimes saved them from much harder sentences.&#8221;</p>
<p>While DDoS attacks typically target a single website or Internet host, they often result in widespread collateral Internet disruption. Less than two weeks after the 2016 arrest of Bidani and Huri, KrebsOnSecurity.com <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank" rel="noopener noreferrer">suffered a three-day outage</a> as a result of <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank" rel="noopener noreferrer">a record 620 Gbps attack</a> that was <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank" rel="noopener noreferrer">alleged to have been purchased in retribution</a> for my reporting on vDOS. That attack caused stability issues for other companies using the same DDoS protection firm my site enjoyed at the time, so much so that the provider <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank" rel="noopener noreferrer">terminated my service</a> with them shortly thereafter.</p>
<p>To say that vDOS was responsible for a majority of the DDoS attacks clogging up the Internet between 2012 and 2016 would be an understatement. The various subscription packages for the service were sold based in part on how many seconds the denial-of-service attack would last. And in just four months between April and July 2016, vDOS was responsible for launching more than 277 million seconds of attack time, or approximately 8.81 years worth of attack traffic.</p>
<p>It seems likely vDOS was responsible for several decades worth of DDoS years, but it&#8217;s impossible to say for sure because vDOS&#8217;s owners routinely wiped attack data from their servers.</p>
<p>Prosecutors in the United States and United Kingdom have in recent years sought tough sentences for those convicted of running booter services. While a number of  current charges against alleged offenders have not yet been fully adjudicated, only a handful of defendants in these cases have seen real jail time.</p>
<p>The two men <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank" rel="noopener noreferrer">responsible</a> for creating and <a href="https://krebsonsecurity.com/?s=mirai&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">unleashing the Mirai botnet</a> (the same duo responsible for building the massive crime machine that knocked my site offline in 2016) each <a href="https://krebsonsecurity.com/2018/10/mirai-co-author-gets-6-months-confinement-8-6m-in-fines-for-rutgers-attacks/" target="_blank" rel="noopener noreferrer">avoided jail time</a> thanks to their considerable cooperation with the FBI.</p>
<p>Likewise, Pennsylvania resident <strong>David Bukoski</strong> recently <a href="https://krebsonsecurity.com/2020/02/booter-boss-busted-by-bacon-pizza-buy/" target="_blank" rel="noopener noreferrer">got five years probation</a> and six months of &#8220;community confinement&#8221; after pleading guilty to running the <strong>Quantum Stresser</strong> booter service. <a href="https://krebsonsecurity.com/?s=lizard+squad&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">Lizard Squad</a> member and PoodleStresser operator <strong>Zachary Buchta</strong> was <a href="https://www.chicagotribune.com/news/breaking/ct-met-hacker-zachary-buchta-sentenced-20180327-story.html" target="_blank" rel="noopener noreferrer">sentenced</a> to three months in prison and ordered to pay $350,000 in restitution for his role in running various booter services.</p>
<p>On the other end of the spectrum, last November 21-year-old Illinois resident <strong>Sergiy Usatyuk</strong> was <a href="https://krebsonsecurity.com/2019/11/ddos-for-hire-boss-gets-13-months-jail-time/" target="_blank" rel="noopener noreferrer">sentenced to 13 months in jail</a> for running multiple booter services that launched millions of attacks over several years. And a 20-year-old U.K. resident in 2017 got <a href="https://krebsonsecurity.com/2017/04/uk-man-gets-two-years-in-jail-for-running-titanium-stresser-attack-for-hire-service/" target="_blank" rel="noopener noreferrer">two years in prison</a> for operating the <strong>Titanium Stresser</strong> service.</p>
<p>For their part, authorities in the U.K. have sought to discourage would-be customers of these booter services <a href="https://krebsonsecurity.com/2020/05/uk-ad-campaign-seeks-to-deter-cybercrime/" target="_blank" rel="noopener noreferrer">by purchasing Google ads warning that such services are illegal</a>. The goal is to steer customers away from committing further offenses that could land them in jail, and toward more productive uses of their skills and/or curiosity about cybersecurity.</p>


feed_id: https://krebsonsecurity.com/?p=51926
title: Florence, Ala. Hit By Ransomware 12 Days After Being Alerted by KrebsOnSecurity
uri: Florence-Ala-Hit-By-Ransomware-12-Days-After-Being-Alerted-by-KrebsO
url:
https://krebsonsecurity.com/2020/06/florence-ala-hit-by-ransomware-12-days-after-being-alerted-by-krebsonsecurity/

content:
<p>In late May, KrebsOnSecurity alerted numerous officials in <strong>Florence, Ala.</strong> that their information technology systems had been infiltrated by hackers who specialize in deploying ransomware. Nevertheless, on Friday, June 5, the intruders sprang their attack, deploying ransomware and demanding nearly $300,000 worth of bitcoin. City officials now say they plan to pay the ransom demand, in hopes of keeping the personal data of their citizens off of the Internet.</p>
<p>Nestled in the northwest corner of Alabama, Florence is home to roughly 40,000 residents. It is part of a quad-city metropolitan area perhaps best known for the <a href="https://en.wikipedia.org/wiki/Muscle_Shoals_Sound_Studio" target="_blank" rel="noopener noreferrer">Muscle Shoals Sound Studio</a> that recorded the dulcet tones of many big-name music acts in the 1960s and 70s.</p>
<div id="attachment_51937" style="width: 608px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-51937" class=" wp-image-51937" src="media/adf935db.florence.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/florence.png" alt="" width="598" height="206" /><p id="caption-attachment-51937" class="wp-caption-text">Image: Florenceal.org</p></div>
<p>On May 26, acting on a tip from Milwaukee, Wisc.-based cybersecurity firm <a href="https://www.holdsecurity.com" target="_blank" rel="noopener noreferrer">Hold Security</a>, KrebsOnSecurity contacted the office of Florence&#8217;s mayor to alert them that a Windows 10 system in their IT environment had been commandeered by a ransomware gang.</p>
<p>Comparing the information shared by Hold Security dark web specialist <strong>Yuliana Bellini</strong> with the employee directory on the Florence website indicated the username for the computer that attackers had used to gain a foothold in the network on May 6 <em>belonged to the city&#8217;s manager of information systems</em>.</p>
<p>My call was transferred to no fewer than three different people, none of whom seemed eager to act on the information. Eventually, I was routed to the non-emergency line for the Florence police department. When that call went straight to voicemail, I left a message and called the city&#8217;s emergency response team.</p>
<p>That last effort prompted a gracious return call the following day from a system administrator for the city, who thanked me for the heads up and said he and his colleagues had isolated the computer and Windows network account Hold Security flagged as hacked.</p>
<p>&#8220;I can&#8217;t tell you how grateful we are that you helped us dodge this bullet,&#8221; the technician said in a voicemail message for this author. &#8220;We got everything taken care of now, and some different protocols are in place. Hopefully we won&#8217;t have another near scare like we did, and hopefully we won&#8217;t have to talk to each other again.&#8221;</p>
<p>But on Friday, <strong>Florence Mayor Steve Holt</strong> <a href="https://www.timesdaily.com/news/city-of-florence-computer-system-hit-with-cyber-attack/article_41db8bf6-144b-5ad1-b9ca-59e5568a2bdf.html" target="_blank" rel="noopener noreferrer">confirmed</a> that a cyberattack had shut down the city&#8217;s email system. Holt told local news outlets at the time there wasn&#8217;t any indication that ransomware was involved.</p>
<p>However, in an interview with KrebsOnSecurity Tuesday, Holt acknowledged the city was being extorted by <a href="https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/" target="_blank" rel="noopener noreferrer">DoppelPaymer</a>, a ransomware gang with a reputation for negotiating some of the highest extortion payments across dozens of known ransomware families.</p>
<div id="attachment_51935" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/fffe3a75.raas-avgprice.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/raas-avgprice.png"><img aria-describedby="caption-attachment-51935" class="wp-image-51935" src="media/fffe3a75.raas-avgprice.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/raas-avgprice.png" alt="" width="596" height="386" /></a><p id="caption-attachment-51935" class="wp-caption-text">The average ransomware payment by ransomware strain. Source: Chainalysis.</p></div>
<p>Holt said the same gang appears to have simultaneously compromised networks belonging to four other victims within an hour of Florence, including another municipality that he declined to name. Holt said the extortionists initially demanded 39 bitcoin (~USD $378,000), but that an outside security firm hired by the city had negotiated the price down to 30 bitcoin (~USD $291,000).</p>
<p>Like many other cybercrime gangs operating these days, DoppelPaymer will steal reams of data from victims prior to launching the ransomware, and then threaten to publish or sell the data unless a ransom demand is paid.</p>
<p>Holt told KrebsOnSecurity the city can&#8217;t afford to see its citizens&#8217; personal and financial data jeopardized by not paying.</p>
<p>&#8220;Do they have our stuff? We don&#8217;t know, but that&#8217;s the roll of the dice,&#8221; Holt said. <span id="more-51926"></span></p>
<p><strong>Steve Price</strong>, the Florence IT manager whose Microsoft Windows credentials were stolen on May 6 by a DHL-themed phishing attack and used to further compromise the city&#8217;s network, explained that following my notification on May 26 the city immediately took a number of preventative measures to stave off a potential ransomware incident. Price said that when the ransomware hit, they were in the middle of trying to get city leaders to approve funds for a more thorough investigation and remediation.</p>
<p>&#8220;We were trying to get another [cybersecurity] response company involved, and that&#8217;s what we were trying to get through the city council on Friday when we got hit,&#8221; Price said. &#8220;We feel like we can build our network back, but we can&#8217;t undo things if peoples&#8217; personal information is released.&#8221;</p>
<div id="attachment_51936" style="width: 603px" class="wp-caption aligncenter"><a class="lightbox" href="media/1a39c2b4.doppelransom.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/doppelransom.png"><img aria-describedby="caption-attachment-51936" class="wp-image-51936" src="media/1a39c2b4.doppelransom.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/doppelransom.png" alt="" width="593" height="465" /></a><p id="caption-attachment-51936" class="wp-caption-text">A DoppelPaymer ransom note. Image: Crowdstrike.</p></div>
<p><strong>Fabian Wosar</strong>, chief technology officer at <a href="https://www.emsisoft.com" target="_blank" rel="noopener noreferrer">Emsisoft</a>, said organizations need to understand that the only step which guarantees a malware infestation won&#8217;t turn into a full-on ransomware attack is completely rebuilding the compromised network &#8212; including email systems.</p>
<p><span class="pullquote pqleft">&#8220;There is a misguided belief that if you were compromised you can get away with anything but a complete rebuild of the affected networks and infrastructure,&#8221; Wosar said</span>, noting that it&#8217;s not uncommon for threat actors to maintain control even as a ransomware victim organization is restoring their systems from backups.</p>
<p>&#8220;They often even demonstrate that they still &#8216;own&#8217; the network by publishing screenshots of messages talking about the incident,&#8221; Wosar said.</p>
<p>Hold Security founder <strong>Alex Holden</strong> said Florence&#8217;s situation is all too common, and that very often ransomware purveyors are inside a victim&#8217;s network for weeks or months before launching their malware.</p>
<p>&#8220;We often get glimpses of the bad guys beginning their assaults against computer networks and we do our best to let the victims know about the attack,&#8221; Holden said. &#8220;Since we can&#8217;t see every aspect of the attack we advise victims to conduct a full investigation of the events, based on the evidence collected. But when we deal with sensitive situations like ransomware, timing and precision are critical. If the victim will listen and seek out expert opinions, they have a great chance of successfully stopping the breach before it turns into ransom.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=51948
title: Microsoft Patch Tuesday, June 2020 Edition
uri: Microsoft-Patch-Tuesday-June-2020-Edition
url: https://krebsonsecurity.com/2020/06/microsoft-patch-tuesday-june-2020-edition/
content:
<p><strong>Microsoft</strong> today released software patches to plug at least 129 security holes in its <strong>Windows</strong> operating systems and supported software, by some accounts a record number of fixes in one go for the software giant. None of the bugs addressed this month are known to have been exploited or detailed prior to today, but there are a few vulnerabilities that deserve special attention &#8212; particularly for enterprises and employees working remotely.</p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />June marks the fourth month in a row that Microsoft has issued fixes to address more than 100 security flaws in its products. Eleven of the updates address problems Microsoft deems &#8220;critical,&#8221; meaning they could be exploited by malware or malcontents to seize complete, remote control over vulnerable systems without any help from users.</p>
<p>A chief concern among the panoply of patches is a trio of vulnerabilities in the Windows file-sharing technology (a.k.a. Microsoft Server Message Block or &#8220;SMB&#8221; service). Perhaps most troubling of these (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1301" target="_blank" rel="noopener noreferrer">CVE-2020-1301</a>) is a remote code execution bug in SMB capabilities built into <strong>Windows 7</strong> and <strong>Windows 2008</strong> systems &#8212; both operating systems that Microsoft stopped supporting with security updates in January 2020. One mitigating factor with this flaw is that an attacker would need to be already authenticated on the network to exploit it, according to security experts at <strong>Tenable</strong>.</p>
<p>The SMB fixes follow closely on <a href="https://arstechnica.com/information-technology/2020/06/exploiting-wormable-flaw-on-unpatched-windows-devices-is-about-to-get-easier/" target="_blank" rel="noopener noreferrer">news that proof-of-concept code was published this week</a> that would allow anyone to exploit a critical SMB flaw Microsoft patched for <strong>Windows 10</strong> systems in March (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796" target="_blank" rel="noopener noreferrer">CVE-2020-0796</a>). Unlike this month&#8217;s critical SMB bugs, CVE-2020-0796 does not require the attacker to be authenticated to the target&#8217;s network. And with countless company employees now working remotely, Windows 10 users who have not yet applied updates from March or later could be dangerously exposed right now.<span id="more-51948"></span></p>
<p><strong>Microsoft Office</strong> and <strong>Excel</strong> get several updates this month. Two different flaws in Excel (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1225" target="_blank" rel="noopener noreferrer">CVE-2020-1225</a> and <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1226" target="_blank" rel="noopener noreferrer">CVE-2020-1226</a>) could be used to remotely commandeer a computer running Office just by getting a user to open a booby-trapped document. Another weakness (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1229" target="_blank" rel="noopener noreferrer">CVE-2020-1229</a>) in most versions of Office may be exploited to bypass security features in Office simply by previewing a malicious document in the preview pane. This flaw also impacts <strong>Office for Mac</strong>, although updates are not yet available for that platform.</p>
<p>After months of giving us a welcome break from patching, <strong>Adobe</strong> has issued <a href="https://helpx.adobe.com/security/products/flash-player/apsb20-30.html" target="_blank" rel="noopener noreferrer">an update</a> for its <strong>Flash Player</strong> program that fixes a single, albeit critical security problem. Adobe says it is not aware of any active exploits against the Flash flaw. Mercifully, <strong>Chrome</strong> and <strong>Firefox</strong> both now disable Flash by default, and Chrome and <strong>IE/Edg</strong>e auto-update the program when new security updates are available. Adobe is slated to retire Flash Player later this year. Adobe also released security updates for its <a href="https://helpx.adobe.com/security/products/experience-manager/apsb20-31.html" target="_blank" rel="noopener noreferrer">Experience Manager</a> and <a href="https://helpx.adobe.com/security/products/framemaker/apsb20-32.html" target="_blank" rel="noopener noreferrer">Framemaker products</a>.</p>
<p>Windows 7 users should be aware by now that while a fair number of flaws addressed this month by Microsoft affect Windows 7 systems, this operating system is no longer being supported with security updates (unless you’re an enterprise taking advantage of Microsoft’s <a href="https://support.microsoft.com/en-us/help/4527878/faq-about-extended-security-updates-for-windows-7" target="_blank" rel="noopener noreferrer">paid extended security updates program</a>, which is available to Windows 7 Professional and Windows 7 enterprise users).</p>
<p>Before you update with this month&#8217;s patch batch, please make sure you have backed up your system and/or important files. It&#8217;s not uncommon for a wonky Windows update to hose one&#8217;s system or prevent it from booting properly, and some updates even have known to erase or corrupt files. So do yourself a favor and backup <em>before</em> installing any patches. Windows 10 even has <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">some built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, see <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">this guide</a>.</p>
<p>As always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips.</p>
<p>Further reading:</p>
<p><a href="https://www.askwoody.com/" target="_blank" rel="noopener noreferrer">AskWoody</a> and <a href="https://www.ghacks.net/2020/06/09/microsoft-windows-security-updates-june-2020-overview/" target="_blank" rel="noopener noreferrer">Martin Brinkmann</a> on Patch Tuesday fixes and potential pitfalls</p>
<p><a href="https://www.zerodayinitiative.com/blog/2020/6/9/the-june-2020-security-update-review" target="_blank" rel="noopener noreferrer">Trend Micro&#8217;s Zero Day Initiative June 2020 patch lowdown</a></p>
<p><a href="https://www.us-cert.gov/ncas/current-activity/2020/06/05/unpatched-microsoft-systems-vulnerable-cve-2020-0796" target="_blank" rel="noopener noreferrer">U.S-CERT on Active Exploitation of CVE-2020-0796</a></p>


feed_id: https://krebsonsecurity.com/?p=51956
title: Privnotes.com Is Phishing Bitcoin from Users of Private Messaging Service Privnote.com
uri: Privnotes-com-Is-Phishing-Bitcoin-from-Users-of-Private-Messaging-Serv
url:
https://krebsonsecurity.com/2020/06/privnotes-com-is-phishing-bitcoin-from-users-of-private-messaging-service-privnote-com/

content:
<p>For the past year, a site called <strong>Privnotes.com</strong> has been impersonating <strong>Privnote.com</strong>, a legitimate, free service that offers private, encrypted messages which self-destruct automatically after they are read. Until recently, I couldn&#8217;t quite work out what Privnotes was up to, but today it became crystal clear: Any messages containing bitcoin addresses will be automatically altered to include a different bitcoin address, as long as the Internet addresses of the sender and receiver of the message are not the same.</p>
<p>Earlier this year, KrebsOnSecurity heard from the owners of Privnote.com, who complained that someone had set up a fake clone of their site that was fooling quite a few regular users of the service.</p>
<p>And it&#8217;s not hard to see why: Privnotes.com is confusingly similar in name and appearance to the real thing, and comes up second in Google search results for the term &#8220;privnote.&#8221; Also, anyone who mistakenly types &#8220;privnotes&#8221; into Google search may see at the top of the results a misleading paid ad for &#8220;Privnote&#8221; that actually leads to privnotes.com.</p>
<div id="attachment_51963" style="width: 605px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-51963" class=" wp-image-51963" src="media/7fef70f1.privnotes.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/privnotes.png" alt="" width="595" height="482" /><p id="caption-attachment-51963" class="wp-caption-text">A Google search for the term &#8220;privnotes&#8221; brings up a misleading paid ad for the phishing site privnotes.com, which is listed above the legitimate site &#8212; privnote.com.</p></div>
<p>Privnote.com (the legit service) employs technology that encrypts all messages so that even Privnote itself <a href="https://privnote.com/info/privacy" target="_blank" rel="noopener noreferrer">cannot read the contents of the message</a>. And it doesn&#8217;t send and receive messages. Creating a message merely generates a link. When that link is clicked or visited, the service warns that the message will be gone forever after it is read.</p>
<p>But according to the owners of Privnote.com, the phishing site Privnotes.com does not fully implement encryption, and can read and/or modify all messages sent by users.</p>
<p>&#8220;It is very simple to check that the note in privnoteS is sent unencrypted in plain text,&#8221; Privnote.com explained in a February 2020 message, responding to inquiries from KrebsOnSecurity. &#8220;Moreover, it doesn&#8217;t enforce any kind of decryption key when opening a note and the key after # in the URL can be replaced by arbitrary characters and the note will still open.&#8221;</p>
<p>But that&#8217;s not the half of it. KrebsOnSecurity has learned that <em>the phishing site Privnotes.com uses some kind of automated script that scours messages for bitcoin addresses, and replaces any bitcoin addresses found with its own bitcoin address</em>. The script apparently only modifies messages if the note is opened from a different Internet address than the one that composed the address.</p>
<p>Here&#8217;s an example, using the bitcoin wallet address <a href="https://en.bitcoin.it/wiki/Address" target="_blank" rel="noopener noreferrer">from bitcoin&#8217;s Wikipedia page</a> as an example. The following message was composed at Privnotes.com from a computer with an Internet address in New York, with the message, &#8220;please send money to bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq thanks&#8221;:</p>
<div id="attachment_51960" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/39509708.privnotes-original.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/privnotes-original.png"><img aria-describedby="caption-attachment-51960" class="wp-image-51960" src="media/39509708.privnotes-original.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/privnotes-original.png" alt="" width="596" height="350" /></a><p id="caption-attachment-51960" class="wp-caption-text">A test message composed on privnotes.com, which is phishing users of the legitimate encrypted message service privnote.com. Pay special attention to the bitcoin address in this message.</p></div>
<p>When I visited the Privnotes.com link generated by clicking the &#8220;create note&#8221; button on the above page from a different computer with an Internet address in California, this was the result. As you can see, it lists a different bitcoin address, albeit one with the same first four characters the same.</p>
<div id="attachment_51961" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/a25f441d.privnotes-alt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/privnotes-alt.png"><img aria-describedby="caption-attachment-51961" class="wp-image-51961" src="media/a25f441d.privnotes-alt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/privnotes-alt.png" alt="" width="597" height="432" /></a><p id="caption-attachment-51961" class="wp-caption-text">The altered message. Notice the bitcoin address has been modified and is not the same address that was sent in the original note.</p></div>
<p>Several other tests confirmed that the bitcoin modifying script does not seem to change message contents if the sender and receiver&#8217;s IP addresses are the same, or if one composes multiple notes with the same bitcoin address in it.<span id="more-51956"></span></p>
<p><strong>Allison Nixon</strong>, the security expert who helped me with this testing, said the script also only seems to replace the first instance of a bitcoin address if it&#8217;s repeated within a message, and the site stops replacing a wallet address if it is sent repeatedly over multiple messages.</p>
<p>&#8220;And because of the design of the site, the sender won&#8217;t be able to view the message because it self destructs after one open, and the type of people using privnote aren&#8217;t the type of people who are going to send that bitcoin wallet any other way for verification purposes,&#8221; said Nixon, who is chief research officer at <a href="https://unit221b.com/" target="_blank" rel="noopener noreferrer">Unit 221B</a>. &#8220;It&#8217;s a pretty smart scam.&#8221;</p>
<p>Given that Privnotes.com is phishing bitcoin users, it&#8217;s a fair bet the phony service also is siphoning other sensitive data from people who use their site.</p>
<p>&#8220;So if there are password dumps in the message, they would be able to read that, too,&#8221; Nixon said. &#8220;At first, I thought that was their whole angle, just to siphon data. But the bitcoin wallet replacement is probably much closer to the main motivation for running the fake site.&#8221;</p>
<p>Even if you never use or plan to use the legitimate encrypted message service Privnote.com, this scam is a great reminder why it pays to be extra careful about using search engines to find sites that you plan to entrust with sensitive data. A far better approach is to bookmark such sites, and rely exclusively on those instead.</p>


