# articles

feed_id: http://krebsonsecurity.com/?p=30978
title: Starbucks Hacked? No, But You Might Be
uri: Starbucks-Hacked-No-But-You-Might-Be
url: http://krebsonsecurity.com/2015/05/starbucks-hacked-no-but-you-might-be/
content:
<p>When it comes to reporting on breaches involving customer accounts at major brands, the news media overall deserves an F-minus. Hardly a week goes by when I don&#8217;t hear from readers about a breathless story proclaiming that yet another household brand name company has been hacked. Upon closer inspection, the stories usually are based on little more than anecdotal evidence from customers who had their online loyalty or points accounts hijacked and then drained of value.</p>
<p><a href="media/f6d0854d.javamess.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/03/javamess.jpg"><img class="alignright size-medium wp-image-19243" src="media/5c15b877.javamess-285x226.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/03/javamess-285x226.jpg" alt="javamess" width="285" height="226" /></a>The latest example of this came last week from <a href="https://bobsullivan.net/cybercrime/identity-theft/exclusive-hackers-target-starbucks-mobile-users-steal-from-linked-credit-cards-without-knowing-account-number/" target="_blank">a story</a> that was responsibly reported by <strong>Bob Sullivan</strong>, a former <strong>MSNBC</strong> journalist who&#8217;s since struck out on his own. Sullivan spoke with multiple consumers who&#8217;d seen their Starbucks card balances emptied and then topped up again.</p>
<p>Those customers had all chosen to tie their debit accounts to their Starbucks cards and mobile phones. Sullivan allowed in his story one logical explanation for the activity: These consumers had re-used their Starbucks account password at another site that got hacked, and attackers simply tried those account credentials en masse at other popular sites &#8212; knowing that a fair number of consumers use the same email address and password across multiple sites.</p>
<p><span class="il">Following up on Sullivan&#8217;s story, the media pounced, suggesting that Starbucks had been compromised. In <a href="https://news.starbucks.com/news/starbucks-online-account-security" target="_blank">a written statement</a>, Starbucks</span> denied the unauthorized activity was the result of a hack or intrusion into its servers or mobile applications.</p>
<p>&#8220;Occasionally, Starbucks receives reports from customers of unauthorized activity on their online account,&#8221; the company wrote. &#8220;This is primarily caused when criminals obtain reused names and passwords from other sites and attempt to apply that information to Starbucks. To protect their security, customers are encouraged to use different user names and passwords for different sites, especially those that keep financial information.&#8221;</p>
<p>In most cases, a flurry of fraudulent account activity targeting a major brand is preceded by postings on noob-friendly hacker forums about large numbers of compromised accounts for sale, and the publication of teachable &#8220;methods&#8221; for extracting value from said hacked accounts.</p>
<p><a href="media/08124c60.crackedstarbucks.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/crackedstarbucks.png"><img class="alignleft  wp-image-30983" src="media/0bd14f4e.crackedstarbucks-580x393.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/crackedstarbucks-580x393.png" alt="crackedstarbucks" width="328" height="222" /></a></p>
<p>Unsurprisingly, we saw large numbers of compromised Starbucks accounts for sale in the days leading up to the initial story about the Starbucks fraud, as well as <a href="http://webcache.googleusercontent.com/search?q=cache:DmI9S1cFnZcJ:www.hackforums.net/printthread.php%3Ftid%3D4772287+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank">the usual &#8220;methods&#8221; explaining</a> to clueless ne&#8217;er-do-wells about how to perpetrate <a href="http://webcache.googleusercontent.com/search?q=cache:ndQR9NXhddsJ:www.mpgh.net/forum/showthread.php%3Ft%3D939157+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank">fraud against hacked accounts</a>. Here&#8217;s another noob-friendly thread explaining how to <a href="http://webcache.googleusercontent.com/search?q=cache:UWbOYyhTdmIJ:www.hackforums.net/archive/index.php/thread-4674419.html+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank">cash out compromised Subway accounts</a>; how long until we read media reports shouting that Subway has been hacked?<span id="more-30978"></span></p>
<p>To be sure, password re-use is a major problem, and it&#8217;s a core driver of fraud like this. Also, companies like Starbucks, <a href="http://krebsonsecurity.com/2014/11/thieves-cash-out-rewards-points-accounts/" target="_blank">Hilton Honors</a>, <a href="http://krebsonsecurity.com/2015/01/password-re-use-fuels-starwood-fraud-spike/" target="_blank">Starwood</a> and others certainly could be doing more &#8212; such as offering customers two-step authentication &#8212; to protect accounts. Indeed, as these recurring episodes show, affected brands take an image hit when customers have their accounts hijacked through password re-use, because the story inevitably devolves into allegations of a data breach at the brand involved.</p>
<p>But it works both ways: consumers who re-use passwords for sites holding their payment data are asking for trouble, and will get it eventually.</p>
<p>For helpful hints on picking strong passwords (or outsourcing that to third-party software and/or services), check out <a href="http://krebsonsecurity.com/password-dos-and-donts/" target="_blank">this primer</a>. For further reading about how penny-ante punks exploit password re-use and trick media outlets into falsely reporting breaches, see <a href="http://krebsonsecurity.com/2014/10/how-to-tell-data-leaks-from-publicity-stunts/" target="_blank">How to Tell Data Leaks from Publicity Stunts</a>.</p>


feed_id: http://krebsonsecurity.com/?p=30991
title: St. Louis Federal Reserve Suffers DNS Breach
uri: St-Louis-Federal-Reserve-Suffers-DNS-Breach
url: http://krebsonsecurity.com/2015/05/st-louis-federal-reserve-suffers-dns-breach/
content:
<p>The <strong>St. Louis Federal Reserve</strong> today sent a message to those it serves alerting them that in late April 2015 attackers succeeded in hijacking the domain name servers for the institution. The attack redirected Web searches and queries for those seeking a variety of domains run by the government entity to a Web page set up by the attackers in an apparent bid by cybercrooks to hijack online communications of banks and other entities dealing with the regional Fed office.</p>
<p><a href="media/99927092.fedstlouis.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/fedstlouis.png"><img class="alignright  wp-image-30995" src="media/99927092.fedstlouis.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/fedstlouis.png" alt="fedstlouis" width="302" height="241" /></a>The communique, shared by an anonymous source, was verified as legitimate by a source at another regional Federal Reserve location.</p>
<p>The notice from the St. Louis Fed stated that the &#8220;the Federal Reserve Bank of St. Louis has been made aware that on April 24, 2015, computer hackers manipulated routing settings at a domain name service (DNS) vendor used by the St. Louis Fed so that they could automatically redirect some of the Bank&#8217;s web traffic that day to rogue webpages they created to simulate the look of the St. Louis Fed&#8217;s research.stlouisfed.org website, including webpages for FRED, FRASER, GeoFRED and ALFRED.&#8221;</p>
<p>Requests for comment from the St. Louis Fed so far have gone unreturned. It remains unclear what impact, if any, this event has had on the normal day-to-day operations of hundreds of financial institutions that interact with the regional Fed operator.</p>
<p>The advisory noted that &#8220;as is common with these kinds of DNS attacks, users who were redirected to one of these phony websites may have been unknowingly exposed to vulnerabilities that the hackers may have put there, such as phishing, malware and access to user names and passwords.&#8221;</p>
<p>The statement continues:</p>
<p>&#8220;These risks apply to individuals who attempted to access the St. Louis Fed&#8217;s research.stlouisfed.org website on April 24, 2015. If you attempted to log into your user account on that date, it is possible that this malicious group may have accessed your user name and password.</p>
<p>The St. Louis Fed&#8217;s website itself was not compromised.</p>
<blockquote><p>&#8220;Out of an abundance of caution, we wanted to alert you to this issue, and also make you aware that the next time you log into your user account, you will be asked to change your password. In addition, in the event that your user name and password are the same or similar as those you use for other websites, we highly recommend that you follow best practices and use a strong, unique and different password for each of your user accounts on the Internet. Click https://research.stlouisfed.org/useraccount/forgotpassword/step1 to change your user account password now.&#8221;</p></blockquote>
<p>According to Wikipedia, the <strong><a href="http://research.stlouisfed.org/fred2/" target="_blank">Federal Reserve Economic Data</a></strong> (FRED) is a database maintained by the Research division of the Federal Reserve Bank of St. Louis that has more than 247,000 economic time series from 79 sources. The data can be viewed in graphical and text form or downloaded for import to a database or spreadsheet, and viewed on mobile devices. They cover banking, business/fiscal, consumer price indexes, employment and population, exchange rates, gross domestic product, interest rates, monetary aggregates, producer price indexes, reserves and monetary base, U.S. trade and international transactions, and U.S. financial data.<span id="more-30991"></span></p>
<p><a href="https://fraser.stlouisfed.org/" target="_blank">FRASER</a> stands for the <strong>Federal Reserve Archival System for Economic Research</strong>, and reportedly contains links to scanned images (PDF format) of historic economic statistical publications, releases, and documents including the annual Economic Report of the President. Coverage starts with the 19th and early 20th century for some economic and banking reports.</p>
<p>According to the Federal Reserve, <a href="http://geofred.stlouisfed.org/" target="_blank">GeoFred</a> allows authorized users to create, customize, and share geographical maps of data found in FRED.</p>
<p><a href="http://alfred.stlouisfed.org/" target="_blank">ALFRED</a>, short for <strong>ArchivaL Federal Reserve Economic Data</strong>, allows users to retrieve vintage versions of economic data that were available on specific dates in history.</p>
<p>The St. Louis Federal Reserve is one of twelve regional Fed organizations, and serves banks located in the all of Arkansas and portions of six other states: Illinois, Indiana, Kentucky, Mississippi, Missouri and Tennessee. According to the reserve&#8217;s Web site, it also serves most of eastern Missouri and southern Illinois.</p>
<p>No information is available at this time about the attackers involved in this intrusion, but given the time lag between this event and today&#8217;s disclosure it seems likely that it is related to state-sponsored hacking activity from a foreign adversary. If the DNS compromise also waylaid emails to and from the institution, this could be a much bigger deal. This is likely to be a fast-moving story. More updates as they become available.</p>


feed_id: http://krebsonsecurity.com/?p=30967
title: Security Firm Redefines APT: African Phishing Threat
uri: Security-Firm-Redefines-APT-African-Phishing-Threat
url: http://krebsonsecurity.com/2015/05/security-firm-redefines-apt-african-phishing-threat/
content:
<p>A security firm made headlines earlier this month when it boasted it had thwarted plans by organized Russian cyber criminals to launch an attack against multiple US-based banks. But a closer look at the details behind that report suggests the actors in question were relatively unsophisticated Nigerian phishers who&#8217;d simply registered a bunch of new fake bank Web sites.</p>
<p>The <a href="http://www.prnewswire.com/news-releases/root9b-uncovers-planned-sofacy-cyber-attack-targeting-several-international-and-domestic-financial-institutions-300081634.html" target="_blank">report</a> was released by Colorado Springs, Colo.-based security vendor <a href="http://www.root9b.com" target="_blank">root9B</a>, which touts a number of former <strong>National Security Agency</strong> (NSA) and <strong>Department of Defense</strong> cybersecurity experts among its ranks. The report attracted coverage by multiple media outlets, including, <a href="http://www.foxbusiness.com/technology/2015/05/14/new-russian-hacks-target-us-banks/" target="_blank">Fox News</a>, <a href="http://www.politico.eu/article/us-banks-russia-hack-malware-cyber/" target="_blank">Politico</a>, <a href="http://www.scmagazine.com/cycyberespionage-group-apt28-expands-sights-beyond-govt-military-orgs/article/414586/" target="_blank">SC Magazine</a> and <a href="http://thehill.com/policy/cybersecurity/241965-russian-hacking-group-was-set-to-hit-us-banks" target="_blank">The Hill</a>. root9B said it had unearthed plans by a Russian hacking gang known variously as the <a href="https://www.alienvault.com/open-threat-exchange/blog/from-russia-with-love-sofacy-sednit-apt28-is-in-town" target="_blank">Sofacy Group</a> and <strong>APT28</strong>. APT is short for &#8220;<a href="http://en.wikipedia.org/wiki/Advanced_persistent_threat" target="_blank">advanced persistent threat</a>,&#8221; and it&#8217;s a term much used among companies that sell cybersecurity services in response to breaches from state-funded adversaries in China and Russia that are bent on stealing trade secrets via extremely stealthy attacks.</p>
<div id="attachment_30976" style="width: 590px" class="wp-caption aligncenter"><a href="media/4534682a.apt28-root9b.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/apt28-root9b.png"><img class="size-medium wp-image-30976" src="media/f206e8e0.apt28-root9b-580x202.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/apt28-root9b-580x202.png" alt="The cover art for the root9B report." width="580" height="202" /></a><p class="wp-caption-text">The cover art for the root9B report.</p></div>
<p>&#8220;While performing surveillance for a root9B client, the company discovered malware generally associated with nation state attacks,&#8221; root9B CEO <strong>Eric Hipkins </strong>wrote of the scheme, which he said was targeted financial institutions such as <strong>Bank of America</strong>, <strong>Regions Bank</strong> and <strong>TD Bank</strong>, among others.</p>
<p>&#8220;It is the first instance of a Sofacy or other attack being discovered, identified and reported before an attack occurred,&#8221; Hipkins said. &#8220;Our team did an amazing job of uncovering what could have been a significant event for the international banking community. We&#8217;ve spent the past three days informing the proper authorities in Washington and the UAE, as well as the CISOs at the financial organizations.&#8221;</p>
<p>However, according to an analysis of the domains reportedly used by the criminals in the planned attack, perhaps root9B should clarify what it means by APT. Unless the company is holding back key details about their research, their definition of APT can more accurately be described as &#8220;African Phishing Threat.&#8221;</p>
<p>The report correctly identifies several key email addresses and physical addresses that the fraudsters used in common across all of the fake bank domains. But root9B appears to have scant evidence connecting the individual(s) who registered those domains to the Sofacy APT gang. Indeed, a reading of their analysis suggests their sole connection is that some of the fake bank domains used a domain name server previously associated with Sofacy activity: <strong>carbon2u[dot]com</strong> (warning: malicious host that will likely set off antivirus alerts).</p>
<p>The problem with that linkage is although carbon2go[dot]com was in fact at one time associated with activity emanating from the Sofacy APT group, Sofacy is hardly the only bad actor using that dodgy name server. There is plenty of other badness unrelated to Sofacy that calls Carbon2go home for their DNS operations, including <a href="http://www.moneymakergroup.com/print.html&amp;client=printer&amp;f=9&amp;t=467880" target="_blank">these clowns</a>.</p>
<p>From what I can tell, the vast majority of the report documents activity stemming from Nigerian scammers who have been conducting run-of-the-mill bank phishing scams for almost a decade now and have left quite a trail.</p>
<p><a href="media/fb4578d1.rolexzad.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/rolexzad.png"><img class="alignright  wp-image-31009" src="media/37fd1bb9.rolexzad-580x327.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/rolexzad-580x327.png" alt="rolexzad" width="328" height="185" /></a>For example, most of the wordage in this report from root9B discusses fake domains registered to a handful of email addresses, including &#8220;adeweb2001@yahoo.com,&#8221; adeweb2007@yahoo.com,&#8221; and &#8220;rolexzad@yahoo.com&#8221;.</p>
<p>Each of these emails have long been associated with phishing sites erected by apparent Nigerian scammers. They are tied to this Facebook <a href="https://www.facebook.com/showunmi.oluwaseun.10" target="_blank">profile</a> for a <strong><span class="fwb">Showunmi Oluwaseun</span></strong><span class="fwb">, who lists his job as CEO of a rather fishy-sounding organization called <a href="https://www.facebook.com/pages/Rolexzad-Fishery-NigLtd/527713540642102?ref=br_rs&amp;rf=212958705546195" target="_blank">Rolexzad Fishery Nig. Ltd</a>.</span></p>
<p><span id="more-30967"></span></p>
<p>The domain <strong>rolexad[dot]com</strong> was <a href="http://forum.aa419.org/viewtopic.php?t=20921&amp;sid=80083687846b939fb15cb4d2cdbbd02d" target="_blank">flagged as early as 2008</a> by <strong>aa419.org</strong>, a volunteer group that seeks to shut down phishing sites &#8212; particularly those emanating from Nigerian scammers (hence the reference to the <a href="http://en.wikipedia.org/wiki/419_scams" target="_blank">Nigerian criminal code 419</a>, which outlaws various confidence scams and frauds). That domain also references the above-mentioned email addresses. <a href="http://db.aa419.org/fakebanksview.php?key=6557" target="_blank">Here&#8217;s another phishy bank domain</a> registered by this same scammer, dating all the way back to 2005!</p>
<p><strong>Bob Zito</strong>, a spokesperson for root9B, said &#8220;the team stands by the report as 100 percent accurate and it has been received very favorably by the proper authorities in Washington (and others in the cyber community, including other cyber firms).&#8221;</p>