feed_id: https://krebsonsecurity.com/?p=51981
title: When Security Takes a Backseat to Productivity
uri: When-Security-Takes-a-Backseat-to-Productivity
url: https://krebsonsecurity.com/2020/06/when-security-takes-a-backseat-to-productivity/
content:
<p style="text-align: center;"><em>&#8220;We must care as much about securing our systems as we care about running them if we are to make the necessary revolutionary change.&#8221; -CIA&#8217;s Wikileaks Task Force. </em></p>
<p>So ends a key section of a report the <strong>U.S. Central Intelligence Agency</strong> produced in the wake of a mammoth data breach in 2016 that led to <strong>Wikileaks</strong> publishing thousands of classified documents stolen from the agency&#8217;s offensive cyber operations division. The analysis highlights a shocking series of security failures at one of the world&#8217;s most secretive organizations, but the underlying weaknesses that gave rise to the breach also unfortunately are all too common in many organizations today.</p>
<p><img class="aligncenter wp-image-51989" src="media/02805217.intelbrief.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/intelbrief.png" alt="" width="598" height="335" /></p>
<p>The CIA produced the report in October 2017, roughly seven months after Wikileaks began publishing <a href="https://en.wikipedia.org/wiki/Vault_7" target="_blank" rel="noopener noreferrer">Vault 7</a> &#8212; reams of classified data detailing the CIA&#8217;s capabilities to perform electronic surveillance and cyber warfare. But the report&#8217;s contents remained shrouded from public view until earlier this week, when heavily redacted portions of it were included in a letter by <strong>Sen. Ron Wyden </strong>(D-Ore.) to the Director of National Intelligence.</p>
<p>The CIA acknowledged its security processes were so &#8220;woefully lax&#8221; that the agency probably would never have known about the data theft had Wikileaks not published the stolen documents online. What kind of security failures created an environment that allegedly allowed a former CIA employee to exfiltrate so much sensitive data? Here are a few, in no particular order:</p>
<ul>
<li>Failing to rapidly detect security incidents.</li>
<li>Failing to act on warning signs about potentially risky employees.</li>
<li>Moving too slowly to enact key security safeguards.</li>
<li>A lack of user activity monitoring or robust server audit capability.</li>
<li>No effective removable media controls.</li>
<li>No single person empowered to ensure IT systems are built and maintained securely throughout their lifecycle.</li>
<li>Historical data available to all users indefinitely.</li>
</ul>
<p>Substitute the phrase &#8220;cyber weapons&#8221; with &#8220;productivity&#8221; or just &#8220;IT systems&#8221; in the CIA&#8217;s report and you might be reading the post-mortem produced by a security firm hired to help a company recover from a highly damaging data breach.</p>
<div id="attachment_51988" style="width: 609px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-51988" class=" wp-image-51988" src="media/64e93438.cia-intelbrief.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/cia-intelbrief.png" alt="" width="599" height="699" /><p id="caption-attachment-51988" class="wp-caption-text">A redacted portion of the CIA&#8217;s report on the Wikileaks breach.</p></div>
<p><span id="more-51981"></span></p>
<h4>DIVIDED WE STAND, UNITED WE FALL</h4>
<p>A key phrase in the CIA&#8217;s report references deficiencies in &#8220;compartmentalizing&#8221; cybersecurity risk. At a high level (not necessarily specific to the CIA), compartmentalizing IT environments involves important concepts such as:</p>
<ul>
<li>Segmenting one&#8217;s network so that malware infections or breaches in one part of the network can&#8217;t spill over into other areas.</li>
<li>Not allowing multiple users to share administrative-level passwords</li>
<li>Developing baselines for user and network activity so that deviations from the norm stand out more prominently.</li>
<li>Continuously inventorying, auditing, logging and monitoring all devices and user accounts connected to the organization&#8217;s IT network.</li>
</ul>
<p>&#8220;The Agency for years has developed and operated IT mission systems outside the purview and governance of enterprise IT, citing the need for mission functionality and speed,&#8221; the CIA observed. &#8220;While often fulfilling a valid purpose, this &#8216;shadow IT&#8217; exemplifies a broader cultural issue that separates enterprise IT from mission IT, has allowed mission system owners to determine how or if they will police themselves.&#8221;</p>
<p>All organizations experience intrusions, security failures and oversights of key weaknesses. In large enough enterprises, these failures likely happen multiple times each day. But by far the biggest factor that allows small intrusions to morph into a full-on data breach is a lack of ability to quickly detect and respond to security incidents.</p>
<p>Also, because employees tend to be the most abundant security weakness in any organization, instituting some kind of continuing security awareness training for all employees is a good idea. Some security experts I know and respect dismiss security awareness programs as a waste of time and money, observing that no matter how much training a company does, there will always be some percentage of users who will click on anything.</p>
<p>That may or may not be accurate, but even if it is, at least the organization then has a much better idea which employees probably need more granular security controls (i.e. more compartmentalizing) to keep them from becoming a serious security liability.</p>
<p><a href="media/aba29c3c.wyden-cybersecurity-lapses-letter-to-dni.pdf" data-original-source="https://www.wyden.senate.gov/imo/media/doc/wyden-cybersecurity-lapses-letter-to-dni.pdf" target="_blank" rel="noopener noreferrer">Sen. Wyden&#8217;s letter</a> (PDF), first reported on by <a href="https://www.washingtonpost.com/national-security/elite-cia-unit-that-developed-hacking-tools-failed-to-secure-its-own-systems-allowing-massive-leak-an-internal-report-found/2020/06/15/502e3456-ae9d-11ea-8f56-63f38c990077_story.html" target="_blank" rel="noopener noreferrer"><em>The Washington Post</em></a>, is worth reading because it points to a series of continuing security weaknesses at the CIA, many of which have already been addressed by other federal agencies, including <a href="https://krebsonsecurity.com/2019/02/a-deep-dive-on-the-recent-widespread-dns-hijacking-attacks/" target="_blank" rel="noopener noreferrer">multi-factor authentication for domain names</a> and access to classified/sensitive systems, and <a href="https://krebsonsecurity.com/2016/07/trump-dnc-rnc-flunk-email-security-test/" target="_blank" rel="noopener noreferrer">anti-spam protections like DMARC</a>.</p>


feed_id: https://krebsonsecurity.com/?p=52007
title: FEMA IT Specialist Charged in ID Theft, Tax Refund Fraud Conspiracy
uri: FEMA-IT-Specialist-Charged-in-ID-Theft-Tax-Refund-Fraud-Conspiracy
url:
https://krebsonsecurity.com/2020/06/fema-it-specialist-charged-in-id-theft-tax-refund-fraud-conspiracy/

content:
<p>An information technology specialist at the <strong>Federal Emergency Management Agency</strong> (FEMA) was arrested this week on suspicion of hacking into the human resource databases of <strong>University of Pittsburgh Medical Center</strong> (UPMC) in 2014, stealing personal data on more than 65,000 UPMC employees, and selling the data on the dark web.</p>
<p><img class="alignright wp-image-25751" src="media/018adfd9.taxfraud.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud.jpg" alt="" width="249" height="249" srcset="https://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud.jpg 693w, https://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-150x150.jpg 150w, https://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-285x285.jpg 285w, https://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-600x600.jpg 600w" sizes="(max-width: 249px) 100vw, 249px" />On June 16, authorities in Michigan arrested 29-year-old <strong>Justin Sean Johnson</strong> in connection with a 43-count indictment on charges of conspiracy, wire fraud and aggravated identity theft.</p>
<p>Federal prosecutors in Pittsburgh allege that in 2013 and 2014 Johnson hacked into the <strong>Oracle PeopleSoft</strong> databases for UPMC, a $21 billion nonprofit health enterprise that includes more than 40 hospitals.</p>
<p>According to the indictment, Johnson stole employee information on all 65,000 then current and former employees, including their names, dates of birth, Social Security numbers, and salaries.</p>
<p>The stolen data also included federal form W-2 data that contained income tax and withholding information, records that prosecutors say Johnson sold on dark web marketplaces to <a href="https://krebsonsecurity.com/category/tax-refund-fraud/" target="_blank" rel="noopener noreferrer">identity thieves engaged in tax refund fraud</a> and other financial crimes. The fraudulent tax refund claims made in the names of UPMC identity theft victims caused the IRS to issue $1.7 million in phony refunds in 2014.</p>
<p>Johnson could not be reached for comment. At a court hearing in Pittsburgh this week, a judge ordered the defendant to be detained pending trial. Johnson&#8217;s attorney declined to comment on the charges.</p>
<p>Prosecutors allege Johnson&#8217;s intrusion into UPMC was not an isolated occurrence, and that for several years after the UPMC hack he sold personally identifiable information (PII) to buyers on dark web forums.</p>
<p>&#8220;The information was sold by Johnson on dark web forums for use by conspirators, who promptly filed hundreds of false form 1040 tax returns in 2014 using UPMC employee PII,&#8221; reads <a href="https://www.justice.gov/usao-wdpa/pr/michigan-man-arrested-2014-hack-upmc-hr-databases-and-theft-employees-personal" target="_blank" rel="noopener noreferrer">a statement</a> from <strong>U.S. Attorney Scott Brady</strong>. &#8220;These false 1040 filings claimed hundreds of thousands of dollars of false tax refunds, which they converted into Amazon.com gift cards, which were then used to purchase Amazon merchandise which was shipped to Venezuela.&#8221;</p>
<p>The indictment says Johnson used the hacker aliases &#8220;DS and &#8220;TDS&#8221; to market the stolen records to identity thieves on the <a href="https://krebsonsecurity.com/?s=evolution+market&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">Evolution</a> and <a href="https://krebsonsecurity.com/tag/alphabay/" target="_blank" rel="noopener noreferrer">AlphaBay</a> dark web marketplaces. However, archived copies of the now-defunct dark web forums indicate those aliases are merely abbreviations that stand for &#8220;<strong>DearthStar</strong>&#8221; and &#8220;<strong>TheDearthStar</strong>,&#8221; respectively.</p>
<p>&#8220;You can expect good things come tax time as I will have lots of profiles with verified prior year AGIs to make your refund filing 10x easier,&#8221; TheDearthStar advertised in an August 2015 message to AlphaBay members.</p>
<p>In some cases, it appears these DearthStar identities were actively involved in not just selling PII and tax refund fraud, but also stealing directly from corporate payrolls.</p>
<p>In an Aug. 2015 post to AlphaBay titled &#8220;I&#8217;d like to stage a heist but&#8230;,&#8221; TheDearthStar solicited people to help him cash out access he had to the payroll systems of several different companies:</p>
<p>&#8220;&#8230; I have nowhere to send the money. I&#8217;d like to leverage the access I have to payroll systems of a few companies and swipe a chunk of their payroll. Ideally, I&#8217;d like to find somebody who has a network of trusted individuals who can receive ACH deposits.&#8221;</p>
<p>When another AlphaBay member asks how much he can get, TheDearthStar responds, &#8220;Depends on how many people end up having their payroll records &#8216;adjusted.&#8217; Could be $1,000 could be $100,000.&#8221;<span id="more-52007"></span></p>
<p>2014 and 2015 were particularly bad years for tax refund fraud, a form of identity theft which cost taxpayers and the U.S. Treasury billions of dollars. In April 2014, KrebsOnSecurity wrote about <a href="https://krebsonsecurity.com/2014/04/states-spike-in-tax-fraud-against-doctors/" target="_blank" rel="noopener noreferrer">a spike in tax refund fraud perpetrated against medical professionals</a> that caused many to speculate that one or more major healthcare providers had been hacked.</p>
<p>A <a href="https://krebsonsecurity.com/2014/04/tax-fraud-gang-targeted-healthcare-firms/" target="_blank" rel="noopener noreferrer">follow-up story that same month</a> examined the work of a cybercrime gang that was hacking into HR departments at healthcare organizations across the country and filing fraudulent tax refund requests with the IRS on employees of those victim firms.</p>
<p>The Justice Department&#8217;s indictment quotes from Johnson&#8217;s online resume as stating that he is proficient at installing and administering Oracle PeopleSoft systems. A <a href="https://www.linkedin.com/in/jjjjust/" target="_blank" rel="noopener noreferrer">LinkedIn resume for a Justin Johnson</a> from Detroit says the same, and that for the past five months he has served as an information technology specialist at FEMA. A <a href="https://www.facebook.com/photo.php?fbid=4647952157826&amp;set=pb.1263840149.-2207520000..&amp;type=3" target="_blank" rel="noopener noreferrer">Facebook profile</a> with the same photo belongs to a Justin S. Johnson from Detroit.</p>
<p>Johnson&#8217;s resume also says he was self-employed for seven years as a &#8220;cyber security researcher / bug bounty hunter&#8221; who was ranked in the top 1,000 by reputation on <a href="https://hackerone.com/sitemap?first=j" target="_blank" rel="noopener noreferrer">Hacker One</a>, a program that rewards security researchers who find and report vulnerabilities in software and web applications.</p>


feed_id: https://krebsonsecurity.com/?p=51979
title: Turn on MFA Before Crooks Do It For You
uri: Turn-on-MFA-Before-Crooks-Do-It-For-You
url: https://krebsonsecurity.com/2020/06/turn-on-mfa-before-crooks-do-it-for-you/
content:
<p>Hundreds of popular websites now offer some form of <strong>multi-factor authentication</strong> (MFA), which can help users safeguard access to accounts when their password is breached or stolen. But people who don&#8217;t take advantage of these added safeguards may find it far more difficult to regain access when their account gets hacked, because increasingly thieves will enable multi-factor options and tie the account to a device they control. Here&#8217;s the story of one such incident.</p>
<p><img class="aligncenter  wp-image-52028" src="media/96519bd5.mfa.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/mfa.jpg" alt="" width="596" height="298" /></p>
<p>As a career chief privacy officer for different organizations, <strong>Dennis Dayman</strong> has tried to instill in his twin boys the importance of securing their online identities against account takeovers. Both are avid gamers on <strong>Microsoft&#8217;s Xbox</strong> platform, and for years their father managed their accounts via his own Microsoft account. But when the boys turned 18, they converted their child accounts to adult, effectively taking themselves out from under their dad&#8217;s control.</p>
<p>On a recent morning, one of Dayman&#8217;s sons found he could no longer access his Xbox account. The younger Dayman admitted to his dad that he&#8217;d reused his Xbox profile password elsewhere, and that he hadn&#8217;t enabled multi-factor authentication for the account.</p>
<p>When the two of them sat down to reset his password, the screen displayed a notice saying there was a new Gmail address tied to his Xbox account. When they went to turn on multi-factor authentication for his son&#8217;s Xbox profile &#8212; which was tied to a non-Microsoft email address &#8212; the Xbox service said it would send a notification of the change to unauthorized Gmail account in his profile.</p>
<p>Wary of alerting the hackers that they were wise to their intrusion, Dennis tried contacting Microsoft Xbox support, but found he couldn&#8217;t open a support ticket from a non-Microsoft account. Using his other son&#8217;s Outlook account, he filed a ticket about the incident with Microsoft.</p>
<p>Dennis soon learned the unauthorized Gmail address added to his son&#8217;s hacked Xbox account also had enabled MFA. Meaning, his son would be unable to reset the account&#8217;s password without approval from the person in control of the Gmail account.</p>
<p>Luckily for Dayman&#8217;s son, he hadn&#8217;t re-used the same password for the email address tied to his Xbox profile. Nevertheless, the thieves began abusing their access to purchase games on Xbox and third-party sites.</p>
<p>&#8220;During this period, we started realizing that his bank account was being drawn down through purchases of games from Xbox and [Electronic Arts],&#8221; Dayman the elder recalled. &#8220;I pulled the recovery codes for his Xbox account out of the safe, but because the hacker came in and turned on multi-factor, those codes were useless to us.&#8221;</p>
<p>Microsoft support sent Dayman and his son a list of 20 questions to answer about their account, such as the serial number on the Xbox console originally tied to the account when it was created. But despite answering all of those questions successfully, Microsoft refused to let them reset the password, Dayman said.</p>
<p>&#8220;They said their policy was not to turn over accounts to someone who couldn&#8217;t provide the second factor,&#8221; he said.</p>
<p>Dayman&#8217;s case was eventually escalated to Tier 3 Support at Microsoft, which was able to walk him through creating a new Microsoft account, enabling MFA on it, and then migrating his son&#8217;s Xbox profile over to the new account.</p>
<p>Microsoft told KrebsOnSecurity that while users currently are not prompted to enable two-step verification upon sign-up, they always have the option <a href="https://support.microsoft.com/en-us/help/12408/microsoft-account-how-to-use-two-step-verification" target="_blank" rel="noopener noreferrer">to enable the feature</a>.</p>
<p>&#8220;Users are also prompted shortly after account creation to add additional security information if they have not yet done so, which enables the customer to receive security alerts and security promotions when they login to their account,&#8221; the company said in a written statement. &#8220;When we notice an unusual sign-in attempt from a new location or device, we help protect the account by challenging the login and send the user a notification. If a customer’s account is ever compromised, we will take the necessary steps <a href="https://support.microsoft.com/en-us/help/10494/microsoft-account-recover-hacked-compromised-account" target="_blank" rel="noopener noreferrer">to help them recover the account</a>.&#8221;<span id="more-51979"></span></p>
<p>Certainly, not enabling MFA when it is offered is far more of a risk for people in the habit of reusing or recycling passwords across multiple sites. But any service to which you entrust sensitive information can get hacked, and enabling multi-factor authentication is a good hedge against having leaked or stolen credentials used to plunder your account.</p>
<p>What&#8217;s more, a great many online sites and services that do support multi-factor authentication are completely automated and extremely difficult to reach for help when account takeovers occur. This is doubly so if the attackers also can modify and/or remove the original email address associated with the account.</p>
<p>KrebsOnSecurity has long steered readers to the site <a href="https://www.twofactorauth.org" target="_blank" rel="noopener noreferrer">twofactorauth.org</a>, which details the various MFA options offered by popular websites. Currently, twofactorauth.org lists nearly 900 sites that have some form of MFA available. These range from authentication options like <a href="https://searchsecurity.techtarget.com/definition/time-based-one-time-password-TOTP" target="_blank" rel="noopener noreferrer">one-time codes</a> sent via email, phone calls, SMS or mobile app, to more robust, true &#8220;2-factor authentication&#8221; or 2FA options (something you have and something you know), such as <a href="https://krebsonsecurity.com/?s=security+keys&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">security keys</a> or push-based 2FA such as <a href="https://duo.com/" target="_blank" rel="noopener noreferrer">Duo Security</a> (an advertiser on this site and a service I have used for years).</p>
<p>Email, SMS and app-based one-time codes are considered less robust from a security perspective because they can be undermined by a variety of well-established attack scenarios, from <a href="https://krebsonsecurity.com/?s=sim+swap&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">SIM-swapping</a> to mobile-based malware. So it makes sense to secure your accounts with the strongest form of MFA available. But please bear in mind that if the only added authentication options offered by a site you frequent are SMS and/or phone calls, this is still better than simply relying on a password to secure your account.</p>