<p>I wanted to know if I was alone in finding fault with the root9B report, so I reached out to <strong>Jaime Blasco</strong>, vice president and chief scientist at <strong>AlienVault</strong> &#8212; one of the security firms that first published the initial findings on the Sofacy/APT28 group back in October 2014. Blasco called the root9B research &#8220;very poor&#8221; (full disclosure: AlienVault is one of several advertisers on this blog).</p>
<p>&#8220;Actually, there isn&#8217;t a link between what root9B published and Sofacy activity,&#8221; he said. &#8220;The only link is there was a DNS server that was used by a Sofacy domain and the banking stuff root9B published. It doesn&#8217;t mean they are related by any means. I&#8217;m really surprised that it got a lot of media attention due to the poor research they did, and [their use] of [terms] like &#8216;zeroday hashes&#8217; in the report really blew my mind. Apart from that it really looks like a &#8216;marketing report/we want media coverage asap,&#8217; since days after that report they published their Q1 financial results and probably that increased the value of their penny stocks.&#8221;</p>
<p>Blasco&#8217;s comments may sound harsh, but it is true that <strong>root9B Chairman Joe Grano</strong> <a href="http://www.sec.gov/Archives/edgar/data/1272550/000114036115017367/xslF345X03/doc1.xml" target="_blank">bought</a> <a href="http://www.sec.gov/Archives/edgar/data/1272550/000114036115019373/xslF345X03/doc1.xml" target="_blank">large</a> <a href="http://www.sec.gov/Archives/edgar/data/1156816/000114036115019358/xslF345X03/doc1.xml" target="_blank">quantities</a> of <a href="http://www.sec.gov/Archives/edgar/data/1272550/000114036115017213/xslF345X03/doc1.xml" target="_blank">the firm&#8217;s stock</a> roughly a week before issuing this report. On May 14, 2015, root9B <a href="https://www.google.com/url?sa=t&amp;rct=j&amp;q=&amp;esrc=s&amp;source=newssearch&amp;cd=5&amp;ved=0CDAQqQIoADAE&amp;url=http%3A%2F%2Fwww.prnewswire.com%2Fnews-releases%2Froot9b-technologies-announces-2015-first-quarter-financial-results-300083777.html&amp;ei=BI1YVYfBMYudNticgdAG&amp;usg=AFQjCNFQE6B1IjD6yLQqLY8-qguLeNOM5g&amp;sig2=e1w0xWpGWt5Gbz_6t_kuPQ&amp;bvm=bv.93564037,d.eXY" target="_blank">issued its first quarter 2015 financial results</a>.</p>
<p>There is an old adage: If the only tool you have is a hammer, you tend to treat everything as if it were a nail. In this case, if all you do is APT research, then you&#8217;ll likely see APT actors everywhere you look.</p>


feed_id: http://krebsonsecurity.com/?p=31025
title: mSpy Denies Breach, Even as Customers Confirm It
uri: mSpy-Denies-Breach-Even-as-Customers-Confirm-It
url: http://krebsonsecurity.com/2015/05/mspy-denies-breach-even-as-customers-confirm-it/
content:
<p>Last week, KrebsOnSecurity <a href="http://krebsonsecurity.com/2015/05/mobile-spy-software-maker-mspy-hacked-customer-data-leaked/" target="_blank">broke the news</a> that sensitive data apparently stolen from hundreds of thousands of customers mobile spyware maker <strong>mSpy</strong> had been posted online. mSpy has since been quoted twice by other publications denying a breach of its systems. Meanwhile, this blog has since contacted multiple people whose data was published to the deep Web, all of whom confirmed they were active or former mSpy customers.</p>
<p><a href="media/86b9a8d0.myspyapp.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/myspyapp.png"><img class="alignright  wp-image-31038" src="media/86b9a8d0.myspyapp.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/myspyapp.png" alt="myspyapp" width="218" height="338" /></a>mSpy <a href="http://www.bbc.com/news/technology-32800238" target="_blank">told BBC News</a> it had been the victim of a &#8220;predatory attack&#8221; by blackmailers, but said it had not given in to demands for money. mSpy also told the BBC that claims the hackers had breached its systems and stolen data were false.</p>
<p>&#8220;There is no data of 400,000 of our customers on the web,&#8221; a spokeswoman for the company told the BBC. &#8220;We believe to have become a victim of a predatory attack, aimed to take advantage of our estimated commercial achievements.&#8221;</p>
<p>Let&#8217;s parse that statement a bit further. No, the stolen records aren&#8217;t on the Web; rather, they&#8217;ve been posted to various sites on the Deep Web, which is only accessible using <a href="https://www.torproject.org/" target="_blank">Tor</a>. Also, I don&#8217;t doubt that mSpy was the target of extortion attempts; the fact that the company did not pay the extortionist is likely what resulted in its customers&#8217; data being posted online.</p>
<p>How am I confident of this, considering mSpy has <em>still</em> not responded to requests for comment? I spent the better part of the day today pulling customer records from the hundreds of gigabytes of data leaked from mSpy. I spoke with multiple customers whose payment and personal data &#8212; and that of their kids, employees and significant others &#8212; were included in the huge cache. All confirmed they are or were recently paying customers of mSpy.</p>
<p><strong>Joe Natoli, </strong>director of a home care provider in Arizona, confirmed what was clear from looking at the leaked data &#8212; that he had paid mSpy hundreds of dollars a month for a subscription to monitor all of the mobile devices distributed to employees by his company. Natoli said all employees agree to the monitoring when they are hired, but that he only used mSpy for approximately four months.</p>
<p>&#8220;The value proposition for the cost didn&#8217;t work out,&#8221; Natoli said.</p>
<p><strong>Katherine Till</strong>&#8216;s information also was in the leaked data. Till confirmed that she and her husband had paid mSpy to monitor the mobile device of their 14-year-old daughter, and were still a paying customer as of my call to her.</p>
<p>Till added that she was unaware of a breach, and was disturbed that mSpy might try to cover it up.</p>
<p><span class="pullquote pqleft">&#8220;This is disturbing, because who knows what someone could do with all that data from her phone,&#8221; Till said</span>, noting that she and her husband had both discussed the monitoring software with their daughter. &#8220;As parents, it’s hard to keep up and teach kids all the time what they can and can’t do. I&#8217;m sure there are lots more people like us that are in this situation now.&#8221;</p>