feed_id: https://krebsonsecurity.com/?p=52037
title: ‘BlueLeaks’ Exposes Files from Hundreds of Police Departments
uri: BlueLeaks-Exposes-Files-from-Hundreds-of-Police-Departments
url: https://krebsonsecurity.com/2020/06/blueleaks-exposes-files-from-hundreds-of-police-departments/
content:
<p>Hundreds of thousands of potentially sensitive files from police departments across the United States were leaked online last week. The collection, dubbed &#8220;<strong>BlueLeaks</strong>&#8221; and made searchable online, stems from a security breach at a Texas web design and hosting company that maintains a number of state law enforcement data-sharing portals.</p>
<p>The collection &#8212; nearly 270 gigabytes in total &#8212; is the latest release from <strong>Distributed Denial of Secrets</strong> (DDoSecrets), an <a href="https://www.cjr.org/tow_center/emma-best-ddosecrets.php" target="_blank" rel="noopener noreferrer">alternative to Wikileaks</a> that publishes caches of previously secret data.</p>
<div id="attachment_52050" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/a4dfec4f.blueleaks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/blueleaks.png"><img aria-describedby="caption-attachment-52050" class="wp-image-52050" src="media/a4dfec4f.blueleaks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/blueleaks.png" alt="" width="599" height="160" /></a><p id="caption-attachment-52050" class="wp-caption-text">A partial screenshot of the BlueLeaks data cache.</p></div>
<p>In a <a href="https://twitter.com/DDoSecrets/status/1274086005461716992" target="_blank" rel="noopener noreferrer">post on Twitter</a>, DDoSecrets said the BlueLeaks archive indexes &#8220;ten years of data from over 200 police departments, fusion centers and other law enforcement training and support resources,&#8221; and that &#8220;among the hundreds of thousands of documents are police and FBI reports, bulletins, guides and more.&#8221;</p>
<p><a href="https://en.wikipedia.org/wiki/Fusion_center" target="_blank" rel="noopener noreferrer">Fusion centers</a> are state-owned and operated entities that gather and disseminate law enforcement and public safety information between state, local, tribal and territorial, federal and private sector partners.</p>
<p>KrebsOnSecurity obtained an internal June 20 analysis by the <strong>National Fusion Center Association</strong> (NFCA), which confirmed the validity of the leaked data. The NFCA alert noted that the dates of the files in the leak actually span nearly 24 years &#8212; from August 1996 through June 19, 2020 &#8212; and that the documents include names, email addresses, phone numbers, PDF documents, images, and a large number of text, video, CSV and ZIP files.</p>
<p>&#8220;Additionally, the data dump contains emails and associated attachments,&#8221; the alert reads. &#8220;Our initial analysis revealed that some of these files contain highly sensitive information such as ACH routing numbers, international bank account numbers (IBANs), and other financial data as well as personally identifiable information (PII) and images of suspects listed in Requests for Information (RFIs) and other law enforcement and government agency reports.&#8221;</p>
<p><img class="aligncenter wp-image-52051" src="media/208d0706.ncfa-top.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/ncfa-top.png" alt="" width="595" height="111" /></p>
<p>The NFCA said it appears the data published by BlueLeaks was taken after a security breach at <a href="https://netsential.com" target="_blank" rel="noopener noreferrer">Netsential</a>, a Houston-based web development firm.</p>
<p>&#8220;Preliminary analysis of the data contained in this leak suggests that Netsential, a web services company used by multiple fusion centers, law enforcement, and other government agencies across the United States, was the source of the compromise,&#8221; the NFCA wrote. &#8220;Netsential confirmed that this compromise was likely the result of a threat actor who leveraged a compromised Netsential customer user account and the web platform’s upload feature to introduce malicious content, allowing for the exfiltration of other Netsential customer data.&#8221;</p>
<p>Reached via phone Sunday evening, Netsential Director <strong>Stephen Gartrell</strong> declined to comment for this story.<span id="more-52037"></span></p>
<p>The NFCA said a variety of cyber threat actors, including nation-states, hacktivists, and financially-motivated cybercriminals, might seek to exploit the data exposed in this breach to target fusion centers and associated agencies and their personnel in various cyber attacks and campaigns.</p>
<p>The BlueLeaks data set was released June 19, also known as &#8220;Juneteenth,&#8221; the oldest nationally celebrated commemoration of the ending of slavery in the United States. This year&#8217;s observance of the date has generated renewed public interest in the wake of widespread protests against police brutality and the filmed killing of <a href="https://www.nytimes.com/article/george-floyd-who-is.html" target="_blank" rel="noopener noreferrer">George Floyd</a> at the hands of Minneapolis police.</p>
<p><a href="https://www.steptoe.com/en/lawyers/stewart-baker.html" target="_blank" rel="noopener noreferrer">Stewart Baker</a>, an attorney at the Washington, D.C. office of <strong>Steptoe &amp; Johnson LLP</strong> and a former assistant secretary of policy at the <strong>U.S. Department of Homeland Security</strong>, said the BlueLeaks data is unlikely to shed much light on police misconduct, but could expose sensitive law enforcement investigations and even endanger lives.</p>
<p>&#8220;With this volume of material, there are bound to be compromises of sensitive operations and maybe even human sources or undercover police, so I fear it will put lives at risk,&#8221; Baker said. &#8220;Every organized crime operation in the country will likely have searched for their own names before law enforcement knows what&#8217;s in the files, so the damage could be done quickly. I&#8217;d also be surprised if the files produce much scandal or evidence of police misconduct. That&#8217;s not the kind of work the fusion centers do.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=52024
title: New Charges, Sentencing in Satori IoT Botnet Conspiracy
uri: New-Charges-Sentencing-in-Satori-IoT-Botnet-Conspiracy
url: https://krebsonsecurity.com/2020/06/new-charges-sentencing-in-satori-iot-botnet-conspiracy/
content:
<p>The <strong>U.S. Justice Department</strong> today criminally charged a Canadian and a Northern Ireland man for allegedly conspiring to build botnets that enslaved hundreds of thousands of routers and other Internet of Things (IoT) devices for use in large-scale distributed denial-of-service (DDoS) attacks. In addition, a defendant in the United States was sentenced today to drug treatment and 18 months community confinement for his admitted role in the botnet conspiracy.</p>
<p><img class="aligncenter wp-image-36433" src="media/ec45f675.iotstuf.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/09/iotstuf.jpg" alt="" width="598" height="337" /></p>
<p>Indictments unsealed by a federal court in Alaska today allege 20-year-old <strong>Aaron Sterritt</strong> from Larne, Northern Ireland, and 31-year-old <strong>Logan Shwydiuk</strong> of Saskatoon, Canada conspired to build, operate and improve their IoT crime machines over several years.</p>
<p>Prosecutors say Sterritt, using the hacker aliases &#8220;<strong>Vamp</strong>&#8221; and &#8220;<strong>Viktor</strong>,&#8221; was the brains behind the computer code that powered several potent and increasingly complex IoT botnet strains that became known by exotic names such as &#8220;<strong>Masuta</strong>,&#8221; &#8220;<strong>Satori</strong>,&#8221; &#8220;<strong>Okiru</strong>&#8221; and &#8220;<strong>Fbot</strong>.&#8221;</p>
<p>Shwydiuk, a.k.a. &#8220;<strong>Drake</strong>,&#8221; &#8220;<strong>Dingle</strong>, and &#8220;<strong>Chickenmelon</strong>,&#8221; is alleged to have taken the lead in managing sales and customer support for people who leased access to the IoT botnets to conduct their own DDoS attacks.</p>
<p>A third member of the botnet conspiracy &#8212; 22-year-old <strong>Kenneth Currin Schuchman</strong> of Vancouver, Wash. &#8212; <a href="https://krebsonsecurity.com/2019/09/satori-iot-botnet-operator-pleads-guilty/" target="_blank" rel="noopener noreferrer">pleaded guilty in Sept. 2019 to aiding and abetting computer intrusions in September 2019</a>. Schuchman, whose role was to acquire software exploits that could be used to infect new IoT devices, was sentenced today by a judge in Alaska to 18 months of community confinement and drug treatment, followed by three years of supervised release.</p>
<div id="attachment_44948" style="width: 259px" class="wp-caption alignright"><img aria-describedby="caption-attachment-44948" class=" wp-image-44948" src="media/bb642a44.schuchman.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/schuchman.png" alt="" width="249" height="220" /><p id="caption-attachment-44948" class="wp-caption-text">Kenneth &#8220;Nexus-Zeta&#8221; Schuchman, in an undated photo.</p></div>
<p>The government says the defendants built and maintained their IoT botnets by constantly scanning the Web for insecure devices. That scanning primarily targeted devices that were placed online with weak, factory default settings and/or passwords. But the group also seized upon a series of newly-discovered security vulnerabilities in these IoT systems &#8212; commandeering devices that hadn&#8217;t yet been updated with the latest software patches.</p>
<p>Some of the IoT botnets enslaved hundreds of thousands of hacked devices. For example, by November 2017, Masuta had infected an estimated 700,000 systems, allegedly allowing the defendants to launch crippling DDoS attacks capable of hurling 100 gigabits of junk data per second at targets &#8212; enough firepower to take down many large websites.</p>
<p>In 2015, then 15-year-old Sterritt was involved in <a href="https://krebsonsecurity.com/?s=talktalk&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">the high-profile hack against U.K. telecommunications provider </a><strong>TalkTalk</strong>. Sterritt later <a href="https://www.irishnews.com/news/uknews/2018/03/14/news/larne-teenager-involved-in-talktalk-hacking-is-named-aaron-sterritt-1278452/" target="_blank" rel="noopener noreferrer">pleaded guilty</a> to his part in the intrusion, and at his sentencing in 2018 was ordered to complete 50 hours of community service.</p>
<p><a href="media/219fa1b7.Dkt-2-Indictment.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/Dkt-2-Indictment.pdf" target="_blank" rel="noopener noreferrer">The indictments against Sterritt and Shwydiuk</a> (PDF) do not mention specific DDoS attacks thought to have been carried out with the IoT botnets. In an interview today with KrebsOnSecurity, prosecutors in Alaska declined to discuss any of their alleged offenses beyond building, maintaining and selling the above-mentioned IoT botnets.</p>
<p>But multiple sources tell KrebsOnSecuirty Vamp was principally responsible for <a href="https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-reddit/" target="_blank" rel="noopener noreferrer">the 2016 massive denial-of-service attack that swamped Dyn</a> — a company that provides core Internet services for a host of big-name Web sites. On October 21, 2016, an attack by a Mirai-based IoT botnet variant overwhelmed Dyn’s infrastructure, causing outages at a number of top Internet destinations, including Twitter, Spotify, Reddit and others.</p>
<p>In 2018, authorities with the U.K.&#8217;s <strong>National Crime Agency</strong> (NCA) interviewed a suspect in connection with the Dyn attack, but ultimately filed no charges against the youth because all of his digital devices had been encrypted.</p>
<p>&#8220;The principal suspect of this investigation is a UK national resident in Northern Ireland,&#8221; reads <a href="media/f7379e16.ni-performance-report-apr-june-2018.PDF" data-original-source="https://www.nipolicingboard.org.uk/sites/nipb/files/publications/ni-performance-report-apr-june-2018.PDF" target="_blank" rel="noopener noreferrer">a June 2018 NCA brief on their investigation into the Dyn attack</a> (PDF), dubbed <strong>Operation Midmonth</strong>. &#8220;In 2018 the subject returned for interview, however there was insufficient evidence against him to provide a realistic prospect of conviction.&#8221;</p>
<p><div id="attachment_44942" style="width: 602px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-44942" class=" wp-image-44942" src="media/b0731728.masuta-krebs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/masuta-krebs.png" alt="" width="592" height="458" /><p id="caption-attachment-44942" class="wp-caption-text">The login prompt for Nexus Zeta&#8217;s IoT botnet included the message &#8220;Masuta is powered and hosted on Brian Kreb&#8217;s [sic] 4head.&#8221; To be precise, it&#8217;s a 5head.</p></div><span id="more-52024"></span></p>
<p>The unsealing of the indictments against Sterritt and Shwydiuk came just minutes after Schuchman was sentenced today. Schuchman has been confined to an Alaskan jail for the past 13 months, and <strong>Chief U.S. District Judge Timothy Burgess</strong> today ordered the sentence of 18 months community confinement to begin Aug. 1.</p>
<p>Community confinement in Schuchman&#8217;s case means he will spend most or all of that time in a drug treatment program. In <a href="media/15acda4d.kennysentencingrecommendations.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/kennysentencingrecommendations.pdf" target="_blank" rel="noopener noreferrer">a memo</a> (PDF) released prior to Schuchman&#8217;s sentencing today, prosecutors detailed the defendant&#8217;s ongoing struggle with narcotics, noting that on multiple occasions he was discharged from treatment programs after testing positive for <a href="https://www.drugs.com/suboxone.html" target="_blank" rel="noopener noreferrer">Suboxone</a> &#8212; which is used to treat opiate addiction and is sometimes abused by addicts &#8212; and for possessing drug contraband.</p>
<p>The government&#8217;s sentencing memo also says Schuchman on multiple occasions absconded from pretrial supervision, and went right back to committing the botnet crimes for which he&#8217;d been arrested &#8212; even communicating with Sterritt about the details of the ongoing FBI investigation.</p>
<p>&#8220;Defendant&#8217;s performance on pretrial supervision has been spectacularly poor,&#8221; prosecutors explained. &#8220;Even after being interviewed by the FBI and put on restrictions, he continued to create and operate a DDoS botnet.&#8221;</p>
<p>Prosecutors told the judge that when he was ultimately re-arrested by U.S. Marshals, Schuchman was found at a computer in violation of the terms of his release. In that incident, Schuchman allegedly told his dad to trash his computer, before successfully encrypting his hard drive (which the Marshals service is still trying to decrypt). According to the memo, the defendant admitted to marshals that he had received and viewed videos of &#8220;juveniles engaged in sex acts with other juveniles.&#8221;</p>
<p>&#8220;The circumstances surrounding the defendant’s most recent re-arrest are troubling,&#8221; the memo recounts. &#8220;The management staff at the defendant’s father’s apartment complex, where the defendant was residing while on abscond status, reported numerous complaints against the defendant, including invitations to underage children to swim naked in the pool.&#8221;</p>
<p><strong>Adam Alexander</strong>, assistant US attorney for the district of Alaska, declined to say whether the DOJ would seek extradition of Sterritt and Shwydiuk. Alexander said the success of these prosecutions is highly dependent on the assistance of domestic and international law enforcement partners, as well as a list of private and public entities named at the conclusion of <a href="media/56d46e4d.Schuchman-Kenneth-ALEXANDER_PELKER.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/Schuchman-Kenneth-ALEXANDER_PELKER.pdf" target="_blank" rel="noopener noreferrer">the DOJ&#8217;s press release on the Schuchman sentencing</a> (PDF).</p>
<p>Chief Judge Burgess was the same magistrate who presided over <a href="https://krebsonsecurity.com/2018/10/mirai-co-author-gets-6-months-confinement-8-6m-in-fines-for-rutgers-attacks/" target="_blank" rel="noopener noreferrer">the 2018 sentencing</a> of the co-authors of <a href="https://krebsonsecurity.com/?s=mirai&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">Mirai</a>, a highly disruptive IoT botnet strain whose <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank" rel="noopener noreferrer">source code was leaked online in 2016</a> and was built upon by the defendants in this case. Both Mirai co-authors were sentenced to community service and home confinement thanks to their considerable cooperation with the government&#8217;s ongoing IoT botnet investigations.</p>
<p>Asked whether he was satisfied with the sentence handed down against Schuchman, Alexander maintained it was more than just another slap on the wrist, noting that Schuchman has waived his right to appeal the conviction and faces additional confinement of two years if he absconds again or fails to complete his treatment.</p>
<p>&#8220;In every case the statutory factors have to do with the history of the defendants, who in these crimes tend to be extremely youthful offenders,&#8221; Alexander said. &#8220;In this case, we had a young man who struggles with mental health and really pronounced substance abuse issues. Contrary to what many people might think, the goal of the DOJ in cases like this is not to put people in jail for as long as possible but to try to achieve the best balance of safeguarding communities and affording the defendant the best possible chance of rehabilitation.&#8221;</p>
<p><strong>William Walton</strong>, supervisory special agent for the FBI&#8217;s cybercrime investigation division in Anchorage, Ala., said he hopes today&#8217;s indictments and sentencing send a clear message to what he described as a relatively insular and small group of individuals who are still building, running and leasing IoT-based botnets to further a range of cybercrimes.</p>
<p>&#8220;One of the things we hope in our efforts here and in our partnerships with our international partners is when we identify these people, we want very much to hold them to account in a just but appropriate way,&#8221; Walton said. &#8220;Hopefully, any associates who are aspiring to fill the vacuum once we take some players off the board realize that there are going to be real consequences for doing that.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=52104
title: Russian Cybercrime Boss Burkov Gets 9 Years
uri: Russian-Cybercrime-Boss-Burkov-Gets-9-Years
url: https://krebsonsecurity.com/2020/06/russian-cybercrime-boss-burkov-gets-9-years/
content:
<p>A well-connected Russian hacker once described as “an asset of supreme importance” to Moscow was sentenced on Friday to nine years in a U.S. prison after pleading guilty to running a site that sold stolen payment card data, and to administering a highly secretive crime forum that counted among its members some of the most elite Russian cybercrooks.</p>
<div id="attachment_49530" style="width: 607px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-49530" class=" wp-image-49530" src="media/a23ec59c.burkov-jerusalem-getty.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/burkov-jerusalem-getty.png" alt="" width="597" height="376" /><p id="caption-attachment-49530" class="wp-caption-text">Alexei Burkov, seated second from right, attends a hearing in Jerusalem in 2015. Photo: Andrei Shirokov / Tass via Getty Images.</p></div>
<p><strong>Alexsei Burkov</strong> of St. Petersburg, Russia admitted to running <strong>CardPlanet</strong>, a site that sold more than 150,000 stolen credit card accounts, and to being a founder of <strong>DirectConnection</strong> — a closely guarded underground community that attracted some of the world’s most-wanted Russian hackers.</p>
<p>As KrebsOnSecurity noted in <a href="https://krebsonsecurity.com/2019/11/why-were-the-russians-so-set-against-this-hacker-being-extradited/" target="_blank" rel="noopener noreferrer">a November 2019 profile of Burkov’s hacker nickname ‘k0pa,’</a> “a deep dive into the various pseudonyms allegedly used by Burkov suggests this individual may be one of the most connected and skilled malicious hackers ever apprehended by U.S. authorities, and that the Russian government is probably concerned that he simply knows too much.”</p>
<p>Burkov was arrested in 2015 on an international warrant while visiting Israel, and over the ensuing four years the Russian government aggressively sought to keep him from being extradited to the United States.</p>
<p>When Israeli authorities turned down requests to send him back to Russia — supposedly to face separate hacking charges there — the Russians then imprisoned Israeli citizen <strong>Naama Issachar</strong> on trumped-up drug charges in a bid to trade prisoners. Nevertheless, Burkov was extradited to the United States in November 2019. <strong>Russian President Vladimir Putin</strong> <a href="https://www.bbc.com/news/world-europe-51301827" target="_blank" rel="noopener noreferrer">pardoned Issachar in January 2020</a>, just hours after Burkov pleaded guilty.</p>
<p><a href="https://nyccriminallawyer.com/" target="_blank" rel="noopener noreferrer">Arkady Bukh</a> is a New York attorney who has represented a number of accused and convicted cybercriminals from Eastern Europe and Russia. Bukh said he suspects Burkov did not cooperate with the Justice Department investigators apart from <a href="https://krebsonsecurity.com/2020/01/russian-cybercrime-boss-burkov-pleads-guilty/" target="_blank" rel="noopener noreferrer">agreeing not to take the case to trial</a>.</p>
<p>&#8220;Nine years is a huge sentence, and the government doesn&#8217;t give nine years to defendants who cooperate,&#8221; Bukh said. &#8220;Also, the time span [between Burkov&#8217;s guilty plea and sentencing] was very short.&#8221;<span id="more-52104"></span></p>
<p>DirectConnection was something of a Who’s Who of major cybercriminals, and many of its most well-known members have likewise been extradited to and prosecuted by the United States. Those include <strong>Sergey “Fly” Vovnenko</strong>, who was sentenced to 41 months in prison for operating a botnet and stealing login and payment card data. Vovnenko also served as administrator of his own cybercrime forum, which <a href="https://krebsonsecurity.com/2019/09/interview-with-the-guy-who-tried-to-frame-me-for-heroin-possession/" target="_blank" rel="noopener noreferrer">he used in 2013 to carry out a plan to have Yours Truly framed for heroin possession</a>.</p>
<p>As noted in last year’s profile of Burkov, an early and important member of DirectConnection was a hacker who went by the moniker “<strong>aqua</strong>” and ran the banking sub-forum on Burkov’s site. In December 2019, the <strong>FBI</strong> <a href="https://www.fbi.gov/wanted/cyber/maksim-viktorovich-yakubets" target="_blank" rel="noopener noreferrer">offered a $5 million bounty</a> leading to the arrest and conviction of aqua, who’s been identified as <strong>Maksim Viktorovich Yakubets</strong>. The Justice Department says Yakubets/aqua <a href="https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/" target="_blank" rel="noopener noreferrer">ran a transnational cybercrime organization called “Evil Corp.”</a> that stole roughly $100 million from victims.</p>
<div id="attachment_49556" class="wp-caption aligncenter">
<p><a class="lightbox" href="media/ae7b3c84.jz-dc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/jz-dc.png"><img class="aligncenter wp-image-49556" src="media/ae7b3c84.jz-dc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/jz-dc.png" alt="" width="596" height="215" aria-describedby="caption-attachment-49556" /></a></p>
<p id="caption-attachment-49556" class="wp-caption-text">In this 2011 screenshot of DirectConnection, we can see the nickname of “aqua,” who ran the “banking” sub-forum on DirectConecttion. Aqua, a.k.a. Maksim V. Yakubets of Russia, now has a $5 million bounty on his head from the FBI.</p>
</div>
<p><span id="more-50271"></span>According to a statement of facts in Burkov’s case, the author of the <a href="https://krebsonsecurity.com/?s=spyeye&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">infamous SpyEye banking trojan</a> — <a href="https://krebsonsecurity.com/2016/04/spyeye-makers-get-24-years-in-prison/" target="_blank" rel="noopener noreferrer">Aleksandr “Gribodemon” Panin</a>— was personally vouched for by Burkov. Panin was sentenced in 2016 to more than nine years in prison.</p>
<p>Other top DirectConnection members include convicted credit card fraudsters <a href="https://www.wired.com/2010/08/badb-rbs-worldpay-hack/" target="_blank" rel="noopener noreferrer">Vladislav “Badb” Horohorin</a> and <a href="https://krebsonsecurity.com/?s=zo0mer&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">Sergey “zo0mer” Kozerev</a>, as well as the infamous spammer and botnet master <a href="https://krebsonsecurity.com/?s=severa+waledac&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">Peter “Severa” Levashov</a>.</p>
<p>Also on Friday, the Justice Department said it obtained <a href="https://www.justice.gov/opa/pr/russian-national-pleads-guilty-role-transnational-cybercrime-organization-responsible-more" target="_blank" rel="noopener noreferrer">a guilty plea</a> from another top cybercrime forum boss &#8212; <strong>Sergey &#8220;Stells&#8221; Medvedev</strong> &#8212; who admitted to <a href="https://krebsonsecurity.com/2018/02/u-s-arrests-13-charges-36-in-infraud-cybercrime-forum-bust/" target="_blank" rel="noopener noreferrer">administering the <strong>Infraud</strong> forum</a>. The government says Infraud, whose slogan was &#8220;In Fraud We Trust,&#8221; attracted more than 10,000 members and inflicted more than $568 million in actual losses from the sale of stolen identity information, payment card data and malware.</p>
<p>A copy of the 108-month judgment entered against Burkov is available <a href="media/1dd18dde.burkov-judgment.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/burkov-judgment.pdf" target="_blank" rel="noopener noreferrer">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=52123
title: COVID-19 ‘Breach Bubble’ Waiting to Pop?
uri: COVID-19-Breach-Bubble-Waiting-to-Pop
url: https://krebsonsecurity.com/2020/06/covid-19-breach-bubble-waiting-to-pop/
content:
<p>The COVID-19 pandemic has made it harder for banks to trace the source of payment card data stolen from smaller, hacked online merchants. On the plus side, months of quarantine have massively decreased demand for account information that thieves buy and use to create physical counterfeit credit cards. But fraud experts say recent developments suggest both trends are about to change &#8212; and likely for the worse.</p>
<p>The economic laws of supply and demand hold just as true in the business world as they do in the cybercrime space. Global lockdowns from COVID-19 have resulted in far fewer fraudsters willing or able to visit retail stores to use their counterfeit cards, and the decreased demand has severely depressed prices in the underground for purloined card data.</p>
<div id="attachment_52132" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/b13b7e15.realandrare.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/realandrare.png"><img aria-describedby="caption-attachment-52132" class="wp-image-52132" src="media/b13b7e15.realandrare.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/realandrare.png" alt="" width="598" height="148" /></a><p id="caption-attachment-52132" class="wp-caption-text">An ad for a site selling stolen payment card data, circa March 2020.</p></div>
<p>That&#8217;s according to <a href="https://www.geminiadvisory.io" target="_blank" rel="noopener noreferrer">Gemini Advisory</a>, a New York-based cyber intelligence firm that closely tracks the inventories of dark web stores trafficking in stolen payment card data.</p>
<p><strong>Stas Alforov</strong>, Gemini&#8217;s director of research and development, said that since the beginning of 2020 the company has seen a steep drop in demand for compromised &#8220;card present&#8221; data &#8212; digits stolen from hacked brick-and-mortar merchants with the help of malicious software surreptitiously installed on point-of-sale (POS) devices.</p>
<p>Alforov said the median price for card-present data has dropped precipitously over the past few months.</p>
<p>&#8220;Gemini Advisory has seen over 50 percent decrease in demand for compromised card present data since the mandated COVID-19 quarantines in the United States as well as the majority of the world,&#8221; he told KrebsOnSecurity.</p>
<p>Meanwhile, the supply of card-present data has remained relatively steady. Gemini&#8217;s latest find &#8212; a 10-month-long card breach at dozens of <a href="https://www.chickene.com" target="_blank" rel="noopener noreferrer">Chicken Express</a> locations throughout Texas and other southern states that the fast-food chain first publicly acknowledged today after being contacted by this author &#8212; saw an estimated 165,000 cards stolen from eatery locations recently go on sale at one of the dark web&#8217;s largest cybercrime bazaars.</p>
<p>&#8220;Card present data supply hasn&#8217;t wavered much during the COVID-19 period,&#8221; Alforov said. &#8220;This is likely due to the fact that most of the sold data is still coming from breaches that occurred in 2019 and early 2020.&#8221;</p>
<div id="attachment_52131" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/f4f9bd8a.medianpricecnp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/medianpricecnp.png"><img aria-describedby="caption-attachment-52131" class="wp-image-52131" src="media/f4f9bd8a.medianpricecnp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/06/medianpricecnp.png" alt="" width="597" height="301" /></a><p id="caption-attachment-52131" class="wp-caption-text">A lack of demand for and steady supply of stolen card-present data in the underground has severely depressed prices since the beginning of the COVID-19 pandemic. Image: Gemini Advisory</p></div>
<p>Naturally, crooks who ply their trade in credit card thievery also have been working from home more throughout the COVID-19 pandemic. That means demand for stolen &#8220;card-not-present&#8221; data &#8212; customer payment information extracted from hacked online merchants and typically used to defraud other e-commerce vendors &#8212; remains high. And so have prices for card-not-present data: Gemini found prices for this commodity actually increased slightly over the past few months.</p>
<p><strong>Andrew Barratt</strong> is an investigator with <a href="https://www.coalfire.com" target="_blank" rel="noopener noreferrer">Coalfire</a>, the cyber forensics firm hired by Chicken Express to remediate the breach and help the company improve security going forward. Barratt said there&#8217;s another curious COVID-19 dynamic going on with e-commerce fraud recently that is making it more difficult for banks and card issuers to trace patterns in stolen card-not-present data back to hacked web merchants &#8212; particularly smaller e-commerce shops.</p>
<p>&#8220;One of the concerns that has been expressed to me is that we’re getting [fewer] overlapping hotspots,&#8221; Barratt said. &#8220;For a lot of the smaller, more frequently compromised merchants there has been a large drop off in transactions. Whilst big e-commerce has generally done okay during the COVID-19 pandemic, a number of more modest sized or specialty online retailers have not had the same access to their supply chain and so have had to close or drastically reduce the lines they’re selling.&#8221;</p>
<p>Banks routinely take groups of customer cards that have experienced fraudulent activity and try to see if some or all of them were used at the same merchant during a similar timeframe, a basic anti-fraud process known as &#8220;common point of purchase&#8221; or CPP analysis. But ironically, this analysis can become more challenging when there are fewer overall transactions going through a compromised merchant&#8217;s site, Barratt said.</p>
<p>&#8220;With a smaller transactional footprint means less Common Point of Purchase alerts and less data to work on to trigger a forensic investigation or fraud alert,&#8221; Barratt said. &#8220;It does also mean less fraud right now – which is a positive. <span class="pullquote pqright">But one of the big concerns that has been raised to us as investigators &#8212; literally asking if we have capacity for what’s coming &#8212; has been that merchants are getting compromised by ‘lie in wait’ type intruders.&#8221;</span></p>
<p>Barratt says there&#8217;s a suspicion that hackers may have established beachheads [breachheads?] in a number of these smaller online merchants and are simply biding their time. If and when transaction volumes for these merchants do pick up, the concern is then hackers may be in a better position to mix the sale of cards stolen from many hacked merchants and further confound CPP analysis efforts.<span id="more-52123"></span></p>
<p>&#8220;These intruders may have a beachhead in a number of small and/or middle market e-commerce entities and they’re just waiting for the transaction volumes to go back up again and they’ve suddenly got the capability to have skimmers capturing lots of card data in the event of a sudden uptick in consumer spending,&#8221; he said. &#8220;They’d also have a diverse portfolio of compromise so could possibly even evade common point of purchase detection for a while too. Couple all of that with major shopping cart platforms going out of support (<a href="https://magento.com/blog/magento-news/supporting-magento-1-through-june-2020" target="_blank" rel="noopener noreferrer">like Magento 1 this month</a>) and furloughed IT and security staff, and there’s a potentially large COVID-19 breach bubble waiting to pop.&#8221;</p>
<p>With a majority of payment cards issued in the United States now equipped with a chip that makes the cards difficult and expensive for thieves to clone, cybercriminals have continued to focus on hacking smaller merchants that have not yet installed chip card readers and are still swiping the cards&#8217; magnetic stripe at the register.</p>
<p>Barratt said his company has tied the source of the breach to malware known as &#8220;<a href="https://blog.trendmicro.com/trendlabs-security-intelligence/pwnpos-old-undetected-pos-malware-still-causing-havoc/" target="_blank" rel="noopener noreferrer">PwnPOS</a>,&#8221; an ancient strain of point-of-sale malware that first surfaced more than seven years ago, if not earlier.</p>
<p>Chicken Express CEO <strong>Ricky Stuart</strong> told KrebsOnSecurity that apart from &#8220;a handful&#8221; of locations his family owns directly, most of his 250 stores are franchisees that decide on their own how to secure their payment operations. Nevertheless, the company is now forced to examine each store&#8217;s POS systems to remediate the breach.</p>
<p>Stuart blamed the major point-of-sale vendors for taking their time in supporting and validating chip-capable payment systems. But when asked how many of the company&#8217;s 250 stores had chip-capable readers installed, Stuart said he didn&#8217;t know. Ditto for the handful of stores he owns directly.</p>
<p>&#8220;I don&#8217;t know how many,&#8221; he said. &#8220;I would think it would be a majority. If not, I know they&#8217;re coming.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=52157
title: Ransomware Gangs Don’t Need PR Help
uri: Ransomware-Gangs-Don-t-Need-PR-Help
url: https://krebsonsecurity.com/2020/07/ransomware-gangs-dont-need-pr-help/
content:
<p>We&#8217;ve seen an ugly trend recently of <a href="https://www.bleepingcomputer.com/news/security/business-giant-xerox-allegedly-suffers-maze-ransomware-attack/" target="_blank" rel="noopener noreferrer">tech news stories</a> and <a href="https://cybleinc.com/blog-2/" target="_blank" rel="noopener noreferrer">cybersecurity firms</a> trumpeting claims of ransomware attacks on companies large and small, apparently based on little more than the say-so of the ransomware gangs themselves. Such coverage is potentially quite harmful and plays deftly into the hands of organized crime.</p>
<p>Often the rationale behind couching these events as newsworthy is that the attacks involve publicly traded companies or recognizable brands, and that investors and the public have a right to know. But absent any additional information from the victim company or their partners who may be affected by the attack, these kinds of stories and blog posts look a great deal like ambulance chasing and sensationalism.</p>
<p><img class="aligncenter  wp-image-32771" src="media/3d1c9fe5.ransomware-kav.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/11/ransomware-kav.png" alt="" width="596" height="449" srcset="https://krebsonsecurity.com/wp-content/uploads/2015/11/ransomware-kav.png 631w, https://krebsonsecurity.com/wp-content/uploads/2015/11/ransomware-kav-580x438.png 580w" sizes="(max-width: 596px) 100vw, 596px" /></p>
<p>Currently, nearly two dozen ransomware crime gangs have erected their own blogs to publish sensitive data from victims. A few of these blogs routinely issue self-serving press releases, some of which gallingly refer to victims as &#8220;clients&#8221; and cast themselves in a beneficent light. Usually, the blog posts that appear on ransom sites are little more than a teaser &#8212; screenshots of claimed access to computers, or a handful of documents that expose proprietary or financial information.</p>
<p>The goal behind the publication of these teasers is clear, and the ransomware gangs make no bones about it: To publicly pressure the victim company into paying up. Those that refuse to be extorted are told to expect that huge amounts of sensitive company data will be published online or sold on the dark web (or both).</p>
<p>Emboldened by their successes, several ransomware gangs recently <em>have started demanding two ransoms</em>: One payment to secure a digital key that can unlock files, folders and directories encrypted by their malware, and a second to avoid having any stolen information published or shared with others.</p>
<p>KrebsOnSecurity has sought to <a href="https://krebsonsecurity.com/?s=ransomware&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">highlight ransomware incidents</a> at companies whose core business involves providing technical services to others &#8212; particularly managed service providers that have done an exceptionally poor job communicating about the attack with their customers.</p>
<p>Overall, I&#8217;ve tried to use each story to call attention to key failures that frequently give rise to ransomware infections, and to offer information about how other companies can avoid a similar fate.</p>
<p>But simply parroting what professional extortionists have posted on their blog about victims of cybercrime smacks of providing aid and comfort to an enemy that needs and deserves neither.</p>
<p>Maybe you disagree, dear readers? Feel free to sound off in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=52173
title: E-Verify’s “SSN Lock” is Nothing of the Sort
uri: E-Verify-s-SSN-Lock-is-Nothing-of-the-Sort
url: https://krebsonsecurity.com/2020/07/e-verifys-ssn-lock-is-nothing-of-the-sort/
content:
<p>One of the most-read advice columns on this site is a 2018 piece called &#8220;<a href="https://krebsonsecurity.com/2018/06/plant-your-flag-mark-your-territory/" target="_blank" rel="noopener noreferrer">Plant Your Flag, Mark Your Territory</a>,&#8221; which tried to impress upon readers the importance of creating accounts at websites like those at the <a href="https://krebsonsecurity.com/2013/09/crooks-hijack-retirement-funds-via-ssa-portal/" target="_blank" rel="noopener noreferrer">Social Security Administration</a>, the <a href="https://krebsonsecurity.com/2015/03/sign-up-at-irs-gov-before-crooks-do-it-for-you/" target="_blank" rel="noopener noreferrer">IRS</a> and others before crooks do it for you. A key concept here is that these services only allow one account per Social Security number &#8212; which for better or worse is the de facto national identifier in the United States. But KrebsOnSecurity recently discovered that this is not the case with all federal government sites built to help you manage your identity online.</p>
<p>A reader who was recently the victim of <a href="https://krebsonsecurity.com/?s=unemployment+insurance+fraud&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">unemployment insurance fraud</a> said he was told he should create an account at the <strong>Department of Homeland Security</strong>&#8216;s <a href="https://myeverify.uscis.gov/" target="_blank" rel="noopener noreferrer">myE-Verify website</a>, and place a lock on his Social Security number (SSN) to minimize the chances that ID thieves might abuse his identity for employment fraud in the future.</p>
<div id="attachment_52185" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/4d40d5d4.myeverify.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/myeverify.png"><img aria-describedby="caption-attachment-52185" class="wp-image-52185" src="media/4d40d5d4.myeverify.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/myeverify.png" alt="" width="597" height="414" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/myeverify.png 1161w, https://krebsonsecurity.com/wp-content/uploads/2020/07/myeverify-580x402.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/07/myeverify-940x652.png 940w, https://krebsonsecurity.com/wp-content/uploads/2020/07/myeverify-768x533.png 768w" sizes="(max-width: 597px) 100vw, 597px" /></a><p id="caption-attachment-52185" class="wp-caption-text">DHS&#8217;s myE-Verify homepage.</p></div>
<p>According to the website, roughly 600,000 employers at over 1.9 million hiring sites use E-Verify to confirm the employment eligibility of new employees. E-Verify&#8217;s consumer-facing portal myE-Verify lets users track and manage employment inquiries made through the E-Verify system. It also features a &#8220;Self Lock&#8221; designed to prevent the misuse of one&#8217;s SSN in E-Verify.</p>
<p>Enabling this lock is supposed to mean that for the next year thereafter, if an unauthorized individual attempts to fraudulently use a SSN for employment authorization, he or she cannot use the SSN in E-Verify, even if the SSN is that of an employment authorized individual. But in practice, this service may actually do little to deter ID thieves from impersonating you to a potential employer.</p>
<p>At the request of the reader who reached out (and in the interest of following my own advice to plant one&#8217;s flag), KrebsOnSecurity decided to sign up for a myE-Verify account. After verifying my email address, I was asked to pick a strong password and select a form of multi-factor authentication (MFA). The most secure MFA option offered (a one-time code generated by an app like Google Authenticator or Authy) was already pre-selected, so I chose that.</p>
<p>The site requested my name, address, SSN, date of birth and phone number. I was then asked to <a href="media/d02bccaa.myeverifypasswordquestions.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/myeverifypasswordquestions.png" target="_blank" rel="noopener noreferrer">select five questions and answers</a> that might be asked if I were to try to reset my password, such as &#8220;In what city/town did you meet your spouse,&#8221; and &#8220;What is the name of the company of your first paid job.&#8221; I chose long, gibberish answers that had nothing to do with the questions (yes, these password questions are next to useless for security and frequently are the cause of account takeovers, but we&#8217;ll get to that in a minute).</p>
<p>Password reset questions selected, the site proceeded to ask four, multiple-guess &#8220;knowledge-based authentication&#8221; questions to verify my identity. The <strong>U.S. Federal Trade Commission</strong>&#8216;s <a href="https://www.consumer.ftc.gov/blog/2015/11/your-information-being-used-job-related-id-theft" target="_blank" rel="noopener noreferrer">primer page on preventing job-related ID theft</a> says people who have <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener noreferrer">placed a security freeze on their credit files with the major credit bureaus</a> will need to lift or thaw the freeze before being able to answer these questions successfully at myE-Verify. However, I did not find that to be the case, even though my credit file has been frozen with the major bureaus for years.</p>
<p>After successfully answering the KBA questions (the answer to each was &#8220;none of the above,&#8221; by the way), the site declared I&#8217;d successfully created my account! I could then see that I had the option to place a &#8220;Self Lock&#8221; on my SSN within the E-Verify system.</p>
<p><a class="lightbox" href="media/1431843f.everifywelcome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/everifywelcome.png"><img class="aligncenter wp-image-52183" src="media/1431843f.everifywelcome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/everifywelcome.png" alt="" width="597" height="438" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/everifywelcome.png 1154w, https://krebsonsecurity.com/wp-content/uploads/2020/07/everifywelcome-580x425.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/07/everifywelcome-940x689.png 940w, https://krebsonsecurity.com/wp-content/uploads/2020/07/everifywelcome-768x563.png 768w" sizes="(max-width: 597px) 100vw, 597px" /></a></p>
<p>Doing so required me to pick three more challenge questions and answers. The site didn&#8217;t explain why it was asking me to do this, but I assumed it would prompt me for the answers in the event that I later chose to unlock my SSN within E-Verify.</p>
<p>After selecting and answering those questions and clicking the &#8220;Lock my SSN&#8221; button, the site generated an error message saying something went wrong and it couldn&#8217;t proceed.</p>
<p><img class="aligncenter wp-image-52179" src="media/cdf1f31b.myeverifysystemerror-e.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/myeverifysystemerror-e.png" alt="" width="598" height="433" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/myeverifysystemerror-e.png 1161w, https://krebsonsecurity.com/wp-content/uploads/2020/07/myeverifysystemerror-e-580x420.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/07/myeverifysystemerror-e-940x681.png 940w, https://krebsonsecurity.com/wp-content/uploads/2020/07/myeverifysystemerror-e-768x556.png 768w" sizes="(max-width: 598px) 100vw, 598px" /></p>
<p>Alas, logging out and logging back in again showed that the site did in fact proceed and that my SSN was locked. Joy.</p>
<p>But I still had to know one thing: Could someone else come along pretending to be me and create another account using my SSN, date of birth and address but under a different email address? Using a different browser and Internet address, I proceeded to find out.</p>
<p>Imagine my surprise when I was able to create a separate account as me with just a different email address (once again, the correct answers to all of the KBA questions was &#8220;none of the above&#8221;). Upon logging in, I noticed my SSN was indeed locked within E-Verify. So I chose to unlock it.</p>
<p>Did the system ask any of the challenge questions it had me create previously? Nope. It just reported that my SSN was now unlocked. Logging out and logging back in to the original account I created (again under a different IP and browser) confirmed that my SSN was unlocked.<span id="more-52173"></span></p>
<h4>ANALYSIS</h4>
<p>Obviously, if the E-Verify system allows multiple accounts to be created using the same name, address, phone number, SSN and date of birth, this is less than ideal and somewhat defeats the purpose of creating one for the purposes of protecting one&#8217;s identity from misuse.</p>
<p>Lest you think your SSN and DOB is somehow private information, you should know this static data about U.S. residents has been exposed many times over in countless data breaches, and in any case these digits are available for sale on most Americans via Dark Web sites for roughly the bitcoin equivalent of a fancy caffeinated drink at Starbucks.</p>
<p>Being unable to proceed through knowledge-based authentication questions without first unfreezing one&#8217;s credit file with one or all of the big three credit bureaus (Equifax, Experian and TransUnion) can actually be a plus for those of us who are paranoid about identity theft. I couldn&#8217;t find any mention on the E-Verify site of which company or service it uses to ask these questions, but the fact that the site doesn&#8217;t seem to care whether one has a freeze in place is troubling.</p>
<p>And when the correct answer to all of the KBA questions that do get asked is invariably &#8220;none of the above,&#8221; that somewhat lessens the value of asking them in the first place. Maybe that was just the luck of the draw in my case, but also troubling nonetheless. Either way, these KBA questions are notoriously weak security because the answers to them often are pulled from records that are public anyway, and can sometimes be deduced by studying the information available on a target&#8217;s social media profiles.</p>
<p>Speaking of silly questions, relying on &#8220;secret questions&#8221; or &#8220;challenge questions&#8221; as an alternative method of resetting one&#8217;s password is severely outdated and insecure. A 2015 study by <strong>Google</strong> titled &#8220;<a href="media/b899d18f.43783.pdf" data-original-source="http://static.googleusercontent.com/media/research.google.com/en/us/pubs/archive/43783.pdf" target="_blank" rel="noopener noreferrer">Secrets, Lies and Account Recovery</a>&#8221; (PDF) found that secret questions generally offer a security level that is far lower than just user-chosen passwords. Also, the idea that an account protected by multi-factor authentication could be undermined by successfully guessing the answer(s) to one or more secret questions (answered truthfully and perhaps located by thieves through mining one&#8217;s social media accounts) is bothersome.</p>
<p>Finally, the advice given to the reader whose inquiry originally prompted me to sign up at myE-Verify doesn&#8217;t seem to have anything to do with preventing ID thieves from fraudulently claiming unemployment insurance benefits in one&#8217;s name at the state level. KrebsOnSecurity followed up with four different readers who left comments on this site about being victims of unemployment fraud recently, and none of them saw any inquiries about this in their myE-Verify accounts after creating them. Not that they should have seen signs of this activity in the E-Verify system; I just wanted to emphasize that one seems to have little to do with the other.</p>


feed_id: https://krebsonsecurity.com/?p=52201
title: Breached Data Indexer ‘Data Viper’ Hacked
uri: Breached-Data-Indexer-Data-Viper-Hacked
url: https://krebsonsecurity.com/2020/07/breached-data-indexer-data-viper-hacked/
content:
<p><strong>Data Viper</strong>, a security startup that provides access to some 15 billion usernames, passwords and other information exposed in more than 8,000 website breaches, has itself been hacked and its user database posted online. The hackers also claim they are selling on the dark web roughly 2 billion records Data Viper collated from numerous breaches and data leaks, including data from several companies that likely either do not know they have been hacked or have not yet publicly disclosed an intrusion.</p>
<p>The apparent breach at St. Louis, Mo. based Data Viper offers a cautionary and twisted tale of what can happen when security researchers seeking to gather intelligence about illegal activity online get too close to their prey or lose sight of their purported mission. The incident also highlights the often murky area between what&#8217;s legal and ethical in combating cybercrime.</p>
<p><img class="aligncenter wp-image-52251" src="media/baed6334.dataviper.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/dataviper.png" alt="" width="561" height="268" /></p>
<p>Data Viper is the brainchild of <strong>Vinny Troia</strong>, a security researcher who runs a cyber threat intelligence company called <strong>Night Lion Security</strong>. Since its inception in 2018, Data Viper has billed itself as a &#8220;threat intelligence platform designed to provide organizations, investigators and law enforcement with access to the largest collection of private hacker channels, pastes, forums and breached databases on the market.&#8221;</p>
<p>Many private companies sell access to such information to vetted clients &#8212; mainly law enforcement officials and anti-fraud experts working in security roles at major companies that can foot the bill for these often pricey services.</p>
<p>Data Viper has <a href="https://web.archive.org/web/20200427105221/https://www.dataviper.io/" target="_blank" rel="noopener noreferrer">sought to differentiate itself</a> by advertising &#8220;access to private and undisclosed breach data.&#8221; As KrebsOnSecurity noted in <a href="https://krebsonsecurity.com/2018/10/when-security-researchers-pose-as-cybercrooks-who-can-tell-the-difference/" target="_blank" rel="noopener noreferrer">a 2018 story</a>, Troia has acknowledged posing as a buyer or seller on various dark web forums as a way to acquire old and newly-hacked databases from other forum members.</p>
<p>But this approach may have backfired over the weekend, when someone posted to <a href="https://en.wikipedia.org/wiki/Deep_web" target="_blank" rel="noopener noreferrer">the deep web</a> a link to an &#8220;e-zine&#8221; (electronic magazine) describing the Data Viper hack and linking to the Data Viper user base. The anonymous poster alleged he&#8217;d been inside Data Viper for months and had exfiltrated hundreds of gigabytes of breached data from the service without notice.</p>
<p>The intruder also linked to several dozen new sales threads on the dark web site <strong>Empire Market</strong>, where they advertise the sale of hundreds of millions of account details from dozens of leaked or hacked website databases that Data Viper allegedly acquired via trading with others on cybercrime forums.</p>
<div id="attachment_52243" style="width: 608px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-52243" class=" wp-image-52243" src="media/3b6b7723.sh-dw.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/sh-dw.png" alt="" width="598" height="524" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/sh-dw.png 635w, https://krebsonsecurity.com/wp-content/uploads/2020/07/sh-dw-580x508.png 580w" sizes="(max-width: 598px) 100vw, 598px" /><p id="caption-attachment-52243" class="wp-caption-text">An online post by the attackers who broke into Data Viper.</p></div>
<p>Some of the databases for sale tie back to known, publicly reported breaches. But others correspond to companies that do not appear to have disclosed a security incident. As such, KrebsOnSecurity is not naming most of those companies and is currently attempting to ascertain the validity of the claims.</p>
<p>KrebsOnSecurity did speak with <strong>Victor Ho</strong>, the CEO of <strong>Fivestars.com</strong>, a company that helps smaller firms run customer loyalty programs. The hackers claimed they are selling 44 million records taken from Fivestars last year. Ho said he was unaware of any data security incident and that no such event had been reported to his company, but that Fivestars is now investigating the claims. Ho allowed that the number of records mentioned in the dark web sales thread roughly matches the number of users his company had last year.</p>
<p>But on Aug. 3, 2019, Data Viper&#8217;s Twitter account <a href="https://twitter.com/DataViperIO/status/1157797279132205057" target="_blank" rel="noopener noreferrer">casually noted</a>, &#8220;FiveStars &#8212; 44m breached records added &#8211; incl Name, Email, DOB.&#8221; The post, buried among a flurry of similar statements about huge caches of breached personal information added to Data Viper, received hardly any attention and garnered just one retweet.</p>
<h4>GNOSTIC PLAYERS, SHINY HUNTERS</h4>
<p>Reached <a href="https://twitter.com/vinnytroia" target="_blank" rel="noopener noreferrer">via Twitter</a>, Troia acknowledged that his site had been hacked, but said the attackers only got access to the development server for Data Viper, and not the more critical production systems that power the service and which house his index of compromised credentials.</p>
<p>Troia said the people responsible for compromising his site are the same people who hacked the databases they are now selling on the dark web and claiming to have obtained exclusively from his service.</p>
<p>What&#8217;s more, Troia believes the attack was a preemptive strike in response to a keynote he&#8217;s giving in Boston this week: On June 29, Troia <a href="https://twitter.com/vinnytroia/status/1277674993799872512" target="_blank" rel="noopener noreferrer">tweeted</a> that he plans to use the speech to publicly expose the identities of the hackers, who he suspects are behind a large number of website break-ins over the years.</p>
<p>Hacked or leaked credentials are prized by cybercriminals engaged in &#8220;credential stuffing,&#8221; a rampant form of cybercrime that succeeds when people use the same passwords across multiple websites. Armed with a list of email addresses and passwords from a breached site, attackers will then automate login attempts using those same credentials at hundreds of other sites.</p>
<p>Password re-use becomes orders of magnitude more dangerous when website developers engage in this unsafe practice. Indeed, <a href="https://www.dataviper.io/blog/2019/gnosticplayers-part-1-nclay-ddb-nsfw/" target="_blank" rel="noopener noreferrer">a January 2020 post on the Data Viper blog</a> suggests credential stuffing is exactly how the group he plans to discuss in his upcoming talk perpetrated their website compromises.</p>
<p>In that post, Troia wrote that the hacker group, known variously as &#8220;<strong>Gnostic Players</strong>&#8221; and &#8220;<strong>Shiny Hunters</strong>,&#8221; plundered countless website databases using roughly the same method: Targeting developers using credential stuffing attacks to log into their <strong>GitHub</strong> accounts.</p>
<p>&#8220;While there, they would pillage the code repositories, looking for AWS keys and similar credentials that were checked into code repositories,&#8221; Troia wrote.</p>
<p>Troia said the intrusion into his service wasn&#8217;t the result of the credential re-use, but instead because his developer accidentally left his credentials exposed in documents explaining how customers can use Data Viper&#8217;s application programming interface.</p>
<p>&#8220;I will say the irony of how they got in is absolutely amazing,&#8221; Troia said. &#8220;But all of this stuff they claim to be selling is [databases] they were already selling. All of this is from Gnostic players. None of it came from me. It’s all for show to try and discredit my report and my talk.&#8221;</p>
<p>Troia said he didn&#8217;t know how many of the databases Gnostic Players claimed to have obtained from his site were legitimate hacks or even public yet.</p>
<p>&#8220;As for public reporting on the databases, a lot of that will be in my report Wednesday,&#8221; he said. &#8220;All of my &#8216;reporting&#8217; goes to the FBI.&#8221;</p>
<h4>SMOKE AND MIRRORS</h4>
<p>The e-zine produced by the Data Viper hackers claimed that Troia used many nicknames on various cybercrime forums, including the moniker &#8220;Exabyte&#8221; on <strong>OGUsers</strong>, a forum that&#8217;s been <a href="https://krebsonsecurity.com/?s=ogusers&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">closely associated with account takeovers</a>.</p>
<p>In a conversation with KrebsOnSecurity, Troia acknowledged that this Exabyte attribution was correct, noting that he was happy about the exposure because it further solidified his suspicions about who was responsible for hacking his site.</p>
<p>This is interesting because some of the hacked databases the intruders claimed to have acquired after compromising Data Viper correspond to discoveries credited to Troia in which companies inadvertently exposed tens of millions of user details by leaving them publicly accessible online at cloud services like Amazon&#8217;s EC2.</p>
<p>For example, in March 2019, Troia said he&#8217;d <a href="https://www.wired.com/story/email-marketing-company-809-million-records-exposed-online/" target="_blank" rel="noopener noreferrer">co-discovered a publicly accessible database containing 150 gigabytes of plaintext marketing data</a> &#8212; including 763 million unique email addresses. The data had been exposed online by <strong>Verifications.io</strong>, an email validation firm.</p>
<p>On Oct 12, 2019, a new user named Exabyte registered on <strong>RaidForums</strong> &#8212; a site dedicated to sharing hacked databases and tools to perpetrate credential stuffing attacks. That Exabyte account was registered less than two weeks after Troia created his Exabyte identity on OGUsers. The Exabyte on RaidForums posted on Dec. 26, 2019 that he was providing the community with something of a belated Christmas present: 200 million accounts leaked from Verifications.io.</p>
<p>&#8220;Verifications.io is finally here!&#8221; Exabyte enthused. &#8220;This release contains 69 of 70 of the original verifications.io databases, totaling 200+ million accounts.&#8221;</p>
<div id="attachment_52215" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/dd8f1e95.exabyte.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/exabyte.png"><img aria-describedby="caption-attachment-52215" class="wp-image-52215" src="media/dd8f1e95.exabyte.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/exabyte.png" alt="" width="596" height="333" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/exabyte.png 1025w, https://krebsonsecurity.com/wp-content/uploads/2020/07/exabyte-580x324.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/07/exabyte-940x525.png 940w, https://krebsonsecurity.com/wp-content/uploads/2020/07/exabyte-768x429.png 768w" sizes="(max-width: 596px) 100vw, 596px" /></a><p id="caption-attachment-52215" class="wp-caption-text">Exabyte&#8217;s offer of the Verifications.io database on RaidForums.</p></div>
<p>In May 2018, Troia <a href="https://www.wired.com/story/apollo-breach-linkedin-salesforce-data/" target="_blank" rel="noopener noreferrer">was featured in <em>Wired.com</em></a> and many other publications after discovering that sales intelligence firm <strong>Apollo</strong> left 125 million email addresses and nine billion data points publicly exposed in a cloud service. As <a href="https://krebsonsecurity.com/2018/10/when-security-researchers-pose-as-cybercrooks-who-can-tell-the-difference/" target="_blank" rel="noopener noreferrer">I reported in 2018</a>, prior to that disclosure Troia had sought my help in identifying the source of the exposed data, which he&#8217;d initially and incorrectly concluded was exposed by <strong>LinkedIn.com</strong>. Rather, Apollo had scraped and collated the data from many different sites, including LinkedIn.</p>
<p>Then in August 2018, someone using the nickname &#8220;Soundcard&#8221; posted a sales thread to the now-defunct <strong>Kickass</strong> dark web forum offering the personal information of 212 million LinkedIn users in exchange for two bitcoin (then the equivalent of ~$12,000 USD). Incredibly, Troia had previously told me that he was the person behind that Soundcard identity on the Kickass forum.</p>
<div id="attachment_45259" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/c93afabb.soundcard-li.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/soundcard-li.png"><img aria-describedby="caption-attachment-45259" class="wp-image-45259" src="media/c93afabb.soundcard-li.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/soundcard-li.png" alt="" width="598" height="357" /></a><p id="caption-attachment-45259" class="wp-caption-text">Soundcard, a.k.a. Troia, offering to sell what he claimed was all of LinkedIn&#8217;s user data, on the Dark Web forum Kickass.</p></div>
<p>Asked about the Exabyte posts on RaidForums, Troia said he wasn&#8217;t the only one who had access to the Verifications.io data, and that the full scope of what&#8217;s been going on would become clearer soon.</p>
<p>&#8220;More than one person can have the same name &#8216;Exabyte,&#8221; Troia said. &#8220;So much from both sides you are seeing is smoke and mirrors.&#8221;</p>
<p>Smoke and mirrors, indeed. It&#8217;s entirely possible this incident is an elaborate and cynical PR stunt by Troia to somehow spring a trap on the bad guys. Troia recently published a book on threat hunting, and on <a href="media/895bf9c5.page360.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/page360.pdf" target="_blank" rel="noopener noreferrer">page 360</a> (PDF) he describes how he previously staged a hack against his own site and then bragged about the fake intrusion on cybercrime forums in a bid to gather information about specific cybercriminals who took the bait &#8212; the same people, by the way, he claims are behind the attack on his site.</p>
<p><span id="more-52201"></span></p>
<h4>MURKY WATERS</h4>
<p>While the trading of hacked databases may not technically be illegal in the United States, it&#8217;s fair to say the <strong>U.S. Department of Justice</strong> (DOJ) takes a dim view of those who operate services marketed to cybercriminals.</p>
<p>In January 2020, U.S. authorities <a href="https://www.zdnet.com/article/fbi-seizes-weleakinfo-a-website-that-sold-access-breached-data/" target="_blank" rel="noopener noreferrer">seized the domain of <strong>WeLeakInfo.com</strong></a>, an online service that for three years sold access to data hacked from other websites. Two men were arrested in connection with that seizure. In February 2017, the Justice Department took down <strong>LeakedSource</strong>, a service that operated similarly to WeLeakInfo.</p>
<p>The DOJ <a href="https://www.justice.gov/criminal-ccips/page/file/1252341/download" target="_blank" rel="noopener noreferrer">recently released guidance</a> (PDF) to help threat intelligence companies avoid the risk of prosecution when gathering and purchasing data from illicit sources online. The guidelines suggest that some types of intelligence gathering &#8212; particularly exchanging ill-gotten information with others on crime forums as a way to gain access to other data or to increase one&#8217;s status on the forum &#8212; could be especially problematic.</p>
<p>&#8220;If a practitioner becomes an active member of a forum and exchanges information and communicates directly with other forum members, the practitioner can quickly become enmeshed in illegal conduct, if not careful,&#8221; reads the Feb. 2020 DOJ document.</p>
<p>The document continues:</p>
<p>&#8220;It may be easier for an undercover practitioner to extract information from sources on the forum who have learned to trust the practitioner’s persona, but developing trust and establishing bona fides as a fellow criminal may involve offering useful information, services, or tools that can be used to commit crimes.&#8221;</p>
<p>&#8220;Engaging in such activities may well result in violating federal criminal law. Whether a crime has occurred usually hinges on an individual’s actions and intent. A practitioner must avoid doing anything that furthers the criminal objectives of others on the forums. Even though the practitioner has no intention of committing a crime, assisting others engaged in criminal conduct can constitute the federal offense of aiding and abetting.&#8221;</p>
<p>&#8220;An individual may be found liable for aiding and abetting a federal offense if her or she takes an affirmative act &#8212; even an act that is lawful on its own &#8212; that is in furtherance of the crime and conducted with the intent of facilitating the crime’s commission.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=52264
title: ‘Wormable’ Flaw Leads July Microsoft Patches
uri: Wormable-Flaw-Leads-July-Microsoft-Patches
url: https://krebsonsecurity.com/2020/07/wormable-flaw-leads-july-microsoft-patches/
content:
<p><strong>Microsoft</strong> today released updates to plug a whopping 123 security holes in <strong>Windows</strong> and related software, including fixes for a critical, &#8220;wormable&#8221; flaw in <strong>Windows Server</strong> versions that Microsoft says is likely to be exploited soon. While this particular weakness mainly affects enterprises, July&#8217;s care package from Redmond has a little something for everyone. So if you&#8217;re a Windows (ab)user, it&#8217;s time once again to back up and patch up (preferably in that order).</p>
<p><img class="aligncenter wp-image-52272" src="media/ca5fc0c3.cworm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/cworm.png" alt="" width="595" height="412" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/cworm.png 925w, https://krebsonsecurity.com/wp-content/uploads/2020/07/cworm-580x401.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/07/cworm-768x531.png 768w" sizes="(max-width: 595px) 100vw, 595px" />Top of the heap this month in terms of outright scariness is <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350" target="_blank" rel="noopener noreferrer">CVE-2020-1350</a>, which concerns a remotely exploitable bug in more or less all versions of Windows Server that attackers could use to install malicious software simply by sending a specially crafted DNS request.</p>
<p>Microsoft said it is not aware of reports that anyone is exploiting the weakness (yet), but the flaw has been assigned a <a href="https://www.first.org/cvss/user-guide" target="_blank" rel="noopener noreferrer">CVSS score</a> of 10, which translates to &#8220;easy to attack&#8221; and &#8220;likely to be exploited.&#8221;</p>
<p>&#8220;We consider this to be a wormable vulnerability, meaning that it has the potential to spread via malware between vulnerable computers without user interaction,&#8221; Microsoft wrote in its documentation of CVE-2020-1350. &#8220;DNS is a foundational networking component and commonly installed on Domain Controllers, so a compromise could lead to significant service interruptions and the compromise of high level domain accounts.&#8221;</p>
<p>CVE-2020-1350 is just the latest worry for enterprise system administrators in charge of patching dangerous bugs in widely-used software. Over the past couple of weeks, fixes for flaws with high severity ratings have been released for a broad array of software products typically used by businesses, <a href="https://www.zdnet.com/article/recon-bug-lets-hackers-create-admin-accounts-on-sap-servers/" target="_blank" rel="noopener noreferrer">including Citrix, F5, Juniper, Oracle and SAP</a>. This at a time when many organizations are already short-staffed and dealing with employees working remotely thanks to the COVID-19 pandemic.</p>
<p>The Windows Server isn&#8217;t the only nasty one addressed this month that malware or malcontents can use to break into systems without any help from users. A full 17 other critical flaws fixed in this release tackle security weaknesses that Microsoft assigned its most dire &#8220;critical&#8221; rating, such as in <strong>Office</strong>, <strong>Internet Exploder</strong>, <strong>SharePoint</strong>, <strong>Visual Studio</strong>, and Microsoft&#8217;s <strong>.NET Framework</strong>.<span id="more-52264"></span></p>
<p>Some of the more eyebrow-raising critical bugs addressed this month include <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1410" target="_blank" rel="noopener noreferrer">CVE-2020-1410</a>, which according to <strong>Recorded Future</strong> concerns the Windows Address Book and could be exploited via a malicious vcard file. Then there&#8217;s <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1421" target="_blank" rel="noopener noreferrer">CVE-2020-1421</a>, which protects against potentially malicious .LNK files (think <a href="https://krebsonsecurity.com/2010/07/microsoft-to-issue-emergency-patch-for-critical-windows-bug/" target="_blank" rel="noopener noreferrer">Stuxnet</a>) that could be exploited via an infected removable drive or remote share. And we have the dynamic duo of <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1435" target="_blank" rel="noopener noreferrer">CVE-2020-1435</a> and <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1436" target="_blank" rel="noopener noreferrer">CVE-2020-1436</a>, which involve problems with the way Windows handles images and fonts that could both be exploited to install malware just by getting a user to click a booby-trapped link or document.</p>
<p>Not to say flaws rated &#8220;important&#8221; as opposed to critical aren&#8217;t also a concern. Chief among those is <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1463" target="_blank" rel="noopener noreferrer">CVE-2020-1463</a>, a problem within <strong>Windows 10</strong> and <strong>Server 2016</strong> or later that was detailed publicly prior to this month&#8217;s Patch Tuesday.</p>
<p>Before you update with this month’s patch batch, please make sure you have backed up your system and/or important files. It’s not uncommon for a particular Windows update to hose one’s system or prevent it from booting properly, and some updates even have been known to erase or corrupt files. Last month&#8217;s bundle of joy from Microsoft sent my Windows 10 system into a perpetual crash state. Thankfully, I was able to restore from a recent backup.</p>
<p>So do yourself a favor and backup <em>before</em> installing any patches. Windows 10 even has <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">some built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>Also, keep in mind that Windows 10 is set to apply patches on its own schedule, which means if you delay backing up you could be in for a wild ride. If you wish to ensure the operating system has been set to pause updating so you can back up your files and/or system <em>before</em> the operating system decides to reboot and install patches whenever it sees fit, see <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">this guide</a>.</p>
<p>As always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips. Also, keep an eye on <a href="https://www.askwoody.com/" target="_blank" rel="noopener noreferrer">the AskWoody blog from Woody Leonhard</a>, who keeps a reliable lookout for buggy Microsoft updates each month.</p>