<p>Another user whose financial and personal data was in the cache asked not to be identified, but sheepishly confirmed that he had paid mSpy to secretly monitor the mobile device of a &#8220;friend.&#8221;</p>
<p>Update, May 22, 10:24 a.m.: mSpy is finally <a href="http://www.ibtimes.co.uk/exclusive-mspy-hacker-says-company-knew-data-leak-two-months-ago-1502473" target="_blank">admitting</a> that it did have a breach that exposed customer information, but they are still downplaying the numbers.<span id="more-31025"></span></p>
<p><span style="text-decoration: underline;">REACTION ON CAPITOL HILL</span></p>
<p>News of the mSpy breach prompted renewed calls from <strong>Sen. Al Franken</strong> for outlawing products like mSpy, which the Minnesota democrat refers to as &#8220;stalking apps.&#8221; In <a href="media/279a91b1.150519mSpy.pdf" data-original-source="http://www.franken.senate.gov/files/documents/150519mSpy.pdf" target="_blank">a letter</a> (PDF) sent this week to the <strong>U.S. Justice Department</strong> and <strong>Federal Trade Commission</strong>, Franken urged the agencies to investigate mSpy, whose products he called &#8216;deeply troubling&#8217; and &#8220;nothing short of terrifying&#8221; when &#8220;in the hands of a stalker or abuse intimate partner.&#8221;</p>
<p>Last year, Franken <a href="http://www.franken.senate.gov/?p=press_release&amp;id=2755" target="_blank">reintroduced</a> The Location Privacy Protection Act of 2014, legislation that would outlaw the development, operation, and sale of such products.</p>
<p>U.S. regulators and law enforcers have taken a dim view of companies that offer mobile spyware services like mSpy. In September 2014, U.S. authorities <a href="http://www.forbes.com/sites/kashmirhill/2014/09/30/stealthgenie-ugly-marketing-of-spyware/" target="_blank" rel="noreferrer">arrested</a> a 31-year-old <strong>Hammad Akbar</strong>, the CEO of a Lahore-based company that makes a spyware app called StealthGenie. The FBI noted that while the company advertised StealthGenie’s use for “monitoring employees and loved ones such as children,” the primary target audience was people who thought their partners were cheating. Akbar was charged with selling and advertising wiretapping equipment.</p>
<p>“Advertising and selling spyware technology is a criminal offense, and such conduct will be aggressively pursued by this office and our law enforcement partners,” <strong>U.S. Attorney Dana Boente</strong> said in a press release tied to Akbar’s indictment.</p>
<p>Akbar <a href="http://www.justice.gov/opa/pr/man-pleads-guilty-selling-stealthgenie-spyware-app-and-ordered-pay-500000-fine" target="_blank" rel="noreferrer">pleaded guilty</a> to the charges in November 2014, and according to the Justice Department he is “the first-ever person to admit criminal activity in advertising and selling spyware that invades an unwitting victim’s confidential communications.”</p>


feed_id: http://krebsonsecurity.com/?p=31043
title: Carefirst Blue Cross Breach Hits 1.1M
uri: Carefirst-Blue-Cross-Breach-Hits-1-1M
url: http://krebsonsecurity.com/2015/05/carefirst-blue-cross-breach-hits-1-1m/
content:
<p><strong>CareFirst BlueCross BlueShield</strong> on Wednesday said it had been hit with a data breach that compromised the personal information on approximately 1.1 million customers. There are indications that the same attack methods may have been used in this intrusion as with breaches at <strong>Anthem</strong> and <strong>Premera</strong>, incidents that collectively involved data on more than 90 million Americans.</p>
<p><a href="media/196b9f8f.carefirst.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/carefirst.png"><img class="alignright  wp-image-31047" src="media/196b9f8f.carefirst.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/carefirst.png" alt="carefirst" width="246" height="217" /></a>According to <a href="http://www.carefirstanswers.com/" target="_blank">a statement</a> CareFirst issued Wednesday, attackers gained access to names, birth dates, email addresses and insurance identification numbers. The company said the database did not include Social Security or credit card numbers, passwords or medical information. Nevertheless, CareFirst is offering credit monitoring and identity theft protection for two years.</p>
<p>Nobody is officially pointing fingers at the parties thought to be responsible for this latest health industry breach, but there are clues implicating the same state-sponsored actors from China thought to be involved in the Anthem and Premera attacks.<span id="more-31043"></span></p>
<p>As I noted in <a href="http://krebsonsecurity.com/2015/02/anthem-breach-may-have-started-in-april-2014/" target="_blank">this Feb. 9, 2015 story</a>, Anthem was breached not long after a malware campaign was erected that mimicked Anthem&#8217;s domain names at the time of the breach. Prior to its official name change at the end of 2014, Anthem was known as Wellpoint. Security researchers at cybersecurity firm <strong>ThreatConnect Inc.</strong> had uncovered a series of subdomains for we11point[dot]com (note the &#8220;L&#8217;s&#8221; in the domain were replaced by the numeral &#8220;1&#8221;) &#8212; including myhr.we11point[dot]com and hrsolutions.we11point[dot]com.</p>
<p>ThreatConnect also found that the domains were registered in April 2014 (approximately the time that the Anthem breach began), and that the domains were used in conjunction with malware designed to mimic a software tool that many organizations commonly use to allow employees remote access to internal networks.</p>
<p>On Feb. 27, 2015, ThreatConnect <a title="http://www.threatconnect.com/news/the-anthem-hack-all-roads-lead-to-china/" href="http://www.threatconnect.com/news/the-anthem-hack-all-roads-lead-to-china/" target="_blank" rel="noreferrer">published more information</a> tying the same threat actors and modus operandi to a domain called “<strong>prennera[dot]com</strong>” (notice the use of the double “n” there to mimic the letter “m”).</p>
<p><a href="media/bcc81233.tc-cfbcbs.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/tc-cfbcbs.png"><img class="alignleft  wp-image-31052" src="media/bcc81233.tc-cfbcbs.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/tc-cfbcbs.png" alt="tc-cfbcbs" width="288" height="237" /></a>“It is believed that the prennera[dot]com domain may have been impersonating the Healthcare provider <a href="http://www.premera.com/" rel="noreferrer">Premera Blue Cross</a>, where the attackers used the same character replacement technique by replacing the ‘m’ with two ‘n’ characters within the faux domain, the same technique that would be seen five months later with the we11point[dot]com command and control infrastructure,” ThreatConnect observed in a February 2015 blog post.</p>
<p>Turns out, the same bulk registrant in China that registered the phony Premera and Anthem domains in April 2014 also registered two Carefirst look-alike domains &#8212; <strong>careflrst[dot]com</strong> (the &#8220;i&#8221; replaced with an &#8220;L&#8221;) and <strong>caref1rst[dot]com</strong> (the &#8220;i&#8221; replaced with the number &#8220;1&#8221;).</p>
<p>Additionally, ThreatConnect has <a href="https://www.anthemfacts.com/" target="_blank">unearthed evidence</a> showing the same tactics were used on <strong>EmpireB1ue.com</strong> (note the &#8220;L&#8221; replaced with a number &#8220;1&#8221;), a domain registered April 11, 2014 (the same day as the phony Carefirst domains). <strong>EmpireBlue BlueCross BlueShield</strong> was o<a href="https://www.anthemfacts.com/" target="_blank">ne of the organizations impacted by the Anthem breach</a>.</p>


feed_id: http://krebsonsecurity.com/?p=31060
title: Recent Breaches a Boon to Extortionists
uri: Recent-Breaches-a-Boon-to-Extortionists
url: http://krebsonsecurity.com/2015/05/recent-breaches-a-boon-to-extortionists/
content:
<p>The recent breaches involving the leak of personal data on millions of customers at online hookup site <strong>Adult Friend Finder</strong> and mobile spyware maker <strong>mSpy</strong> give extortionists and blackmailers plenty of ammunition with which to ply their trade. And there is some evidence that ne&#8217;er-do-wells are actively trading this data and planning to abuse it for financial gain.</p>
<p>Within hours after data on tens (if not hundreds) of thousands of mSpy users leaked onto the Deep Web, miscreants on the <strong>&#8220;Hell&#8221; forum</strong> (reachable only via <a href="http://www.torproject.org" target="_blank">Tor</a>) were busy extracting countless <strong>Apple iTunes</strong> usernames and passwords from the archive.</p>
<p>&#8220;Apple Id accounts you can use Tor to login perfectly safe! Good method so far use &#8216;Find My phone,'&#8221; wrote Ping, a moderator on the forum. &#8220;Wipe data and set a message that they been hacked and the only way to get their data back is to pay a ransom.&#8221;</p>
<div id="attachment_31064" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/4a0602bb.hell-hackedItunes.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/hell-hackedItunes.png"><img class="size-medium wp-image-31064" src="media/20b54449.hell-hackedItunes-580x399.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/hell-hackedItunes-580x399.png" alt="&quot;Hell&quot; forum users discuss extorting mSpy users who had iTunes account credentials compromised in the breach." width="580" height="399" /></a><p class="wp-caption-text">&#8220;Hell&#8221; forum users discuss extorting mSpy users who had iTunes account credentials compromised in the breach.</p></div>
<p><span id="more-31060"></span>mSpy works on non-jailbroken iPhones and iPads, but the user loading the program needs to supply the iTunes username and password to load mSpy onto the device. The tough part about a breach at a company like mSpy is that many &#8220;users&#8221; will not know they need to change their iTunes account passwords because they don&#8217;t know they have the application installed in the first place!</p>
<p>Late last week, several <a href="https://teksecurityblog.com/" target="_blank">publications</a> <a href="http://www.pcworld.com/article/2926232/full-adult-friend-finder-database-offered-for-17000.html" target="_blank">reported</a> that the database for Adult Friend Finder&#8217;s users was being sold online for the Bitcoin equivalent of about USD $17,000. Unfortunately, that same database seems to be circulating quickly around the Deep Web, including on the aforementioned Hell forum.</p>
<p>In <a href="http://ffn.com/security-updates/" target="_blank">an update</a> posted to its site on Friday, AFF owner FriendFinder Networks sought to assure registered users there was no evidence that any financial information or passwords were compromised.</p>
<p>Nevertheless, the AFF breach clearly threatens to inundate breached users with tons more spam, and potentially makes it easy to identify subscribers in real life. Such a connection could expose users to blackmail attempts: I spent roughly 10 minutes popping email addresses from the leaked AFF users list into <strong>Facebook</strong>, and managed to locate more than a dozen active Facebook accounts apparently tied to married men.</p>
<div id="attachment_31065" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/945b64dc.afflist.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/afflist.png"><img class="size-medium wp-image-31065" src="media/073f9f96.afflist-580x281.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/afflist-580x281.png" alt="A description posted to the &quot;Hell&quot; forum listing the attributes of the Adult Friend Finder user database." width="580" height="281" /></a><p class="wp-caption-text">A description posted to the &#8220;Hell&#8221; forum listing the attributes of the Adult Friend Finder user database.</p></div>
<p>According to <a href="media/bf86e262.pingmsg.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/pingmsg.png" target="_blank">a note</a> posted by the aforementioned Hell moderator Ping (this user is also administrator of the Deep Web forum <strong>The Real Deal</strong>), the AFF database has been traded online since March 2015, but it only received widespread media attention last week.</p>


feed_id: http://krebsonsecurity.com/?p=31082
title: IRS: Crooks Stole Data on 100K Taxpayers Via ‘Get Transcript’ Feature
uri: IRS-Crooks-Stole-Data-on-100K-Taxpayers-Via-Get-Transcript-Feat
url:
http://krebsonsecurity.com/2015/05/irs-crooks-stole-data-on-100k-taxpayers-via-get-transcript-feature/