feed_id: https://krebsonsecurity.com/?p=52278
title: Who’s Behind Wednesday’s Epic Twitter Hack?
uri: Who-s-Behind-Wednesday-s-Epic-Twitter-Hack
url: https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/
content:
<p><strong>Twitter</strong> was thrown into chaos on Wednesday after accounts for some of the world&#8217;s most recognizable public figures, executives and celebrities starting tweeting out links to bitcoin scams. Twitter says the attack happened because someone tricked or coerced an employee into providing access to internal Twitter administrative tools. This post is an attempt to lay out some of the timeline of this attack, and point to clues about who may have been behind it.</p>
<p>The first public signs of the intrusion came around 3 PM EST, when the Twitter account for the cryptocurrency exchange Binance <a href="https://www.binance.com/en/blog/421499824684900753/Statement-on-Twitter-Breach" target="_blank" rel="noopener noreferrer">tweeted a message</a> saying it had partnered with &#8220;CryptoForHealth&#8221; to give back 5000 bitcoin to the community, with a link where people could donate or send money.</p>
<p>Minutes after that, similar tweets went out from the accounts of other cryptocurrency exchanges, and from the Twitter accounts for democratic presidential candidate <strong>Joe Biden</strong>, <strong>Amazon CEO Jeff Bezos</strong>, <strong>President Barak Obama</strong>, <strong>Tesla CEO Elon Musk</strong>, former New York Mayor <strong>Michael Bloomberg</strong> and investment mogul <strong>Warren Buffet</strong>.</p>
<p><img class="aligncenter wp-image-52296" src="media/63a051ed.bezos-hack.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/bezos-hack.png" alt="" width="553" height="682" /></p>
<p>While it may sound ridiculous that anyone would be fooled into sending bitcoin in response to these tweets, an analysis of <a href="https://www.blockchain.com/btc/address/bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh?page=31" target="_blank" rel="noopener noreferrer">the BTC wallet</a> promoted by many of the hacked Twitter profiles shows that on July 15 the account processed 383 transactions and received almost 13 bitcoin on July 15 &#8212; or approximately USD $117,000.</p>
<p>Twitter issued <a href="https://twitter.com/TwitterSupport/status/1283591846464233474" target="_blank" rel="noopener noreferrer">a statement</a> saying it detected &#8220;a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools. We know they used this access to take control of many highly-visible (including verified) accounts and Tweet on their behalf. We’re looking into what other malicious activity they may have conducted or information they may have accessed and will share more here as we have it.&#8221;</p>
<p>There are strong indications that this attack was perpetrated by individuals who&#8217;ve traditionally specialized in hijacking social media accounts via &#8220;<a href="https://krebsonsecurity.com/?s=sim+swapping&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">SIM swapping</a>,&#8221; an increasingly rampant form of crime that involves bribing, hacking or coercing employees at mobile phone and social media companies into providing access to a target&#8217;s account.</p>
<p>People within the SIM swapping community are obsessed with hijacking so-called &#8220;OG&#8221; social media accounts. Short for &#8220;original gangster,&#8221; OG accounts typically are those with short account names (such as @B or @joe). Possession of these OG accounts confers a measure of status and perceived influence and wealth in SIM swapping circles, as such accounts can often fetch thousands of dollars when resold in the underground.</p>
<p>In the days leading up to Wednesday&#8217;s attack on Twitter, there were signs that some actors in the SIM swapping community were selling the ability to change an email address tied to any Twitter account. In a post on OGusers &#8212; <a href="https://krebsonsecurity.com/?s=ogusers&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">a forum dedicated to account hijacking </a>&#8212; a user named &#8220;<strong>Chaewon</strong>&#8221; advertised they could change email address tied to <em>any</em> Twitter account for $250, and provide direct access to accounts for between $2,000 and $3,000 apiece.</p>
<div id="attachment_52281" style="width: 600px" class="wp-caption aligncenter"><a class="lightbox" href="media/7f26d0c8.chaewon.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/chaewon.png"><img aria-describedby="caption-attachment-52281" class="wp-image-52281" src="media/7f26d0c8.chaewon.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/chaewon.png" alt="" width="590" height="321" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/chaewon.png 1518w, https://krebsonsecurity.com/wp-content/uploads/2020/07/chaewon-580x316.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/07/chaewon-940x511.png 940w, https://krebsonsecurity.com/wp-content/uploads/2020/07/chaewon-768x418.png 768w" sizes="(max-width: 590px) 100vw, 590px" /></a><p id="caption-attachment-52281" class="wp-caption-text">The OGUsers forum user &#8220;Chaewon&#8221; taking requests to modify the email address tied to any twitter account.</p></div>
<p>&#8220;This is NOT a method, you will be given a full refund if for any reason you aren&#8217;t given the email/@, however if it is revered/suspended I will not be held accountable,&#8221; Chaewon wrote in their sales thread, which was titled &#8220;Pulling email for any Twitter/Taking Requests.&#8221;</p>
<p>Hours before any of the Twitter accounts for cryptocurrency platforms or public figures began blasting out bitcoin scams on Wednesday, the attackers appear to have focused their attention on hijacking a handful of OG accounts, including &#8220;<strong>@6.</strong>&#8221;</p>
<p>That Twitter account was formerly owned by <a href="https://krebsonsecurity.com/2018/03/adrian-lamo-homeless-hacker-who-turned-in-chelsea-manning-dead-at-37/" target="_blank" rel="noopener noreferrer">Adrian Lamo</a> &#8212; the now-deceased &#8220;homeless hacker&#8221; perhaps best known for breaking into the New York Times&#8217;s network and for reporting <a href="https://en.wikipedia.org/wiki/Chelsea_Manning" target="_blank" rel="noopener noreferrer">Chelsea Manning</a>&#8216;s theft of classified documents. @6 is now controlled by Lamo&#8217;s longtime friend, a security researcher and <a href="https://en.wikipedia.org/wiki/Phreaking" target="_blank" rel="noopener noreferrer">phone phreaker</a> who asked to be identified in this story only by his Twitter nickname, &#8220;<a href="https://twitter.com/lucky225/status/1283525414896320512?s=19" target="_blank" rel="noopener noreferrer"><strong>Lucky225</strong></a>.&#8221;</p>
<p>Lucky225 said that just before 2 p.m. EST on Wednesday, he received a password reset confirmation code via Google Voice for the @6 Twitter account. Lucky said he&#8217;d previously disabled SMS notifications via his Google Voice number as a means of receiving multi-factor codes from Twitter, opting instead to have one-time codes generated by a mobile authentication app.</p>
<p>But because the attackers were able to change the email address tied to the @6 account and disable multi-factor authentication, the one-time authentication code was sent to both his Google Voice account <em>and</em> to the new email address added by the attackers.</p>
<p>&#8220;The way the attack worked was that within Twitter&#8217;s admin tools, apparently you can update the email address of any Twitter user, and it does this without sending any kind of notification to the user,&#8221; Lucky told KrebsOnSecurity. &#8220;So [the attackers] could avoid detection by updating the email address on the account first, and then turning off 2FA.&#8221;</p>
<p>Lucky said he still hasn&#8217;t been able to review whether any tweets were sent from his account during the time it was hijacked because he still doesn&#8217;t have access to it (he has put together a breakdown of the entire episode <a href="https://medium.com/@lucky225/the-twitter-hack-what-exactly-happened-d8740d33c1c" target="_blank" rel="noopener noreferrer">at this Medium post</a>).</p>
<p>But around the same time @6 was hijacked, another OG account &#8211; <strong>@B</strong> &#8212; was swiped. The person in control of that account then began tweeting out pictures of Twitter&#8217;s internal tools panel.</p>
<div id="attachment_52282" style="width: 464px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-52282" class="size-full wp-image-52282" src="media/3a48559f.atb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/atb.png" alt="" width="454" height="603" /><p id="caption-attachment-52282" class="wp-caption-text">A screenshot of the hijacked OG Twitter account &#8220;@B,&#8221; shows the hijackers logged in to Twitter&#8217;s internal account tools interface.</p></div>
<p>Twitter responded by removing any tweets across its platform that included screenshots of its internal tools, and in some cases temporarily suspended the ability of those accounts to tweet further.</p>
<p>Another Twitter account &#8212; <strong>@shinji</strong> &#8212; also was tweeting out screenshots of Twitters internal tools. Minutes before Twitter terminated the @shinji account, it was seen publishing a tweet saying &#8220;follow @6,&#8221; referring to the account hijacked from Lucky225.</p>
<div id="attachment_52283" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/f77188bd.shinji-r.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/shinji-r.png"><img aria-describedby="caption-attachment-52283" class="wp-image-52283" src="media/f77188bd.shinji-r.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/shinji-r.png" alt="" width="594" height="382" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/shinji-r.png 651w, https://krebsonsecurity.com/wp-content/uploads/2020/07/shinji-r-580x373.png 580w" sizes="(max-width: 594px) 100vw, 594px" /></a><p id="caption-attachment-52283" class="wp-caption-text">The account &#8220;@shinji&#8221; tweeting a screenshot of Twitter&#8217;s internal tools interface.</p></div>
<p>Cached copies of @Shinji&#8217;s tweets prior to Wednesday&#8217;s attack on Twitter are available <a href="https://archive.vn/Abr3l" target="_blank" rel="noopener noreferrer">here</a> and <a href="https://archive.vn/YGS0T" target="_blank" rel="noopener noreferrer">here</a> from the <strong>Internet Archive</strong>. Those caches show Shinji claims ownership of two OG accounts on Instagram &#8212; &#8220;<a href="https://www.instagram.com/j0e/" target="_blank" rel="noopener noreferrer">j0e</a>&#8221; and &#8220;<a href="https://www.instagram.com/dead/" target="_blank" rel="noopener noreferrer">dead</a>.&#8221;</p>
<p>KrebsOnSecurity heard from a source who works in security at one of the largest U.S.-based mobile carriers, who said the &#8220;j0e&#8221; and &#8220;dead&#8221; Instagram accounts are tied to a notorious SIM swapper who goes by the nickname &#8220;<strong>PlugWalkJoe</strong>.&#8221; Investigators have been tracking PlugWalkJoe because he is thought to have been involved in multiple SIM swapping attacks over the years that preceded high-dollar bitcoin heists.</p>
<div id="attachment_52288" style="width: 601px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-52288" class="size-full wp-image-52288" src="media/0b7af794.shinji-archive1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/shinji-archive1.png" alt="" width="591" height="386" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/shinji-archive1.png 591w, https://krebsonsecurity.com/wp-content/uploads/2020/07/shinji-archive1-580x379.png 580w" sizes="(max-width: 591px) 100vw, 591px" /><p id="caption-attachment-52288" class="wp-caption-text">Archived copies of the @Shinji account on twitter shows one of Joe&#8217;s OG Instagram accounts, &#8220;Dead.&#8221;</p></div>
<p>Now look at the profile image in the other Archive.org index of the @shinji Twitter account (pictured below). It is the same image as the one included in the @Shinji screenshot above from Wednesday in which Joseph/@Shinji was tweeting out pictures of Twitter&#8217;s internal tools.</p>
<div id="attachment_52292" style="width: 608px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-52292" class=" wp-image-52292" src="media/60c662ee.shinjo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/shinjo.png" alt="" width="598" height="291" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/shinjo.png 693w, https://krebsonsecurity.com/wp-content/uploads/2020/07/shinjo-580x282.png 580w" sizes="(max-width: 598px) 100vw, 598px" /><p id="caption-attachment-52292" class="wp-caption-text">Image: Archive.org</p></div>
<p>This individual, the source said, was a key participant in a group of SIM swappers that adopted the nickname &#8220;<strong>ChucklingSquad</strong>,&#8221; and was thought to be behind the hijacking of <strong>Twitter CEO Jack Dorsey</strong>&#8216;s Twitter account last year. As <a href="https://www.wired.com/story/jack-dorsey-twitter-hacked/" target="_blank" rel="noopener noreferrer">Wired.com recounted</a>, @jack was hijacked after the attackers conducted a SIM swap attack against <strong>AT&amp;T</strong>, the mobile provider for the phone number tied to Dorsey&#8217;s Twitter account.</p>
<div id="attachment_52286" style="width: 563px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-52286" class=" wp-image-52286" src="media/784c6898.jack-tweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/jack-tweet.png" alt="" width="553" height="571" /><p id="caption-attachment-52286" class="wp-caption-text">A tweet sent out from Twitter CEO Jack Dorsey&#8217;s account while it was hijacked shouted out to PlugWalkJoe and other Chuckling Squad members.</p></div>
<p><span id="more-52278"></span></p>
<p>The mobile industry security source told KrebsOnSecurity that PlugWalkJoe in real life is a 21-year-old from Liverpool, U.K. named <strong>Joseph James Connor</strong>. The source said PlugWalkJoe is in Spain where he was attending a university until earlier this year. He added that PlugWalkJoe has been unable to return home on account of travel restrictions due to the COVID-19 pandemic.</p>
<p>The mobile industry source said PlugWalkJoe was the subject of an investigation in which a female investigator was hired to strike up a conversation with PlugWalkJoe and convince him to agree to a video chat. The source further explained that a video which they recorded of that chat showed a distinctive swimming pool in the background.</p>
<p>According to that same source, the pool pictured on PlugWalkJoe&#8217;s Instagram account (instagram.com/j0e) is the same one they saw in their video chat with him.</p>
<p><img class="aligncenter wp-image-52293" src="media/974a107e.j0epool.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/j0epool.png" alt="" width="599" height="489" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/j0epool.png 943w, https://krebsonsecurity.com/wp-content/uploads/2020/07/j0epool-580x474.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/07/j0epool-940x768.png 940w, https://krebsonsecurity.com/wp-content/uploads/2020/07/j0epool-768x627.png 768w" sizes="(max-width: 599px) 100vw, 599px" /></p>
<p>If PlugWalkJoe was in fact pivotal to this Twitter compromise, it&#8217;s perhaps fitting that he was identified in part via social engineering. Maybe we should all be grateful the perpetrators of this attack on Twitter did not set their sights on more ambitious aims, such as disrupting an election or the stock market, or attempting to start a war by issuing false, inflammatory tweets from world leaders.</p>
<p>Also, it seems clear that this Twitter hack could have let the attackers view the direct messages of anyone on Twitter, information that is difficult to put a price on but which nevertheless would be of great interest to a variety of parties, from nation states to corporate spies and blackmailers.</p>
<p>This is a fast-moving story. Please stay tuned for further updates.</p>


feed_id: https://krebsonsecurity.com/?p=52323
title: Twitter Hacking for Profit and the LoLs
uri: Twitter-Hacking-for-Profit-and-the-LoLs
url: https://krebsonsecurity.com/2020/07/twitter-hacking-for-profit-and-the-lols/
content:
<p><em>The New York Times</em> last week ran an interview with several young men who claimed to have had direct contact with those involved in last week&#8217;s epic hack against Twitter. These individuals said they were only customers of the person who had access to Twitter&#8217;s internal employee tools, and were not responsible for the actual intrusion or bitcoin scams that took place that day. But new information suggests that at least two of them operated a service that resold access to Twitter employees for the purposes of modifying or seizing control of prized Twitter profiles.</p>
<p>As first <a href="https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/" target="_blank" rel="noopener noreferrer">reported here on July 16,</a> prior to bitcoin scam messages being blasted out from such high-profile Twitter accounts @barackobama, @joebiden, @elonmusk and @billgates, several highly desirable short-character Twitter account names changed hands, including @L, @6 and @W.</p>
<div id="attachment_52340" style="width: 520px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-52340" class=" wp-image-52340" src="media/5297da46.resetl.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/resetl.png" alt="" width="510" height="597" /><p id="caption-attachment-52340" class="wp-caption-text">A screenshot of a Discord discussion between the key Twitter hacker &#8220;Kirk&#8221; and several people seeking to hijack high-value Twitter accounts.</p></div>
<p>Known as “original gangster” or &#8220;OG&#8221; accounts, short-character profile names confer a measure of status and wealth in certain online communities, and such accounts can often fetch thousands of dollars when resold in the underground.</p>
<p>The people involved in obtaining those OG accounts on July 15 said they got them from a person identified only as &#8220;Kirk,&#8221; who claimed to be a Twitter employee. According to <a href="https://www.nytimes.com/2020/07/17/technology/twitter-hackers-interview.html?action=click&amp;module=Top%20Stories&amp;pgtype=Homepage" target="_blank" rel="noopener noreferrer">The Times</a>, Kirk first reached out to the group through a hacker who used the screen name &#8220;<strong>lol</strong>&#8221; on <strong>OGusers</strong>, a forum dedicated to helping users hijack and resell OG accounts from Twitter and other social media platforms. From The Times&#8217;s story:</p>
<blockquote><p>&#8220;The hacker &#8216;lol&#8217; and another one he worked with, who went by the screen name &#8216;ever so anxious,&#8217; told The Times that they wanted to talk about their work with Kirk in order to prove that they had only facilitated the purchases and takeovers of lesser-known Twitter addresses early in the day. They said they had not continued to work with Kirk once he began more high-profile attacks around 3:30 p.m. Eastern time on Wednesday.</p>
<p>&#8216;lol&#8217; did not confirm his real-world identity, but said he lived on the West Coast and was in his 20s. “ever so anxious” said he was 19 and lived in the south of England with his mother.</p>
<p>Kirk connected with “lol” late Tuesday and then “ever so anxious” on Discord early on Wednesday, and asked if they wanted to be his middlemen, selling Twitter accounts to the online underworld where they were known. They would take a cut from each transaction.&#8221;</p></blockquote>
<p>Twice in the past year, the <a href="https://krebsonsecurity.com/?s=ogusers&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">OGUsers forum was hacked</a>, and both times its database of usernames, email addresses and private messages was leaked online. A review of the private messages for &#8220;lol&#8221; on OGUsers provides a glimpse into the vibrant market for the resale of prized OG accounts.</p>
<p>On OGUsers, lol was known to other members as someone who had a direct connection to one or more people working at Twitter who could be used to help fellow members gain access to Twitter profiles, including those that had been suspended for one reason or another. In fact, this was how lol introduced himself to the OGUsers community when he first joined.</p>
<p>&#8220;I have a twitter contact who I can get users from (to an extent) and I believe I can get verification from,&#8221; lol explained.</p>
<p>In a direct message exchange on OGUsers from November 2019, lol is asked for help from another OGUser member whose Twitter account had been suspended for abuse.</p>
<p>&#8220;hello saw u talking about a twitter rep could you please ask if she would be able to help unsus [unsuspend] my main and my friends business account will pay 800-1k for each,&#8221; the OGUusers profile inquires of lol.</p>
<p>Lol says he can&#8217;t promise anything but will look into it. &#8220;I sent her that, not sure if I will get a reply today bc its the weekend but ill let u know,&#8221; Lol says.</p>
<p>In another exchange, an OGUser denizen quizzes lol about his Twitter hookup.</p>
<p>&#8220;Does she charge for escalations? And how do you know her/what is her department/job. How do you connect with them if I may ask?&#8221;</p>
<p>&#8220;They are in the Client success team,&#8221; lol replies. &#8220;No they don&#8217;t charge, and I know them through a connection.&#8221;</p>
<p>As for how he got access to the Twitter employee, lol declines to elaborate, saying it&#8217;s a private method. &#8220;It&#8217;s a lil method, sorry I cant say.&#8221;</p>
<p>In another direct message, lol asks a fellow OGUser member to edit a comment in a forum discussion which included the Twitter account &#8220;<strong>@tankska</strong>,&#8221; saying it was his IRL (in real life) Twitter account and that he didn&#8217;t want to risk it getting found out or suspended (Twitter says this account doesn&#8217;t exist, but <a href="https://twitter.com/search?q=tankska&amp;src=typed_query" target="_blank" rel="noopener noreferrer">a simple text search on Twitter</a> shows the profile was active until late 2019).</p>
<p>&#8220;can u edit that comment out, @tankska is a gaming twitter of mine and i dont want it to be on ogu :D&#8217;,&#8221; lol wrote. &#8220;just dont want my irl getting sus[pended].&#8221;</p>
<p>Still another OGUser member would post lol&#8217;s identifying information into a forum thread, calling lol by his first name &#8212; &#8220;Josh&#8221; &#8212; in a post asking lol what he might offer in an auction for a specific OG name.</p>
<p>&#8220;Put me down for 100, but don&#8217;t note my name in the thread please,&#8221; lol wrote.</p>
<h4>WHO IS LOL?</h4>
<p>The information in lol&#8217;s OGUsers registration profile indicates he was probably being truthful with The Times about his location. The hacked forum database shows a user &#8220;tankska&#8221; registered on OGUsers back in July 2018, but only made one post asking about the price of an older Twitter account for sale.</p>
<p>The person who registered the tankska account on OGUsers did so with the email address <strong>jperry94526@gmail.com</strong>, and from an Internet address tied to the <strong>San Ramon Unified School District</strong> in Danville, Calif.</p>
<p>According to <a href="https://www.4iq.com" target="_blank" rel="noopener noreferrer">4iq.com</a>, a service that indexes account details like usernames and passwords exposed in Web site data breaches, the jperry94526 email address was used to register accounts at several other sites over the years, including one at the apparel store Stockx.com under the profile name <strong>Josh Perry</strong>.</p>
<p>Tankska was active only briefly on OGUsers, but the hacked OGUsers database shows that &#8220;lol&#8221; changed his username three times over the years. Initially, it was &#8220;freej0sh,&#8221; followed by just &#8220;j0sh.&#8221;</p>
<p>lol did not respond to requests for comment sent to email addresses tied to his various OGU profiles and Instagram accounts.</p>
<h4>ALWAYS IN DISCORD</h4>
<p>Last week&#8217;s story on the Twitter compromise noted that just before the bitcoin scam tweets went out, several OG usernames changed hands. The story traced screenshots of Twitter tools posted online back to a moniker that is well-known in the OGUsers circle: <a href="media/da7f025e.pwj-mason.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/pwj-mason.png" target="_blank" rel="noopener noreferrer">PlugWalkJoe</a>, a 21-year-old from the United Kingdom.</p>
<p>Speaking with <em>The Times</em>, PlugWalkJoe &#8212; whose real name is <strong>Joseph O&#8217;Connor</strong> &#8212; said while he acquired a single OG Twitter account (<a href="https://medium.com/@lucky225/the-twitter-hack-what-exactly-happened-d8740d33c1c" target="_blank" rel="noopener noreferrer">@6</a>) through one of the hackers in direct communication with Kirk, he was otherwise not involved in the conversation.</p>
<p>&#8220;I don&#8217;t care,&#8221; O&#8217;Connor told The Times. &#8220;They can come arrest me. I would laugh at them. I haven&#8217;t done anything.&#8221;</p>
<p>In an interview with KrebsOnSecurity, O&#8217;Connor likewise asserted his innocence, suggesting at least a half dozen other hacker handles that may have been Kirk or someone who worked with Kirk on July 15, including &#8220;Voku,&#8221; &#8220;Crim/Criminal,&#8221; &#8220;Promo,&#8221; and &#8220;Aqua.&#8221;</p>
<p>&#8220;That twit screenshot was the first time in a while I joke[d], and evidently I shouldn&#8217;t have,&#8221; he said. &#8220;Joking is what got me into this mess.&#8221;</p>
<p>O&#8217;Connor shared a number of screenshots from a <a href="https://en.wikipedia.org/wiki/Discord_(software)" target="_blank" rel="noopener noreferrer">Discord</a> chat conversation on the day of the Twitter hack between Kirk and two others: &#8220;<strong>Alive</strong>,&#8221; which is another handle used by lol, and &#8220;<strong>Ever So Anxious.</strong>&#8221; Both were described by The Times as middlemen who sought to resell OG Twitter names obtained from Kirk. O&#8217;Connor is referenced in these screenshots as both &#8220;PWJ&#8221; and by his Discord handle, &#8220;<strong>Beyond Insane</strong>.&#8221;</p>
<div id="attachment_52337" style="width: 412px" class="wp-caption aligncenter"><a class="lightbox" href="media/b5293476.beyondkirk.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/beyondkirk.png"><img aria-describedby="caption-attachment-52337" class="wp-image-52337 size-full" src="media/b5293476.beyondkirk.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/beyondkirk.png" alt="" width="402" height="540" /></a><p id="caption-attachment-52337" class="wp-caption-text">The negotiations over highly-prized OG Twitter usernames took place just prior to the hijacked celebrity accounts tweeting out bitcoin scams.</p></div>
<p>Ever So Anxious told Kirk his OGU nickname was &#8220;<strong>Chaewon</strong>,&#8221; which corresponds to a user in the United Kingdom. Just prior to the Twitter compromise, Chaewon <a href="media/7f26d0c8.chaewon.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/chaewon.png" target="_blank" rel="noopener noreferrer">advertised a service on the forum</a> that could change the email address tied to any Twitter account for around $250 worth of bitcoin. O&#8217;Connor said Chaewon also operates under the hacker alias &#8220;<strong>Mason</strong>.&#8221;</p>
<div id="attachment_52338" style="width: 367px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-52338" class="size-full wp-image-52338" src="media/e9afa3c4.chaewon-kirk.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/chaewon-kirk.png" alt="" width="357" height="627" /><p id="caption-attachment-52338" class="wp-caption-text">&#8220;Ever So Anxious&#8221; tells Kirk his OGUsers handle is &#8220;Chaewon,&#8221; and asks Kirk to modify the display names of different OG Twitter handles to read &#8220;lol&#8221; and &#8220;PWJ&#8221;.</p></div>
<p>At one point in the conversation, Kirk tells Alive and Ever So Anxious to send funds for any OG usernames they want to <a href="https://www.blockchain.com/btc/address/1Ai52Uw6usjhpcDrwSmkUvjuqLpcznUuyF" target="_blank" rel="noopener noreferrer">this bitcoin address</a>. The payment history of that address shows that it indeed also received approximately $180,000 worth of bitcoin from the wallet address tied to <a href="media/63a051ed.bezos-hack.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/bezos-hack.png" target="_blank" rel="noopener noreferrer">the scam messages tweeted out on July 15 by the compromised celebrity accounts</a>.</p>
<div id="attachment_52335" style="width: 563px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-52335" class="wp-image-52335 size-full" src="media/47c7ac99.kirk3-e.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/kirk3-e.png" alt="" width="553" height="484" /><p id="caption-attachment-52335" class="wp-caption-text">The Twitter hacker &#8220;Kirk&#8221; telling lol/Alive and Chaewon/Mason/Ever So Anxious where to send the funds for the OG Twitter accounts they wanted.</p></div>
<p><span id="more-52323"></span></p>
<h4>SWIMPING</h4>
<p>My July 15 story observed there were strong indications that the people involved in the Twitter hack have connections to <a href="https://krebsonsecurity.com/?s=sim+swapping&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">SIM swapping</a>, an increasingly rampant form of crime that involves bribing, hacking or coercing employees at mobile phone and social media companies into providing access to a target’s account.</p>
<div id="attachment_52283" style="width: 602px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-52283" class=" wp-image-52283" src="media/f77188bd.shinji-r.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/shinji-r.png" alt="" width="592" height="381" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/shinji-r.png 651w, https://krebsonsecurity.com/wp-content/uploads/2020/07/shinji-r-580x373.png 580w" sizes="(max-width: 592px) 100vw, 592px" /><p id="caption-attachment-52283" class="wp-caption-text">The account &#8220;@shinji,&#8221; a.k.a. &#8220;PlugWalkJoe,&#8221; tweeting a screenshot of Twitter&#8217;s internal tools interface.</p></div>
<p>SIM swapping was thought to be behind the hijacking of <strong>Twitter CEO Jack Dorsey</strong>‘s Twitter account last year. As <a href="https://www.wired.com/story/jack-dorsey-twitter-hacked/" target="_blank" rel="noopener noreferrer">recounted by Wired.com</a>, @jack was hijacked after the attackers conducted a SIM swap attack against AT&amp;T, the mobile provider for the phone number tied to Dorsey’s Twitter account.</p>
<p>Immediately after Jack Dorsey&#8217;s Twitter handle was hijacked, the hackers tweeted out several shout-outs, <a href="media/784c6898.jack-tweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/jack-tweet.png" target="_blank" rel="noopener noreferrer">including one to @PlugWalkJoe</a>. O&#8217;Connor told KrebsOnSecurity he has never been involved in SIM swapping, although that statement was contradicted by two law enforcement sources who closely track such crimes.</p>
<p>However, Chaewon&#8217;s private messages on OGusers indicate that he very much was involved in SIM swapping. Use of the term &#8220;SIM swapping&#8221; was not allowed on OGusers, and the forum administrators created an automated script that would watch for anyone trying to post the term into a private message or discussion thread.</p>
<p>The script would replace the term with &#8220;I do not condone illegal activities.&#8221; Hence, a portmanteau was sometimes used: &#8220;Swimping.&#8221;</p>
<p>&#8220;Are you still swimping?&#8221; one OGUser member asks of Chaewon on Mar. 24, 2020. &#8220;If so and got targs lmk your discord.&#8221; Chaewon responds in the affirmative, and asks the other user to share his account name on <strong>Wickr</strong>, an encrypted online messaging app that automatically deletes messages after a few days.</p>
<p>Chaewon/Ever So Anxious/Mason did not respond to requests for comment.</p>
<p>O&#8217;Connor told KrebsOnSecurity that one of the individuals thought to be associated with the July 15 Twitter hack &#8212; a young man who goes by the nickname &#8220;Voku&#8221; &#8212; is still actively involved in SIM-swapping, particularly against customers of <strong>AT&amp;T</strong> and <strong>Verizon</strong>.</p>
<p>Voku is one of several hacker handles used by a Canton, Mich. youth whose mom turned him in to the local police in February 2018 when she overheard him talking on the phone and pretending to be an AT&amp;T employee. Officers responding to the report searched the residence and found multiple cell phones and SIM cards, as well as files on the kid’s computer that included “an extensive list of names and phone numbers of people from around the world.”</p>
<p>The following month, Michigan authorities found the same individual accessing personal consumer data via public Wi-Fi at a local library, and seized 45 SIM cards, a laptop and a Trezor wallet — a hardware device designed to store crytpocurrency account data. In April 2018, Voku&#8217;s mom again called the cops on her son — identified only as confidential source #1 (“CS1”) in the criminal complaint against him — saying he’d obtained yet another mobile phone.</p>
<p>Voku&#8217;s cooperation with authorities led them <a href="https://krebsonsecurity.com/2018/08/florida-man-arrested-in-sim-swap-conspiracy/" target="_blank" rel="noopener noreferrer">to bust up a conspiracy involving at least nine individuals</a> who stole millions of dollars worth of cryptocurrency and other items of value from their targets.</p>
<h4>CONSPIRACY</h4>
<p><strong>Samy Tarazi</strong>, an investigator with the Santa Clara County District Attorney&#8217;s Office, has spent hundreds of hours tracking young hackers during his tenure with <a href="https://krebsonsecurity.com/2018/11/busting-sim-swappers-and-sim-swap-myths/" target="_blank" rel="noopener noreferrer">REACT, a task force set up to combat SIM swapping and bring SIM swappers to justice</a>.</p>
<p>According to Tarazi, multiple actors in the cybercrime underground are constantly targeting people who work in key roles at major social media and online gaming platforms, from Twitter and Instagram to Sony, Playstation and Xbox.</p>
<p>Tarazi said some people engaged in this activity seek to woo their targets, sometimes offering them bribes in exchange for the occasional request to unban or change the ownership of specific accounts.</p>
<p>All too often, however, employees at these social media and gaming platforms find themselves the object of extremely hostile and persistent personal attacks that threaten them and their families unless and until they give in to demands.</p>
<p>&#8220;In some cases, they&#8217;re just hitting up employees saying, &#8216;Hey, I&#8217;ve got a business opportunity for you, do you want to make some money?'&#8221; Tarazi explained. &#8220;In other cases, they&#8217;ve done everything from SIM swapping and <a href="https://krebsonsecurity.com/?s=swatting&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">swatting</a> the victim many times to posting their personal details online or extorting the victims to give up access.&#8221;</p>
<p><strong>Allison Nixon</strong> is chief research officer at <a href="https://www.unit221b.com" target="_blank" rel="noopener noreferrer">Unit 221B</a>, a cyber investigations company based in New York. Nixon says she doesn&#8217;t buy the idea that PlugWalkJoe, lol, and Ever So Anxious are somehow less culpable in the Twitter compromise, even if their claims of not being involved in the July 15 Twitter bitcoin scam are accurate.</p>
<p>&#8220;You have the hackers like Kirk who can get the goods, and the money people who can help them profit &#8212; the buyers and the resellers,&#8221; Nixon said. &#8220;Without the buyers and the resellers, there is no incentive to hack into all these social media and gaming companies.&#8221;</p>
<p><strong>Mark Rasch</strong>, Unit 221B&#8217;s general counsel and a former U.S. federal prosecutor, said all of the players involved in the Twitter compromise of July 15 can be charged with conspiracy, a legal concept in the criminal statute which holds that any co-conspirators are liable for the acts of any other co-conspirator in furtherance of the crime, even if they don&#8217;t know who those other people are in real life or what else they may have been doing at the time.</p>
<p>&#8220;Conspiracy has been called the prosecutor&#8217;s friend because it makes the agreement the crime,&#8221; Rasch said. &#8220;It&#8217;s a separate crime in addition to the underlying crime, whether it be breaking in to a network, data theft or account takeover. The &#8216;I just bought some usernames and gave or sold them to someone else&#8217; excuse is wrong because it&#8217;s a conspiracy and these people obviously don&#8217;t realize that.&#8221;</p>
<p>In <a href="https://blog.twitter.com/en_us/topics/company/2020/an-update-on-our-security-incident.html" target="_blank" rel="noopener noreferrer">a statement</a> on its ongoing investigation into the July 15 incident, Twitter said it resulted from a small number of employees being manipulated through a social engineering scheme. Twitter said at least 130 accounts were targeted by the attackers, who succeeded in sending out unauthorized tweets from 45 of them and may have been able to view additional information about those accounts, such as direct messages.</p>
<p>On eight of the compromised accounts, Twitter said, the attackers managed to download the account history using the Your Twitter Data tool. Twitter added that it is working with law enforcement and is rolling out additional company-wide training to guard against social engineering tactics.</p>


feed_id: https://krebsonsecurity.com/?p=52384
title: NY Charges First American Financial for Massive Data Leak
uri: NY-Charges-First-American-Financial-for-Massive-Data-Leak
url: https://krebsonsecurity.com/2020/07/ny-charges-first-american-financial-for-massive-data-leak/
content:
<p>In May 2019, KrebsOnSecurity broke the news that the website of mortgage title insurance giant <strong>First American Financial Corp.</strong> had exposed approximately 885 million records related to mortgage deals going back to 2003. On Wednesday, regulators in New York announced that First American was the target of their first ever cybersecurity enforcement action in connection with the incident, charges that could bring steep financial penalties.</p>
<div id="attachment_47830" style="width: 608px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-47830" class=" wp-image-47830" src="media/e0ba395a.firstamericanfinancial.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/firstamericanfinancial.jpg" alt="" width="598" height="356" /><p id="caption-attachment-47830" class="wp-caption-text">First American Financial Corp.</p></div>
<p>Santa Ana, Calif.-based <a href="https://en.wikipedia.org/wiki/First_American_Corporation" target="_blank" rel="noopener noreferrer">First American</a> [<a href="https://www.marketbeat.com/stocks/NYSE/FAF/" target="_blank" rel="noopener noreferrer">NYSE:FAF</a>] is a leading provider of title insurance and settlement services to the real estate and mortgage industries. It employs some 18,000 people and brought in <a href="http://investors.firstam.com/investors/overview/default.aspx" target="_blank" rel="noopener noreferrer">$6.2 billion in 2019</a>.</p>
<p>As <a href="https://krebsonsecurity.com/2019/05/first-american-financial-corp-leaked-hundreds-of-millions-of-title-insurance-records/" target="_blank" rel="noopener noreferrer">first reported here last year</a>, First American&#8217;s website exposed 16 years worth of digitized mortgage title insurance records — including bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts, and drivers license images.</p>
<p>The documents were available without authentication to anyone with a Web browser.</p>
<p>According to <a href="media/22615a69.ea20200721_first_american_notice_charges.pdf" data-original-source="https://www.dfs.ny.gov/system/files/documents/2020/07/ea20200721_first_american_notice_charges.pdf" target="_blank" rel="noopener noreferrer">a filing</a> (PDF) by the <strong>New York State Department of Financial Services</strong> (DFS), the weakness that exposed the documents was first introduced during an application software update in May 2014 and went undetected for years.</p>
<p>Worse still, the DFS found, the vulnerability was discovered in a penetration test First American conducted on its own in December 2018.</p>
<p>&#8220;Remarkably, Respondent instead allowed unfettered access to the personal and financial data of millions of its customers for six more months until the breach and its serious ramifications were widely publicized by a nationally recognized cybersecurity industry journalist,&#8221; the DFS explained in <a href="https://www.dfs.ny.gov/reports_and_publications/press_releases/pr202007221" target="_blank" rel="noopener noreferrer">a statement</a> on the charges.</p>
<div id="attachment_47843" style="width: 608px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-47843" class=" wp-image-47843" src="media/49e128d0.sample-fa.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/sample-fa.jpg" alt="" width="598" height="489" /><p id="caption-attachment-47843" class="wp-caption-text">A redacted screenshot of one of many millions of sensitive records exposed by First American&#8217;s Web site.</p></div>
<p>Reuters <a href="https://kfgo.com/2020/07/22/new-york-charges-big-title-insurer-first-american-over-security-gap/" target="_blank" rel="noopener noreferrer">reports</a> that the penalties could be significant for First American: The DFS considers each instance of exposed personal information a separate violation, and the company faces penalties of up to $1,000 per violation.<span id="more-52384"></span></p>
<p>In a written statement, First American said it strongly disagrees with the DFS&#8217;s findings, and that its own investigation determined only a &#8220;very limited number&#8221; of consumers &#8212; and none from New York &#8212; had personal data accessed without permission.</p>
<p>In August 2019, the company said a third-party investigation into the exposure <a href="https://www.firstam.com/incidentupdate/update20190716.html" target="_blank" rel="noopener noreferrer">identified just 32 consumers</a> whose non-public personal information likely was accessed without authorization.</p>
<p>When KrebsOnSecurity asked last year how long it maintained access logs or how far back in time that review went, First American declined to be more specific, saying only that its logs covered a period that was typical for a company of its size and nature.</p>
<p>But in Wednesday&#8217;s filing, the DFS said First American was unable to determine whether records were accessed prior to Jun 2018.</p>
<p>&#8220;Respondent’s forensic investigation relied on a review of web logs retained from June 2018 onward,&#8221; the DFS found. &#8220;Respondent’s own analysis demonstrated that during this 11-month period, more than 350,000 documents were accessed without authorization by automated &#8216;bots&#8217; or &#8216;scraper&#8217; programs designed to collect information on the Internet.</p>
<p>The records exposed by First American would have been a virtual gold mine for phishers and scammers involved in so-called Business Email Compromise (BEC) scams, which often impersonate real estate agents, closing agencies, title and escrow firms in a bid to <a href="https://krebsonsecurity.com/2017/04/blind-trust-in-email-could-cost-you-your-home/" target="_blank" rel="noopener noreferrer">trick property buyers into wiring funds to fraudsters</a>. According to the FBI, BEC scams are the most costly form of cybercrime today.</p>
<p>First American&#8217;s stock price fell more than 6 percent the day after news of their data leak was published here. In the days that followed, the DFS and <a href="https://krebsonsecurity.com/2019/08/sec-investigating-data-leak-at-first-american-financial-corp/" target="_blank" rel="noopener noreferrer">U.S. Securities and Exchange Commission</a> each announced they were investigating the company.</p>
<p>First American released <a href="http://investors.firstam.com/investors/news-and-events/events/event-details/2020/1Q-2020-First-American-Financial-Corporation-Earnings-Conference-Call/default.aspx" target="_blank" rel="noopener noreferrer">its first quarter 2020 earnings today</a>. A hearing on the charges alleged by the DFS is slated for Oct. 26.</p>