content:
<p>In March 2015, KrebsOnSecurity broke the news that identity thieves engaged in filing fraudulent tax refund requests with the <strong>Internal Revenue Service</strong> (IRS) were using the IRS&#8217;s own Web site to obtain taxpayer data needed to complete the phony requests. Today, IRS Commissioner <strong>John Koskinen</strong> acknowledged that crooks used this feature to pull sensitive data on more than 100,000 taxpayers this year.</p>
<p><a href="media/d005bf3a.Screenshot-2015-03-29-14.22.55.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/Screenshot-2015-03-29-14.22.55.png"><img class="alignright  wp-image-30558" src="media/d005bf3a.Screenshot-2015-03-29-14.22.55.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/Screenshot-2015-03-29-14.22.55.png" alt="Screenshot 2015-03-29 14.22.55" width="198" height="183" /></a>That March story &#8212; <a href="http://krebsonsecurity.com/2015/03/sign-up-at-irs-gov-before-crooks-do-it-for-you/" target="_blank">Sign Up at IRS.gov Before Crooks Do It For You</a> &#8212; tracked the nightmarish story of <strong>Michael Kasper</strong>, one of millions of Americans victimized by tax refund fraud each year. When Kasper tried to get a transcript of the fraudulent return using the “Get Transcript” function on IRS.gov, he learned that someone had already registered through the IRS’s site using his Social Security number and an unknown email address.</p>
<p>Koskinen was quoted today in an <a href="http://bigstory.ap.org/article/34539a748b3745ffb92451472f814ffa/apnewsbreak-irs-says-thieves-stole-tax-info-100000" target="_blank">Associated Press story</a> saying the IRS was alerted to the thieves when technicians noticed an increase in the number of taxpayers seeking transcripts. The story noted that the IRS said they targeted the system from February to mid-May, and that the service has been temporarily shut down. Prior to that shutdown, the IRS estimates that thieves used the data to steal up to $50 million in fraudulent refunds.</p>
<p>&#8220;In all, about 200,000 attempts were made from questionable email domains, with more than 100,000 of those attempts successfully clearing authentication hurdles,&#8221; the IRS <a href="http://www.irs.gov/uac/Newsroom/IRS-Statement-on-the-Get-Transcript-Application" target="_blank">said in a statement</a>. &#8220;During this filing season, taxpayers successfully and safely downloaded a total of approximately 23 million transcripts.&#8221;<span id="more-31082"></span></p>
<p><span style="text-decoration: underline;">SCOURGE AT THE STATE LEVEL</span></p>
<p>The <strong>Government Accountability Office</strong> (GAO) estimates that thieves steal nearly $6 billion from state and federal coffers last year via tax refund fraud. This year, fraudsters changed their tactics, leading to a huge spike in attempted fraudulent refund requests &#8212; <a href="http://krebsonsecurity.com/2015/02/citing-tax-fraud-spike-turbotax-suspends-state-e-filings/" target="_blank">particularly at the state level</a>.</p>
<p>Earlier this week, I had an opportunity to interview <strong>John Valentine</strong>, chair of the <strong>Utah State Tax Commission</strong>. Valentine said this year <em>his state saw a tenfold increase in suspicious tax refund filings</em>, and that most of that increase was the result of a type of tax fraud the state had never seen before.</p>
<p>&#8220;This was unique, where someone clearly had the information from the prior year&#8217;s tax return,&#8221; Valentine said. &#8220;That different significantly from the way the return comes across if it&#8217;s just ID theft. If you have the prior year&#8217;s return, you have the names of children, their Social Security numbers and other data you don&#8217;t often times get with ID theft.&#8221;</p>
<p>These suspicious returns all had the filing status exactly the same [as the year prior], the number of exemptions exactly the same&#8230;.you even got spelling errors on addresses and names, so that the same errors that occurred in the 2013 return occurred in the fraudulent 2014 return,&#8221; Valentine explained. &#8220;That&#8217;s what told us we were dealing with a different kind of fraud, especially since the extent of the fraud was ten times the amount of fraud we&#8217;d seen in the past.&#8221;</p>
<p>Valentine said he believes most of that increase was due to lax authentication and security at third-party tax preparation firms (TurboTax, for example). Based on <a href="http://krebsonsecurity.com/?s=turbotax&amp;x=0&amp;y=0" target="_blank">numerous stories about poor authentication and virtually nonexistent &#8220;know-your-customer&#8221; procedures at TurboTax</a>, I&#8217;ve no doubt the nation&#8217;s leading tax preparation firm contributed considerably to the spike. But that same data that Valentine references also could be had by pulling taxpayer data from the IRS&#8217;s site, which until very recently offered the full previous year&#8217;s W2 information on taxpayers.</p>
<p>Stay tuned over the next week for more in-depth stories and interviews about how the states are grappling with tax return fraud, and the changes they are seeking to the status quo.</p>


feed_id: http://krebsonsecurity.com/?p=31092
title: More Evidence of mSpy Apathy Over Breach
uri: More-Evidence-of-mSpy-Apathy-Over-Breach
url: http://krebsonsecurity.com/2015/05/more-evidence-of-mspy-apathy-over-breach/
content:
<p>Mobile spyware maker <strong>mSpy</strong> has expended a great deal of energy <a href="http://www.bbc.co.uk/news/technology-32826678" target="_blank">denying and then later downplaying</a> a breach involving <a href="http://krebsonsecurity.com/2015/05/mobile-spy-software-maker-mspy-hacked-customer-data-leaked/" target="_blank">data stolen from tens of thousands of mobile devices</a> running its software. Unfortunately for victims of this breach, mSpy&#8217;s lackadaisical response has left millions of screenshots taken from those devices <em>wide open and exposed to the Internet via its own Web site</em>.</p>