feed_id: https://krebsonsecurity.com/?p=52199
title: Thinking of a Cybersecurity Career? Read This
uri: Thinking-of-a-Cybersecurity-Career-Read-This
url: https://krebsonsecurity.com/2020/07/thinking-of-a-cybersecurity-career-read-this/
content:
<p>Thousands of people graduate from colleges and universities each year with cybersecurity or computer science degrees only to find employers are less than thrilled about their hands-on, foundational skills. Here&#8217;s a look at a recent survey that identified some of the bigger skills gaps, and some thoughts about how those seeking a career in these fields can better stand out from the crowd.</p>
<p><img class="aligncenter wp-image-52423" src="media/f9f68159.codepeople.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/codepeople.png" alt="" width="596" height="404" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/codepeople.png 625w, https://krebsonsecurity.com/wp-content/uploads/2020/07/codepeople-580x393.png 580w" sizes="(max-width: 596px) 100vw, 596px" /></p>
<p>Virtually every week KrebsOnSecurity receives at least one email from someone seeking advice on <a href="https://krebsonsecurity.com/category/how-to-break-into-security/" target="_blank" rel="noopener noreferrer">how to break into cybersecurity</a> as a career. In most cases, the aspirants ask which certifications they should seek, or what specialization in computer security might hold the brightest future.</p>
<p>Rarely am I asked which practical skills they should seek to make themselves more appealing candidates for a future job. And while I always preface any response with the caveat that I don&#8217;t hold any computer-related certifications or degrees myself, I do speak with C-level executives in cybersecurity and recruiters on a regular basis and frequently ask them for their impressions of today&#8217;s cybersecurity job candidates.</p>
<p>A common theme in these C-level executive responses is that a great many candidates simply lack hands-on experience with the more practical concerns of operating, maintaining and defending the information systems which drive their businesses.</p>
<p>Granted, most people who have just graduated with a degree lack practical experience. But happily, a somewhat unique aspect of cybersecurity is that one can gain a fair degree of mastery of hands-on skills and foundational knowledge through self-directed study and old fashioned trial-and-error.</p>
<p>One key piece of advice I nearly always include in my response to readers involves learning the core components of how computers and other devices communicate with one another. I say this because a mastery of networking is a fundamental skill that so many other areas of learning build upon. Trying to get a job in security without a deep understanding of how data packets work is a bit like trying to become a chemical engineer without first mastering the periodic table of elements.</p>
<p>But please don&#8217;t take my word for it. <a href="https://www.sans.org" target="_blank" rel="noopener noreferrer">The SANS Institute</a>, a Bethesda, Md. based security research and training firm, recently conducted a survey of more than 500 cybersecurity practitioners at 284 different companies in an effort to suss out which skills they find most useful in job candidates, and which are most frequently lacking.</p>
<p>The survey asked respondents to rank various skills from &#8220;critical&#8221; to &#8220;not needed.&#8221; Fully 85 percent ranked networking as a critical or &#8220;very important&#8221; skill, followed by a mastery of the Linux operating system (77 percent), Windows (73 percent), common exploitation techniques (73 percent), computer architectures and virtualization (67 percent) and data and cryptography (58 percent). Perhaps surprisingly, only 39 percent ranked programming as a critical or very important skill (I&#8217;ll come back to this in a moment).</p>
<p>How did the cybersecurity practitioners surveyed grade their pool of potential job candidates on these critical and very important skills? The results may be eye-opening:</p>
<p><a class="lightbox" href="media/075c0700.skillscyber.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/skillscyber.png"><img class="aligncenter wp-image-52405" src="media/075c0700.skillscyber.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/skillscyber.png" alt="" width="597" height="186" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/skillscyber.png 802w, https://krebsonsecurity.com/wp-content/uploads/2020/07/skillscyber-580x181.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/07/skillscyber-768x239.png 768w" sizes="(max-width: 597px) 100vw, 597px" /></a></p>
<p>&#8220;Employers report that student cybersecurity preparation is largely inadequate and are frustrated that they have to spend months searching before they find qualified entry-level employees if any can be found,&#8221; said <strong>Alan Paller</strong>, director of research at the SANS Institute. &#8220;We hypothesized that the beginning of a pathway toward resolving those challenges and helping close the cybersecurity skills gap would be to isolate the capabilities that employers expected but did not find in cybersecurity graduates.&#8221;</p>
<p style="font-weight: 400;">The truth is, some of the smartest, most insightful and talented computer security professionals I know today don&#8217;t have any computer-related certifications under their belts. In fact, many of them never even went to college or completed a university-level degree program.</p>
<p>Rather, they got into security because they were passionately and intensely curious about the subject, and that curiosity led them to learn as much as they could &#8212; mainly by reading, doing, and making mistakes (lots of them).</p>
<p>I mention this not to dissuade readers from pursuing degrees or certifications in the field (which may be a basic requirement for many corporate HR departments) but to emphasize that these should not be viewed as some kind of golden ticket to a rewarding, stable and relatively high-paying career.</p>
<p>More to the point, without a mastery of one or more of the above-mentioned skills, you simply will not be a terribly appealing or outstanding job candidate when the time comes.<span id="more-52199"></span></p>
<h4>BUT..HOW?</h4>
<p>So what should you focus on, and what&#8217;s the best way to get started? First, understand that while there are a near infinite number of ways to acquire knowledge and virtually no limit to the depths you can explore, getting your hands dirty is the fastest way to learning.</p>
<p>No, I&#8217;m not talking about breaking into someone&#8217;s network, or hacking some poor website. Please don&#8217;t do that without permission. If you must target third-party services and sites, stick to those that offer recognition and/or incentives for doing so <a href="https://www.bugcrowd.com/bug-bounty-list/" target="_blank" rel="noopener noreferrer">through bug bounty programs</a>, and then make sure you respect the boundaries of those programs.</p>
<p>Besides, almost anything you want to learn by doing can be replicated locally. Hoping to master common vulnerability and exploitation techniques? There are <a href="https://www.hacker101.com/" target="_blank" rel="noopener noreferrer">innumerable</a> <a href="https://www.sans.org/media/free/free-faculty-tools.pdf?msc=sans-free-lp" target="_blank" rel="noopener noreferrer">free</a> <a href="https://www.cybrary.it/" target="_blank" rel="noopener noreferrer">resources</a> available; purpose-built exploitation toolkits like <a href="https://www.metasploit.com/" target="_blank" rel="noopener noreferrer">Metasploit</a>, <a href="https://owasp.org/www-project-webgoat/" target="_blank" rel="noopener noreferrer">WebGoat</a>, and custom Linux distributions like <a href="https://www.kali.org/" target="_blank" rel="noopener noreferrer">Kali Linux</a> that are well supported by tutorials and videos online. Then there are a number of free reconnaissance and vulnerability discovery tools like <a href="https://nmap.org/" target="_blank" rel="noopener noreferrer">Nmap</a>, <a href="https://www.tenable.com/products/nessus" target="_blank" rel="noopener noreferrer">Nessus</a>, <a href="https://www.openvas.org/" target="_blank" rel="noopener noreferrer">OpenVAS</a> and <a href="https://cirt.net/Nikto2" target="_blank" rel="noopener noreferrer">Nikto</a>. This is by no means a complete list.</p>
<p>Set up your own hacking labs. You can do this with a spare computer or server, or with older hardware that is plentiful and cheap on places like eBay or Craigslist. Free virtualization tools like <a href="https://www.virtualbox.org/" target="_blank" rel="noopener noreferrer">VirtualBox</a> can make it simple to get friendly with different operating systems without the need of additional hardware.</p>
<p>Or look into paying someone else to set up a virtual server that you can poke at. Amazon&#8217;s <a href="https://aws.amazon.com/ec2/" target="_blank" rel="noopener noreferrer">EC2 services</a> are a good low-cost option here. If it&#8217;s web application testing you wish to learn, you can install any number of web services on computers within your own local network, such as older versions of WordPress, Joomla or shopping cart systems like Magento.</p>
<p>Want to learn networking? Start by getting <a href="https://www.amazon.com/gp/offer-listing/0201633469/ref=dp_olp_all_mbc_mma?ie=UTF8&amp;condition=all" target="_blank" rel="noopener noreferrer">a decent book on TCP/IP</a> and really learning the network stack and <a href="https://www.youtube.com/watch?v=PpsEaqJV_A0" target="_blank" rel="noopener noreferrer">how each layer interacts with the other</a>.</p>
<p>And while you&#8217;re absorbing this information, learn to use some tools that can help put your newfound knowledge into practical application. For example, familiarize yourself with <a href="https://www.wireshark.org/" target="_blank" rel="noopener noreferrer">Wireshark</a> and <a href="https://www.tcpdump.org/" target="_blank" rel="noopener noreferrer">Tcpdump</a>, handy tools relied upon by network administrators to troubleshoot network and security problems and to understand how network applications work (or don&#8217;t). Begin by inspecting your own network traffic, web browsing and everyday computer usage. Try to understand what applications on your computer are doing by looking at what data they are sending and receiving, how, and where.</p>
<h4>ON PROGRAMMING</h4>
<p>While being able to program in languages like <a href="https://www.codecademy.com/learn/learn-go" target="_blank" rel="noopener noreferrer">Go</a>, <a href="https://www.w3schools.com/java/java_intro.asp" target="_blank" rel="noopener noreferrer">Java</a>, <a href="https://learn.perl.org/" target="_blank" rel="noopener noreferrer">Perl</a>, <a href="https://www.python.org/about/gettingstarted/" target="_blank" rel="noopener noreferrer">Python</a>, <a href="https://computer.howstuffworks.com/c1.htm" target="_blank" rel="noopener noreferrer">C</a> or <a href="https://www.freecodecamp.org/news/learning-ruby-from-zero-to-hero-90ad4eecc82d/" target="_blank" rel="noopener noreferrer">Ruby</a> may or may not be at the top of the list of skills demanded by employers, having one or more languages in your skillset is not only going to make you a more attractive hire, it will also make it easier to grow your knowledge and venture into deeper levels of mastery.</p>
<p>It is also likely that depending on which specialization of security you end up pursuing, at some point you will find your ability to expand that knowledge is somewhat limited without understanding how to code.</p>
<p>For those intimidated by the idea of learning a programming language, start by getting familiar with basic command line tools on Linux. Just learning to write basic scripts that automate specific manual tasks can be a wonderful stepping stone. What&#8217;s more, a mastery of <a href="http://linuxcommand.org/lc3_writing_shell_scripts.php" target="_blank" rel="noopener noreferrer">creating shell scripts</a> will pay handsome dividends for the duration of your career in almost any technical role involving computers (regardless of whether you learn a specific coding language).</p>
<h4>GET HELP</h4>
<p>Make no mistake: Much like learning a musical instrument or a new language, gaining cybersecurity skills takes most people a good deal of time and effort. But don&#8217;t get discouraged if a given topic of study seems overwhelming at first; just take your time and keep going.</p>
<p>That&#8217;s why it helps to have support groups. Seriously. In the cybersecurity industry, the human side of networking takes the form of conferences and local meetups. I cannot stress enough how important it is for both your sanity and career to get involved with like-minded people on a semi-regular basis.</p>
<p>Many of these gatherings are free, including <a href="http://www.securitybsides.com/w/page/12194156/FrontPage" target="_blank" rel="noopener noreferrer">Security BSides events</a>, <a href="https://defcongroups.org/dcpages.html" target="_blank" rel="noopener noreferrer">DEFCON groups</a>, and <a href="https://owasp.org/chapters/" target="_blank" rel="noopener noreferrer">OWASP chapters</a>. And because the tech industry continues to be disproportionately populated by men, there are also a number cybersecurity meetups and membership groups geared toward women, such as the <a href="https://womenscyberjutsu.org/page/COVER6" target="_blank" rel="noopener noreferrer">Women&#8217;s Society of Cyberjutsu</a> and others <a href="https://www.comparitech.com/blog/information-security/women-cybersecurity-initiatives/" target="_blank" rel="noopener noreferrer">listed here</a>.</p>
<p>Unless you live in the middle of nowhere, chances are there&#8217;s a number of security conferences and security meetups in your general area. But even if you do reside in the boonies, the good news is many of these meetups are going virtual to avoid the ongoing pestilence that is the COVID-19 epidemic.</p>
<p>In summary, don&#8217;t count on a degree or certification to prepare you for the kinds of skills employers are going to understandably expect you to possess. That may not be fair or as it should be, but it&#8217;s likely on you to develop and nurture the skills that will serve your future employer(s) and employability in this field.</p>
<p>I&#8217;m certain that readers here have their own ideas about how newbies, students and those contemplating a career shift into cybersecurity can best focus their time and efforts. Please feel free to sound off in the comments. I may even update this post to include some of the better recommendations.</p>


feed_id: https://krebsonsecurity.com/?p=51865
title: Business ID Theft Soars Amid COVID Closures
uri: Business-ID-Theft-Soars-Amid-COVID-Closures
url: https://krebsonsecurity.com/2020/07/business-id-theft-soars-amid-covid-closures/
content:
<p>Identity thieves who specialize in running up unauthorized lines of credit in the names of small businesses are having a field day with all of the closures and economic uncertainty wrought by the COVID-19 pandemic, KrebsOnSecurity has learned. This story is about the victims of a particularly aggressive business ID theft ring that&#8217;s spent years targeting small businesses across the country and is now pivoting toward using that access for pandemic assistance loans and unemployment benefits.</p>
<p><img class="aligncenter wp-image-51644" src="media/9a4a6a9f.100mask.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/100mask.jpg" alt="" width="590" height="359" /></p>
<p>Most consumers are likely aware of the threat from identity theft, which occurs when crooks apply for new lines of credit in your name. But the same crime can be far more costly and damaging when thieves target small businesses. Unfortunately, far too many entrepreneurs are simply unaware of the threat or don&#8217;t know how to be watchful for it.</p>
<p>What&#8217;s more, with so many small enterprises going out of business or sitting dormant during the COVID-19 pandemic, organized fraud rings have an unusually rich pool of targets to choose from.</p>
<p>Short Hills, N.J.-based <a href="https://www.dnb.com" target="_blank" rel="noopener noreferrer">Dun &amp; Bradstreet</a> [<a href="https://finance.yahoo.com/quote/DNB/" target="_blank" rel="noopener noreferrer">NYSE:DNB</a>] is a data analytics company that acts as a kind of de facto credit bureau for companies: When a business owner wants to open a new line of credit, creditors typically check with Dun &amp; Bradstreet to gauge the business&#8217;s history and trustworthiness.</p>
<p>In 2019, Dun &amp; Bradstreet saw more than a 100 percent increase in business identity theft. For 2020, the company estimates <em>an overall 258 percent spike in the crime.</em> Dun &amp; Bradstreet said that so far this year it has received over 4,700 tips and leads where business identity theft or malfeasance are suspected.</p>
<p>&#8220;The ferocity of cyber criminals to take advantage of COVID-19 uncertainties by preying on small businesses is disturbing,&#8221; said <strong>Andrew LaMarca</strong>, who leads the global high-risk and fraud team at Dun &amp; Bradstreet.</p>
<p>For the past several months, Milwaukee, Wisc. based cyber intelligence firm <a href="https://www.holdsecurity.com" target="_blank" rel="noopener noreferrer">Hold Security</a> has been monitoring the communications between and among a businesses ID theft gang apparently operating in Georgia and Florida but targeting businesses throughout the United States. That surveillance has helped to paint a detailed picture of how business ID thieves operate, as well as the tricks they use to gain credit in a company&#8217;s name.</p>
<p>Hold Security founder <strong>Alex Holden</strong> said the group appears to target both active and dormant or inactive small businesses. The gang typically will start by looking up the business ownership records at the Secretary of State website that corresponds to the company&#8217;s state of incorporation. From there, they identify the officers and owners of the company, acquire their Social Security and Tax ID numbers from the dark web and other sources online.</p>
<p>To prove ownership over the hijacked firms, they hire low-wage image editors online to help fabricate and/or modify a number of official documents tied to the business &#8212; including tax records and utility bills.</p>
<p>The scammers frequently then file phony documents with the Secretary of State&#8217;s office in the name(s) of the business owners, but include a mailing address that they control. They also create email addresses and domain names that mimic the names of the owners and the company to make future credit applications appear more legitimate, and submit the listings to business search websites, such as yellowpages.com.</p>
<p>For both dormant and existing businesses, the fraudsters attempt to create or modify the target company&#8217;s accounts at Dun &amp; Bradstreet. In some cases, the scammers create dashboard accounts in the business&#8217;s names at Dun &amp; Bradstreet&#8217;s credit builder portal; in others, the bad guys have actually hacked existing business accounts at DNB, requesting a new DUNS numbers for the business (a DUNS number is a unique, nine-digit identifier for businesses).</p>
<p><img class="aligncenter wp-image-52445" src="media/0206d4f7.dnb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/dnb.png" alt="" width="591" height="179" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/dnb.png 1304w, https://krebsonsecurity.com/wp-content/uploads/2020/07/dnb-580x175.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/07/dnb-940x284.png 940w, https://krebsonsecurity.com/wp-content/uploads/2020/07/dnb-768x232.png 768w" sizes="(max-width: 591px) 100vw, 591px" /></p>
<p>Finally, after the bogus profiles are approved by Dun &amp; Bradstreet, the gang waits a few weeks or months and then starts applying for new lines of credit in the target business&#8217;s name at stores like Home Depot, Office Depot and Staples. Then they go on a buying spree with the cards issued by those stores.</p>
<p>Usually, the first indication a victim has that they&#8217;ve been targeted is when the debt collection companies start calling.</p>
<p>&#8220;They are using mostly small companies that are still active businesses but currently not operating because of COVID-19,&#8221; Holden said. &#8220;With this gang, we see four or five people working together. The team leader manages the work between people. One person seems to be in charge of getting stolen cards from the dark web to pay for the reactivation of businesses through the secretary of state sites. Another team member works on revising the business documents and registering them on various sites. The others are busy looking for specific businesses they want to revive.&#8221;</p>
<p>Holden said the gang appears to find success in getting new lines of credit with about 20 percent of the businesses they target.</p>
<p>&#8220;One&#8217;s personal credit is nothing compared to the ability of corporations to borrow money,&#8221; he said. &#8220;That&#8217;s bad because while the credit system may be flawed for individuals, it&#8217;s an even worse situation on average when we&#8217;re talking about businesses.&#8221;</p>
<p>Holden said over the past few months his firm has seen communications between the gang&#8217;s members indicating they have temporarily shifted more of their energy and resources to defrauding states and the federal government by filing unemployment insurance claims and apply for pandemic assistance loans with the Small Business Administration.</p>
<p>&#8220;It makes sense, because they&#8217;ve already got control over all these dormant businesses,&#8221; he said. &#8220;So they&#8217;re now busy trying to get unemployment payments and SBA loans in the names of these companies and their employees.&#8221;</p>
<h4>PHANTOM OFFICES</h4>
<p>Hold Security shared data intercepted from the gang that listed the personal and financial details of dozens of companies targeted for ID theft, including Dun &amp; Bradstreet logins the crooks had created for the hijacked businesses. Dun &amp; Bradstreet declined to comment on the matter, other than to say it was working with federal and state authorities to alert affected businesses and state regulators.</p>
<p><img class="aligncenter wp-image-52446" src="media/93c27e77.officeboxes.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/officeboxes.jpg" alt="" width="596" height="397" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/officeboxes.jpg 1000w, https://krebsonsecurity.com/wp-content/uploads/2020/07/officeboxes-580x386.jpg 580w, https://krebsonsecurity.com/wp-content/uploads/2020/07/officeboxes-940x626.jpg 940w, https://krebsonsecurity.com/wp-content/uploads/2020/07/officeboxes-768x511.jpg 768w" sizes="(max-width: 596px) 100vw, 596px" /></p>
<p>Among those targeted was <a href="https://www.escflorida.com/" target="_blank" rel="noopener noreferrer">Environmental Safety Consultants Inc.</a> (ESC), a 37-year-old environmental engineering firm based in Bradenton, Fla. ESC owner <strong>Scott Russell</strong> estimates his company was initially targeted nearly two years ago, and that he first became aware something wasn&#8217;t right when he recently began getting calls from Home Depot&#8217;s corporate offices inquiring about the company&#8217;s delinquent account.</p>
<p>But Russell said he didn&#8217;t quite grasp the enormity of the situation until last year, when he was contacted by a the manager of a virtual office space across town who told him about a suspiciously large number of deliveries at an office space that was rented out in his name.</p>
<p>Russell had never rented that particular office. Rather, the thieves had done it for him, using his name and the name of his business. The office manager said the deliveries came virtually non-stop, even though there was apparently no business operating within the rented premises. And in each case, shortly after the shipments arrived someone would show up and cart them away.</p>
<p>&#8220;She said we don&#8217;t think it&#8217;s you,&#8221; he recalled. &#8220;Turns out, they had paid for a lease in my name with someone else&#8217;s credit card. She shared with me a copy of the lease, which included a fraudulent ID and even a vehicle insurance card for a Land Cruiser we got rid of like 15 years ago. The application listed our home address with me and some woman who was not my wife&#8217;s name.&#8221;</p>
<p>The crates and boxes being delivered to his erstwhile office space were mostly computers and other high-priced items ordered from 10 different Office Depot credit cards that also were not in his name.</p>
<p>&#8220;The total value of the electronic equipment that was bought and delivered there was something like $75,000,&#8221; Russell said, noting that it took countless hours and phone calls with Office Depot to make it clear they would no longer accept shipments addressed to him or his company. &#8220;It was quite spine-tingling to see someone penned a lease in the name of my business and personal identity.&#8221;</p>
<p>Even though the virtual office manager had the presence of mind to take photocopies of the driver&#8217;s licenses presented by the people arriving to pick up the fraudulent shipments, the local police seemed largely uninterested in pursuing the case, Russell said.</p>
<p>&#8220;I went to the local county sheriff&#8217;s office and showed them all the documentation I had and the guy just yawned and said he&#8217;d get right on it,&#8221; he recalled. &#8220;The place where the office space was rented was in another county, and the detective I spoke to there about it was interested, but he could never get anyone from my county to follow up.&#8221;<span id="more-51865"></span></p>
<h4>RECYCLING VICTIMS</h4>
<p>Russell said he believes the fraudsters initially took out new lines of credit in his company&#8217;s name and then used those to defraud others in a similar way. One of those victims is another victim on the gang&#8217;s target list obtained by Hold Security &#8212; <strong>Mary McMahan</strong>, owner of <strong>Fan Experiences</strong>, an event management company in Winter Park, Fla.</p>
<p><img class="wp-image-52447 alignright" src="media/1a7a7062.recycling.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/recycling.png" alt="" width="249" height="242" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/recycling.png 625w, https://krebsonsecurity.com/wp-content/uploads/2020/07/recycling-580x562.png 580w" sizes="(max-width: 249px) 100vw, 249px" /></p>
<p>McMahan also had stolen goods from Office Depot and other stores purchased in her company&#8217;s name and delivered to the same office space rented in Russell&#8217;s name. McMahan said she and her businesses have suffered hundreds of thousands of dollars in fraud, and spent nearly as much in legal fees fending off collections firms and restoring her company&#8217;s credit.</p>
<p>McMahan said she first began noticing trouble almost four years ago, when someone started taking out new credit cards in her company&#8217;s name. At the same time, her business was used to open a new lease on a virtual office space in Florida that also began receiving packages tied to other companies victimized by business ID theft.</p>
<p>&#8220;About four years back, they hit my credit hard for a year, getting all these new lines of credit at Home Depot, Office Depot, Office Max, you name it,&#8221; she said. &#8220;Then they came back again two years ago and hit it hard for another year. They even went to the [Florida Department of Motor Vehicles] to get a driver&#8217;s license in my name.&#8221;</p>
<p>McMahan said the thieves somehow hacked her DNB account, and then began adding new officers and locations for her business listing.</p>
<p>&#8220;They changed the email and mailing address, and even went on Yelp and Google and did the same,&#8221; she said.</p>
<p>McMahan said she&#8217;s since locked down her personal and business credit to the point where even she would have a tough time getting a new line of credit or mortgage if she tried.</p>
<p>&#8220;There&#8217;s no way they can even utilize me anymore because there&#8217;s so many marks on my credit stating that it&#8217;s been stolen&#8221; she said. &#8220;These guys are relentless, and they recycle victims to defraud others until they figure out they can&#8217;t recycle them anymore.&#8221;</p>
<h4>SAY&#8230;THAT&#8217;S A NICE CREDIT PROFILE YOU GOT THERE&#8230;</h4>
<p>McMahan says she, too, has filed multiple reports about the crimes with local police, but has so far seen little evidence that anyone is interested in following up on the matter. For now, she is paying Dun and Bradstreet more than a $100 a month to monitor her business credit profile.</p>
<p>Dun &amp; Bradstreet does offer a free version of credit monitoring called <a href="https://businesscredit.dnb.com/product/credit-signal/" target="_blank" rel="noopener noreferrer">Credit Signal</a> that lets business owners check their business credit scores and any inquiries made in the previous 14 days up to four times a year. However, those looking for more frequent checks or additional information about specific credit inquiries beyond 14 days are steered toward DNB&#8217;s subscription-based services.</p>
<p><strong>Eva Velasquez</strong>, president of the <a href="https://www.idtheftcenter.org" target="_blank" rel="noopener noreferrer">Identity Theft Resource Center</a>, a California-based nonprofit that assists ID theft victims, said she finds that troubling.</p>
<p>&#8220;When we look at these institutions that are necessary for us to operate and function in society and they start to charge us a fee for a service to fix a problem they helped create through their infrastructure, that&#8217;s just unconscionable,&#8221; Velasquez said. &#8220;We need to take a hard look at the infrastructures that businesses are beholden to and make sure the risk minimization protections they&#8217;re entitled to are not fee-based &#8212; particularly if it&#8217;s a problem created by the very infrastructure of the system.&#8221;</p>
<p>Velasquez said it&#8217;s unfortunate that small business owners don&#8217;t have the same protections afforded to consumers. For example, only recently did the three major consumer reporting bureaus allow all U.S. residents to <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener noreferrer">place a freeze on their credit files for free</a>.</p>
<p>&#8220;We&#8217;ve done a good job in educating the public that anyone can be victim of identity theft, and in compelling our infrastructure to provide robust consumer protection and risk minimization processes that are more uniform,&#8221; she said. &#8220;It&#8217;s still not good by any means, but it&#8217;s definitely better for consumers than it is for businesses. We currently put all the responsibility on the small business owner, and very little on the infrastructure and processes that should be designed to protect them but aren&#8217;t doing a great job, frankly.&#8221;</p>
<p>Rather, the onus continues to be on the business owner to periodically check with DNB and state agencies to monitor for any signs of unauthorized changes. Worse still, too many private and public organizations still don&#8217;t do a good enough job protecting employee identification and tax ID numbers that are so often abused in business identity theft, Velasquez said.</p>
<p>&#8220;You can put alerts and other protections in place but the problem is you have to go on a department by department and case by case basis,&#8221; she said. &#8220;The place to begin is your secretary of state&#8217;s office or wherever you file your documents to operate your business.</p>
<p>For its part, Dun &amp; Bradstreet recently <a href="https://www.dnb.com/perspectives/small-business/prevent-business-fraud-during-covid19.html" target="_blank" rel="noopener noreferrer">published a blog post</a> outlining recommendations for businesses to ward off identity thieves. DNB says anyone who suspects fraudulent activity on their account should <a href="https://support.dnb.com/" target="_blank" rel="noopener noreferrer">contact its support team</a>.</p>


feed_id: https://krebsonsecurity.com/?p=51973
title: Here’s Why Credit Card Fraud is Still a Thing
uri: Here-s-Why-Credit-Card-Fraud-is-Still-a-Thing
url: https://krebsonsecurity.com/2020/07/heres-why-credit-card-fraud-is-still-a-thing/
content:
<p>Most of the civilized world years ago shifted to requiring computer chips in payment cards that make it far more expensive and difficult for thieves to clone and use them for fraud. One notable exception is the United States, which is still lurching toward this goal. Here&#8217;s a look at the havoc that lag has wrought, as seen through the purchasing patterns at one of the underground&#8217;s biggest stolen card shops that was hacked last year.</p>
<p>In October 2019, someone hacked <strong>BriansClub</strong>, a popular stolen card bazaar that uses this author&#8217;s likeness and name in its marketing. Whoever compromised the shop siphoned data on millions of card accounts that were acquired over four years through various illicit means from legitimate, hacked businesses around the globe &#8212; but mostly from U.S. merchants. That database <a href="https://krebsonsecurity.com/2019/10/briansclub-hack-rescues-26m-stolen-cards/" target="_blank" rel="noopener noreferrer">was leaked to KrebsOnSecurity</a>, which in turn shared it with multiple sources that help fight payment card fraud.</p>
<div id="attachment_49240" style="width: 603px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-49240" class=" wp-image-49240" src="media/5981cd16.briansdump.gif" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/briansdump.gif" alt="" width="593" height="38" /><p id="caption-attachment-49240" class="wp-caption-text">An ad for BriansClub has been using my name and likeness for years to peddle millions of stolen credit cards.</p></div>
<p>Among the recipients was <strong>Damon McCoy</strong>, an associate professor at <strong>New York University&#8217;s Tandon School of Engineering</strong> [full disclosure: NYU has been a longtime advertiser on this blog]. McCoy&#8217;s work in probing the credit card systems used by some of the world&#8217;s biggest purveyors of junk email greatly enriched the data that informed <a href="https://www.amazon.com/Spam-Nation-Organized-Cybercrime-Epidemic-ebook/dp/B00L5QGBL0/ref=dp_kinw_strp_1" target="_blank" rel="noopener noreferrer">my 2014 book <em>Spam Nation</em></a>, and I wanted to make sure he and his colleagues had a crack at the BriansClub data as well.</p>
<p>McCoy and fellow NYU researchers found BriansClub earned close to $104 million in gross revenue from 2015 to early 2019, and listed over 19 million unique card numbers for sale. Around 97% of the inventory was stolen magnetic stripe data, commonly used to produce counterfeit cards for in-person payments.</p>
<p>&#8220;What surprised me most was there are still a lot of people swiping their cards for transactions here,&#8221; McCoy said.</p>
<p>In 2015, the major credit card associations instituted new rules that made it riskier and potentially more expensive for U.S. merchants to continue allowing customers to swipe the stripe instead of dip the chip. Complicating this transition was the fact that many card-issuing U.S. banks took years to replace their customer card stocks with chip-enabled cards, and countless retailers dragged their feet in updating their payment terminals to accept chip-based cards.</p>
<p>Indeed, three years later the <strong>U.S. Federal Reserve</strong> <a href="media/62f01369.2019-payments-study-20191219.pdf" data-original-source="https://www.federalreserve.gov/newsevents/pressreleases/files/2019-payments-study-20191219.pdf" target="_blank" rel="noopener noreferrer">estimated</a> (PDF) that 43.3 percent of in-person card payments were still being processed by reading the magnetic stripe instead of the chip. This might not have been such a big deal if payment terminals at many of those merchants weren&#8217;t also compromised with malicious software that copied the data when customers swiped their cards.</p>
<p>Following the 2015 liability shift, more than 84 percent of the non-chip cards advertised by BriansClub were sold, versus just 35 percent of chip-based cards during the same time period.</p>
<p>&#8220;All cards without a chip were in much higher demand,&#8221; McCoy said.</p>
<p>Perhaps surprisingly, McCoy and his fellow NYU researchers found BriansClub customers purchased only 40% of its overall inventory. But what they did buy supports the notion that crooks generally gravitate toward cards issued by financial institutions that are perceived as having fewer or more lax protections against fraud.</p>
<div id="attachment_52471" style="width: 261px" class="wp-caption alignright"><a class="lightbox" href="media/f311c096.bc-issuers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/bc-issuers.png"><img aria-describedby="caption-attachment-52471" class="wp-image-52471" src="media/f311c096.bc-issuers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/bc-issuers.png" alt="" width="251" height="406" /></a><p id="caption-attachment-52471" class="wp-caption-text">Source: NYU.</p></div>
<p>While the top 10 largest card issuers in the United States accounted for nearly half of the accounts put up for sale at BriansClub, only 32 percent of those accounts were sold &#8212; and at a roughly half the median price of those issued by small- and medium-sized institutions.</p>
<p>In contrast, more than half of the stolen cards issued by small and medium-sized institutions were purchased from the fraud shop. This was true even though by the end of 2018, 91 percent of cards for sale from medium-sized institutions were chip-based, and 89 percent from smaller banks and credit unions. Nearly all cards issued by the top ten largest U.S. card issuers (98 percent) were chip-enabled by that time.</p>
<h4>REGION LOCK</h4>
<p>The researchers found BriansClub customers strongly preferred cards issued by financial institutions in specific regions of the United States, specifically Colorado, Nevada, and South Carolina.</p>
<p>&#8220;For whatever reason, those regions were perceived as having lower anti-fraud systems or those that were not as effective,&#8221; McCoy said.</p>
<p>Cards compromised from merchants in South Carolina were in especially high demand, with fraudsters willing to spend twice as much on those cards per capita than any other state &#8212; roughly $1 per resident.</p>
<p>That sales trend also was reflected in the support tickets filed by BriansClub customers, who frequently were informed that cards tied to the southeastern United States were less likely to be restricted for use outside of the region.</p>
<div id="attachment_52481" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/fc3a6a49.bc-us-supply-spending.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/bc-us-supply-spending.png"><img aria-describedby="caption-attachment-52481" class="wp-image-52481" src="media/fc3a6a49.bc-us-supply-spending.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/bc-us-supply-spending.png" alt="" width="597" height="121" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/bc-us-supply-spending.png 1016w, https://krebsonsecurity.com/wp-content/uploads/2020/07/bc-us-supply-spending-580x118.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/07/bc-us-supply-spending-940x191.png 940w, https://krebsonsecurity.com/wp-content/uploads/2020/07/bc-us-supply-spending-768x156.png 768w" sizes="(max-width: 597px) 100vw, 597px" /></a><p id="caption-attachment-52481" class="wp-caption-text">Image: NYU.</p></div>
<p>McCoy said the lack of region locking also made stolen cards issued by banks in China something of a hot commodity, even though these cards demanded much higher prices (often more than $100 per account): The NYU researchers found virtually all available Chinese cards were sold soon after they were put up for sale. Ditto for the relatively few corporate and business cards for sale.</p>
<p>A lack of region locks may also have caused card thieves to gravitate toward buying up as many cards as they could from <strong>USAA</strong>, a savings bank that caters to active and former military service members and their immediate families. More than 83 percent of the available USAA cards were sold between 2015 and 2019, the researchers found.</p>
<p>Although Visa cards made up more than half of accounts put up for sale (12.1 million), just 36 percent were sold. MasterCards were the second most-plentiful (3.72 million), and yet more than 54 percent of them sold.</p>
<p><strong>American Express</strong> and <strong>Discover</strong>, which unlike Visa and MasterCard are so-called &#8220;closed loop&#8221; networks that do not rely on third-party financial institutions to issue cards and manage fraud on them, saw 28.8 percent and 33 percent of their stolen cards purchased, respectively.<span id="more-51973"></span></p>
<h4>PREPAIDS</h4>
<p>Some people concerned about the scourge of debit and credit card fraud opt to purchase prepaid cards, which generally enjoy the same cardholder protections against fraudulent transactions. But the NYU team found compromised prepaid accounts were purchased at a far higher rate than regular debit and credit cards.</p>
<p>Several factors may be at play here. For starters, relatively few prepaid cards for sale were chip-based. McCoy said there was some data to suggest many of these prepaids were issued to people collecting government benefits such as unemployment and food assistance. Specifically, the &#8220;service code&#8221; information associated with these prepaid cards indicated that many were restricted for use at places like liquor stores and casinos.</p>
<p>&#8220;This was a pretty sad finding, because if you don&#8217;t have a bank this is probably how you get your wages,&#8221; McCoy said. &#8220;These cards were disproportionately targeted. The unfortunate and striking thing was the sheer demand and lack of [chip] support for prepaid cards. Also, these cards were likely more attractive to fraudsters because [the issuer&#8217;s] anti-fraud countermeasures weren&#8217;t up to par, possibly because they know less about their customers and their typical purchase history.&#8221;</p>
<h4>PROFITS</h4>
<p>The NYU researchers estimate BriansClub pulled in approximately $24 million in profit over four years. They calculated this number by taking the more than $100 million in total sales and subtracting commissions paid to card thieves who supplied the shop with fresh goods, as well as the price of cards that were refunded to buyers. BriansClub, like many other stolen card shops, offers refunds on certain purchases if the buyer can demonstrate the cards were no longer active at the time of purchase.</p>
<p>On average, BriansClub paid suppliers commissions ranging from 50-60 percent of the total value of the cards sold. Card-not-present (CNP) accounts &#8212; or those stolen from online retailers and purchased by fraudsters principally for use in defrauding other online merchants &#8212; fetched a much steeper supplier commission of 80 percent, but mainly because these cards were in such high demand and low supply.</p>
<p>The NYU team found card-not-present sales accounted for just 7 percent of all revenue, even though card thieves clearly now have much higher incentives to target online merchants.</p>
<p>A story here last year observed that this exact supply and demand tug-of-war had <a href="https://krebsonsecurity.com/2019/04/data-e-retail-hacks-more-lucrative-than-ever/" target="_blank" rel="noopener noreferrer">helped to significantly increase prices for card-not-present accounts across multiple stolen credit card shops in the underground</a>. Not long ago, the price of CNP accounts was less than half that of card-present accounts. These days, those prices are roughly equivalent.</p>
<p>One likely reason for that shift is the United States is the last of the G20 nations to fully transition to more secure chip-based payment cards. In every other country that long ago made the chip card transition, they saw the same dynamic: As they made it harder for thieves to counterfeit physical cards, the fraud didn&#8217;t go away but instead shifted to online merchants.</p>
<p>The same progression is happening now in the United States, only the demand for stolen CNP data still far outstrips supply. Which might explain why <a href="https://krebsonsecurity.com/2018/11/whos-in-your-online-shopping-cart/" target="_blank" rel="noopener noreferrer">we&#8217;ve seen such a huge uptick over the past few years in e-commerce sites getting hacked</a>.</p>
<p>&#8220;Everyone points to this displacement effect from card-present to card-not-present fraud,&#8221; McCoy said. &#8220;But if the supply isn&#8217;t there, there&#8217;s only so much room for that displacement to occur.&#8221;</p>
<p>No doubt the epidemic of card fraud has benefited mightily from hacked retail chains &#8212; particularly restaurants &#8212; that <a href="https://krebsonsecurity.com/2020/06/covid-19-breach-bubble-waiting-to-pop/" target="_blank" rel="noopener noreferrer">still allow customers to swipe chip-based cards</a>. But as we&#8217;ll see in a post to be published tomorrow, new research suggests thieves are starting to deploy ingenious methods for converting card data from certain compromised chip-based transactions into physical counterfeit cards.</p>
<p>A copy of the NYU research paper is <a href="media/69e10d41.nyu-cardshop.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/nyu-cardshop.pdf" target="_blank" rel="noopener noreferrer">available here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=52499
title: Is Your Chip Card Secure? Much Depends on Where You Bank
uri: Is-Your-Chip-Card-Secure-Much-Depends-on-Where-You-Bank
url: https://krebsonsecurity.com/2020/07/is-your-chip-card-secure-much-depends-on-where-you-bank/
content:
<p>Chip-based credit and debit cards are designed to make it infeasible for skimming devices or malware to clone your card when you pay for something by dipping the chip instead of swiping the stripe. But a recent series of malware attacks on U.S.-based merchants suggest thieves are exploiting weaknesses in how certain financial institutions have implemented the technology to sidestep key chip card security features and effectively create usable, counterfeit cards.</p>
<div id="attachment_52510" style="width: 607px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-52510" class=" wp-image-52510" src="media/5842117c.chipcard.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/chipcard.png" alt="" width="597" height="375" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/chipcard.png 807w, https://krebsonsecurity.com/wp-content/uploads/2020/07/chipcard-580x364.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/07/chipcard-768x482.png 768w" sizes="(max-width: 597px) 100vw, 597px" /><p id="caption-attachment-52510" class="wp-caption-text">A chip-based credit card. Image: Wikipedia.</p></div>
<p>Traditional payment cards encode cardholder account data in plain text on a magnetic stripe, which can be read and recorded by skimming devices or malicious software surreptitiously installed in payment terminals. That data can then be encoded onto anything else with a magnetic stripe and used to place fraudulent transactions.</p>
<p>Newer, chip-based cards employ a technology known as <a href="https://en.wikipedia.org/wiki/EMV#:~:text=EMV%20is%20a%20payment%20method,companies%20which%20created%20the%20standard." target="_blank" rel="noopener noreferrer">EMV</a> that encrypts the account data stored in the chip. The technology causes a unique encryption key &#8212; referred to as a token or &#8220;cryptogram&#8221; &#8212; to be generated each time the chip card interacts with a chip-capable payment terminal.</p>
<p>Virtually all chip-based cards still have much of the same data that&#8217;s stored in the chip encoded on a magnetic stripe on the back of the card. This is largely for reasons of backward compatibility since many merchants &#8212; particularly those in the United States &#8212; <a href="https://krebsonsecurity.com/2020/07/heres-why-credit-card-fraud-is-still-a-thing/" target="_blank" rel="noopener noreferrer">still have not fully implemented chip card readers</a>. This dual functionality also allows cardholders to swipe the stripe if for some reason the card&#8217;s chip or a merchant&#8217;s EMV-enabled terminal has malfunctioned.</p>
<p>But there are important differences between the cardholder data stored on EMV chips versus magnetic stripes. One of those is a component in the chip known as an integrated circuit card verification value or “iCVV” for short — also known as a “dynamic CVV.”</p>
<p>The iCVV differs from the card verification value (CVV) stored on the physical magnetic stripe, and protects against the copying of magnetic-stripe data from the chip and the use of that data to create counterfeit magnetic stripe cards. Both the iCVV and CVV values are unrelated to the three-digit security code that is visibly printed on the back of a card, which is used mainly for e-commerce transactions or for card verification over the phone.</p>
<p>The appeal of the EMV approach is that even if a skimmer or malware manages to intercept the transaction information when a chip card is dipped, the data is only valid for that one transaction and should not allow thieves to conduct fraudulent payments with it going forward.</p>
<p>However, for EMV&#8217;s security protections to work, the back-end systems deployed by card-issuing financial institutions are supposed to check that when a chip card is dipped into a chip reader, only the iCVV is presented; and conversely, that only the CVV is presented when the card is swiped. If somehow these do not align for a given transaction type, the financial institution is supposed to decline the transaction.</p>
<p><em>The trouble is that not all financial institutions have properly set up their systems this way.</em> Unsurprisingly, thieves have known about this weakness for years. In 2017, I wrote about <a href="https://krebsonsecurity.com/2017/01/atm-shimmers-target-chip-based-cards/" target="_blank" rel="noopener noreferrer">the increasing prevalence of &#8220;shimmers,&#8221;</a> high-tech card skimming devices made to intercept data from chip card transactions.</p>
<div id="attachment_37813" style="width: 603px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-37813" class=" wp-image-37813" src="media/9e562e64.ca-shim2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/01/ca-shim2.png" alt="" width="593" height="424" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/01/ca-shim2.png 969w, https://krebsonsecurity.com/wp-content/uploads/2017/01/ca-shim2-580x415.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/01/ca-shim2-768x549.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/01/ca-shim2-940x672.png 940w" sizes="(max-width: 593px) 100vw, 593px" /><p id="caption-attachment-37813" class="wp-caption-text">A close-up of a shimmer found on a Canadian ATM. Source: RCMP.</p></div>
<p>More recently, researchers at <strong>Cyber R&amp;D Labs</strong> <a href="https://www.cyberdlab.com/insights/it-only-takes-a-minute-to-clone-a-credit-card-thanks-to-a-50-year-old-problem" target="_blank" rel="noopener noreferrer">published a paper</a> detailing how they tested 11 chip card implementations from 10 different banks in Europe and the U.S. The researchers found they could harvest data from four of them and create cloned magnetic stripe cards that were successfully used to place transactions.</p>
<p>There are now strong indications the same method detailed by Cyber R&amp;D Labs is being used by point-of-sale (POS) malware to capture EMV transaction data that can then be resold and used to fabricate magnetic stripe copies of chip-based cards.</p>
<p>Earlier this month, the world&#8217;s largest payment card network <strong>Visa</strong> <a href="http://click.broadcasts.visa.com/xfm/?40254/0/e72e19883ebb78a475570ab6dd5275ad/lonew" target="_blank" rel="noopener noreferrer">released a security alert</a> regarding a recent merchant compromise in which known POS malware families were apparently modified to target EMV chip-enabled POS terminals.</p>
<p>&#8220;The implementation of secure acceptance technology, such as EMV® Chip, significantly reduced the usability of the payment account data by threat actors as the available data only included personal account number (PAN), integrated circuit card verification value (iCVV) and expiration date,&#8221; Visa wrote. &#8220;Thus, provided iCVV is validated properly, the risk of counterfeit fraud was minimal. Additionally, many of the merchant locations employed point-to-point encryption (P2PE) which encrypted the PAN data and further reduced the risk to the payment accounts processed as EMV® Chip.&#8221;</p>
<p>Visa did not name the merchant in question, but something similar seems to have happened at <strong>Key Food Stores Co-Operative Inc.</strong>, a supermarket chain in the northeastern United States. Key Food initially disclosed a card breach in March 2020, but two weeks ago <a href="https://www.keyfood.com/store/keyFood/en/protectingourcustomers?state=NY&amp;city=Albertson" target="_blank" rel="noopener noreferrer">updated its advisory</a> to clarify that EMV transaction data also was intercepted.</p>
<p>&#8220;The POS devices at the store locations involved were EMV enabled,&#8221; Key Foods explained. &#8220;For EMV transactions at these locations, we believe only the card number and expiration date would have been found by the malware (but not the cardholder name or internal verification code).&#8221;</p>
<p><a class="lightbox" href="media/11adf26e.visaalert.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/visaalert.png"><img class="aligncenter wp-image-52508" src="media/11adf26e.visaalert.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/visaalert.png" alt="" width="590" height="420" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/visaalert.png 674w, https://krebsonsecurity.com/wp-content/uploads/2020/07/visaalert-580x413.png 580w" sizes="(max-width: 590px) 100vw, 590px" /></a></p>
<p>While Key Food&#8217;s statement may be technically accurate, it glosses over the reality that the stolen EMV data could still be used by fraudsters to create magnetic stripe versions of EMV cards presented at the compromised store registers in cases where the card-issuing bank hadn&#8217;t implemented EMV correctly.<span id="more-52499"></span></p>
<p>Earlier today, fraud intelligence firm <a href="https://www.geminiadvisory.io" target="_blank" rel="noopener noreferrer">Gemini Advisory</a> released a blog post with more information on recent merchant compromises &#8212; including Key Food &#8212; in which EMV transaction data was stolen and ended up for sale in underground shops that cater to card thieves.</p>
<p>&#8220;The payment cards stolen during this breach were offered for sale in the dark web,&#8221; Gemini explained. &#8220;Shortly after discovering this breach, several financial institutions confirmed that the cards compromised in this breach were all processed as EMV and did not rely on the magstripe as a fallback.&#8221;</p>
<p>Gemini says it has verified that another recent breach &#8212; at a liquor store in Georgia &#8212; also resulted in compromised EMV transaction data showing up for sale at dark web stores that sell stolen card data. As both Gemini and Visa have noted, in both cases proper iCVV verification from banks should render this intercepted EMV data useless to crooks.</p>
<p>Gemini determined that due to the sheer number of stores affected, it&#8217;s extremely unlikely the thieves involved in these breaches intercepted the EMV data using physically installed EMV card shimmers.</p>
<p>&#8220;Given the extreme impracticality of this tactic, they likely used a different technique to remotely breach POS systems to collect enough EMV data to perform EMV-Bypass Cloning,&#8221; the company wrote.</p>
<p><strong>Stas Alforov</strong>, Gemini&#8217;s director of research and development, said financial institutions that aren&#8217;t performing these checks risk losing the ability to notice when those cards are used for fraud.</p>
<p>That&#8217;s because many banks that have issued chip-based cards may assume that as long as those cards are used for chip transactions, there is virtually no risk that the cards will be cloned and sold in the underground. Hence, when these institutions are looking for patterns in fraudulent transactions to determine which merchants might be compromised by POS malware, they may completely discount any chip-based payments and focus only on those merchants at which a customer has swiped their card.</p>
<p>&#8220;The card networks are catching on to the fact that there&#8217;s a lot more EMV-based breaches happening right now,&#8221; Alforov said. &#8220;The larger card issuers like Chase or Bank of America are indeed checking [for a mismatch between the iCVV and CVV], and will kick back transactions that don&#8217;t match. But that is clearly not the case with some smaller institutions.&#8221;</p>
<p>For better or worse, we don&#8217;t know which financial institutions have failed to properly implement the EMV standard. That&#8217;s why it always pays to keep a close eye on your monthly statements, and report any unauthorized transactions immediately. If your institution lets you receive transaction alerts via text message, this can be a near real-time way to keep an eye out for such activity.</p>


feed_id: https://krebsonsecurity.com/?p=52521
title: Three Charged in July 15 Twitter Compromise
uri: Three-Charged-in-July-15-Twitter-Compromise
url: https://krebsonsecurity.com/2020/07/three-charged-in-july-15-twitter-compromise/
content:
<p>Three individuals have been charged for their alleged roles in the July 15 hack on <strong>Twitter</strong>, an incident that resulted in Twitter profiles for some of the world&#8217;s most recognizable celebrities, executives and public figures sending out tweets advertising a bitcoin scam.</p>
<div id="attachment_52296" style="width: 563px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-52296" class="size-full wp-image-52296" src="media/63a051ed.bezos-hack.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/bezos-hack.png" alt="" width="553" height="683" /><p id="caption-attachment-52296" class="wp-caption-text">Amazon CEO Jeff Bezos&#8217;s Twitter account on the afternoon of July 15.</p></div>
<p><strong>Nima &#8220;Rolex&#8221; Fazeli</strong>, a 22-year-old from Orlando, Fla., was charged in a criminal complaint in Northern California with aiding and abetting intentional access to a protected computer.</p>
<p><strong>Mason &#8220;Chaewon&#8221; Sheppard</strong>, a 19-year-old from Bognor Regis, U.K., also was charged in California with conspiracy to commit wire fraud, money laundering and unauthorized access to a computer.</p>
<p>A <strong>U.S. Justice Department</strong> <a href="https://www.justice.gov/usao-ndca/pr/three-individuals-charged-alleged-roles-twitter-hack" target="_blank" rel="noopener noreferrer">statement on the matter</a> does not name the third defendant charged in the case, saying juvenile proceedings in federal court are sealed to protect the identity of the youth. But an NBC News affiliate in Tampa <a href="https://www.wfla.com/news/hillsborough-county/tampa-teen-accused-of-being-mastermind-behind-twitter-hack-that-targeted-high-profile-accounts/" target="_blank" rel="noopener noreferrer">reported today</a> that authorities had arrested 17-year-old <strong>Graham Clark</strong> as the alleged mastermind of the hack.</p>
<div id="attachment_52527" style="width: 255px" class="wp-caption alignright"><img aria-describedby="caption-attachment-52527" class=" wp-image-52527" src="media/870ebbfb.gclark.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/gclark.png" alt="" width="245" height="287" /><p id="caption-attachment-52527" class="wp-caption-text">17-year-old Graham Clark of Tampa, Fla. was among those charged in the July 15 Twitter hack. Image: Hillsborough County Sheriff&#8217;s Office.</p></div>
<p><strong>Wfla.com</strong> said Clark was hit with 30 felony charges, including organized fraud, communications fraud, one count of fraudulent use of personal information with over $100,000 or 30 or more victims, 10 counts of fraudulent use of personal information and one count of access to a computer or electronic device without authority. Clark&#8217;s arrest report is available <a href="media/5849fc0a.twt_arrest_report.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/twt_arrest_report.pdf" target="_blank" rel="noopener noreferrer">here</a> (PDF).</p>
<p>On Thursday, Twitter <a href="https://twitter.com/TwitterSupport/status/1289000138300563457" target="_blank" rel="noopener noreferrer">released more details</a> about how the hack went down, saying the intruders &#8220;targeted a small number of employees through a phone spear phishing attack,&#8221; that &#8220;relies on a significant and concerted attempt to mislead certain employees and exploit human vulnerabilities to gain access to our internal systems.&#8221;</p>
<p>By targeting specific Twitter employees, the perpetrators were able to gain access to internal Twitter tools. From there, Twitter said, the attackers targeted 130 Twitter accounts, tweeting from 45 of them, accessing the direct messages of 36 accounts, and downloading the Twitter data of seven.</p>
<p>Among the accounts compromised were democratic presidential candidate <strong>Joe Biden</strong>, <strong>Amazon CEO Jeff Bezos</strong>, <strong>President Barack Obama</strong>, <strong>Tesla CEO Elon Musk</strong>, former New York Mayor <strong>Michael Bloomberg</strong> and investment mogul <strong>Warren Buffett</strong>.</p>
<p>The hacked Twitter accounts were made to send tweets suggesting they were giving away bitcoin, and that anyone who sent bitcoin to a specified account would be sent back double the amount they gave. All told, the bitcoin accounts associated with the scam received more than 400 transfers totaling more than $100,000.</p>
<p>Sheppard&#8217;s alleged alias Chaewon was mentioned twice in stories here since the July 15 incident. On July 16, KrebsOnSecurity <a href="https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/" target="_blank" rel="noopener noreferrer">wrote</a> that just before the Twitter hack took place, a member of the <a href="https://krebsonsecurity.com/?s=ogusers&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">social media account hacking forum OGUsers</a> advertised they could change email address tied to <em>any</em> Twitter account for $250, and provide direct access to accounts for between $2,000 and $3,000 apiece.</p>
<div id="attachment_52281" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/7f26d0c8.chaewon.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/chaewon.png"><img aria-describedby="caption-attachment-52281" class="wp-image-52281" src="media/7f26d0c8.chaewon.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/chaewon.png" alt="" width="597" height="325" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/chaewon.png 1518w, https://krebsonsecurity.com/wp-content/uploads/2020/07/chaewon-580x316.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/07/chaewon-940x511.png 940w, https://krebsonsecurity.com/wp-content/uploads/2020/07/chaewon-768x418.png 768w" sizes="(max-width: 597px) 100vw, 597px" /></a><p id="caption-attachment-52281" class="wp-caption-text">The OGUsers forum user &#8220;Chaewon&#8221; taking requests to modify the email address tied to any twitter account.</p></div>
<p>On July 17, <em>The New York Times</em> <a href="https://www.nytimes.com/2020/07/17/technology/twitter-hackers-interview.html?action=click&amp;module=Top%20Stories&amp;pgtype=Homepage" target="_blank" rel="noopener noreferrer">ran a story</a> that featured interviews with several people involved in the attack, who told The Times they weren&#8217;t responsible for the Twitter bitcoin scam and had only purchased accounts from the Twitter hacker &#8212; who they referred to only as &#8220;Kirk.&#8221;</p>
<p>One of the people interviewed by The Times used the alias &#8220;Ever So Anxious,&#8221; and said he was a 19-year from the U.K. In <a href="https://krebsonsecurity.com/2020/07/twitter-hacking-for-profit-and-the-lols/" target="_blank" rel="noopener noreferrer">my follow-up story on July 22</a>, it emerged that Ever So Anxious was in fact Chaewon.</p>
<p>The person who shared that information was the principal subject of <a href="https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/" target="_blank" rel="noopener noreferrer">my July 16 post</a>, which followed clues from tweets sent from one of the accounts claimed during the Twitter compromise back to a 21-year-old from the U.K. who uses the nickname <strong>PlugWalkJoe</strong>.</p>
<p>That individual shared a series of screenshots showing he had been in communications with Chaewon/Ever So Anxious just prior to the Twitter hack, and had asked him to secure several desirable Twitter usernames from the Twitter hacker. He added that Chaewon/Ever So Anxious also was known as &#8220;Mason.&#8221;</p>
<div id="attachment_52337" style="width: 412px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-52337" class="size-full wp-image-52337" src="media/b5293476.beyondkirk.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/beyondkirk.png" alt="" width="402" height="540" /><p id="caption-attachment-52337" class="wp-caption-text">The negotiations over highly-prized Twitter usernames took place just prior to the hijacked celebrity accounts tweeting out bitcoin scams. PlugWalkJoe is pictured here chatting with Ever So Anxious/Chaewon/Mason using his Discord username &#8220;Beyond Insane.&#8221;</p></div>
<p>On July 22, KrebsOnSecurity interviewed Sheppard/Mason/Chaewon, who confirmed that PlugWalkJoe had indeed asked him to ask Kirk to change the profile picture and display name for a specific Twitter account on July 15. He acknowledged that while he did act as a &#8220;middleman&#8221; between Kirk and others seeking to claim desirable Twitter usernames, he had nothing to do with the hijacking of the VIP Twitter accounts for the bitcoin scam that same day.</p>
<p>&#8220;Encountering Kirk was the worst mistake I&#8217;ve ever made due to the fact it has put me in issues I had nothing to do with,&#8221; he said. &#8220;If I knew Kirk was going to do what he did, or if even from the start if I knew he was a hacker posing as a rep I would not have wanted to be a middleman.&#8221;</p>