<p><a href="media/91c1479b.mspylogo.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/mspylogo.png"><img class="alignright  wp-image-31097" src="media/44eb2b1c.mspylogo-580x368.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/mspylogo-580x368.png" alt="mspylogo" width="334" height="212" /></a>The mSpy data was <a href="http://krebsonsecurity.com/2015/05/recent-breaches-a-boon-to-extortionists/" target="_blank">leaked to the Deep Web</a>, where hundreds of gigabytes of files, chat logs, location records and other data was dumped after the company reportedly declined to comply with extortion demands made by hackers who&#8217;d broken into mSpy&#8217;s servers. Included in that huge archive is a 13 gigabyte (compressed) directory referencing countless screen shots taken from devices running mSpy&#8217;s software &#8212; including screen shots taken secretly by users who installed the software on a friend or partner&#8217;s device.</p>
<p>The log file of the screen shots taken from mSpy-infested devices doesn&#8217;t store the actual screenshot, but instead includes incomplete links to the images. <em>Incredibly, nearly two weeks after this breach became public, all of the leaked screen shots remain viewable over the Internet with nothing more than a Web browser if one knows the base URL that precedes the file name.</em> And that base URL is trivial to work out if you have an active mSpy account.</p>
<p>For example, here&#8217;s a fairly benign screen shot reference that was included in the leaked files:</p>
<p>&#8220;ref&#8221;: &#8220;dav/a00/003/628/359/2015/02/<wbr />24/cGWmz4OjqoyImZQh-25493887.<wbr />jpg.open</p>
<p>Adding the base URL to that URL stem produces a screen shot showing an mSpy-enabled device browsing <strong>seberizeni.cz</strong>, a Czech news site. Disturbingly, it is trivial to identify the owners of many mSpy-enabled devices merely based on the information available in the bookmarks bar or Web browser windows shown in many of these screen shots.</p>
<p>According to mSpy, however, this is not a big deal. Almost a week after I requested comment from mSpy, a person named <strong>Amelie Ross</strong> responded with a somewhat nonsensical statement that essentially said the whole incident was dramatically exaggerated and aggravated by the media.<span id="more-31092"></span></p>
<p>&#8220;Data logs do not include the information of the account user, therefore cannot be tracked back to data owner,&#8221; Ross said, ignoring the fact that I was able to identify and contact many of the company&#8217;s customers. &#8220;This case been a hard lesson and will only serve as an incentive for perfecting our service further. We have communicated with our customers whose data could have been stolen, described them a situation and they perceived it with a total understanding.&#8221;</p>
<p>Reached today about the exposed screenshots, mSpy reiterated its claim the data cannot be traced back to the data owner, and then acknowledged that it was reworking its system to render the exposed screenshot links unusable.</p>
<p>&#8220;Currently we&#8217;re working on re-<wbr />hashing of the exposed data, <wbr />which will result in the <wbr />leaked links becoming <wbr />inoperable,&#8221; Ross wrote. &#8220;We expect it to be completed within 24 hours.&#8221;</p>
<p>A number of journalists following the mSpy breach story have asked if I knew where the company was based, noting that authorities from several countries are now investigating the breach. As I mentioned in my original story on the break-in, the founders of the company variously claimed UK and Russian nationality, but it remains unclear where the company is physically located. However, I&#8217;m leaning toward Russia or another Eastern European country. Ross&#8217;s response to my initial email includes a forwarded copy of my May 9 message to the main media@mspy.com mailbox, which was prefaced by the the timestamp: &#8220;<span class="aBn" tabindex="0" data-term="goog_1279369413"><span class="aQJ">09.05.2015 17:55</span></span>, brian krebs пишет:&#8221; That last word, пишет, is Russian for &#8220;wrote&#8221;. According to a review of the email headers, the response was sent from a laptop in Ukraine on the Eastern European summer time zone.</p>
<p>I hope it&#8217;s clear that it&#8217;s foolhardy to place any trust or confidence in a company whose reason for existence is secretly spying on people. Alas, the only customers who can truly &#8220;trust&#8221; a company like this are those who are indifferent to the privacy and security of the device owner being spied upon.</p>


feed_id: http://krebsonsecurity.com/?p=31017
title: Phishing Gang is Audacious Manipulator
uri: Phishing-Gang-is-Audacious-Manipulator
url: http://krebsonsecurity.com/2015/05/phishing-gang-is-audacious-manipulator/
content:
<p>Cybercriminals who specialize in phishing &#8212; or tricking people into giving up usernames and passwords at fake bank and ecommerce sites &#8212; aren&#8217;t generally considered the most sophisticated crooks, but occasionally they do exhibit creativity and chutzpah. That&#8217;s most definitely the case with a phishing gang that calls itself the &#8220;Manipulaters Team&#8221;, whose Web site boasts that it specializes in brand research and development.</p>
<p>I first learned about the Manipulaters from a source at an Australian bank who clued me in to a phishing group that specializes in targeting <strong>Apple&#8217;s iCloud</strong> services and a whole mess of U.S., European and Asian banks. For whatever reason (probably because they&#8217;re proud of their work), these guys leave a calling card of sorts in the WHOIS Web site registration records for most of the phishing domains that they register: According to <a href="http://www.domaintools.com" target="_blank">Domaintools.com</a>, some 329 domains are registered to &#8220;<strong>admin@manipulaters[dot]com</strong>&#8221; (complete list of domains: in <a href="media/16c0a31f.RWR_1432672877_2015-05-26.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/RWR_1432672877_2015-05-26.pdf" target="_blank">PDF</a> and <a href="http://krebsonsecurity.com/wp-content/uploads/2015/05/RWR_1432672877_2015-05-26.csv" target="_blank">CSV</a>).</p>
<div id="attachment_31110" style="width: 590px" class="wp-caption aligncenter"><a href="media/8820f822.manipulaters.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/manipulaters.png"><img class="size-medium wp-image-31110" src="media/1654f173.manipulaters-580x453.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/manipulaters-580x453.png" alt="The Web site for the &quot;Manipulaters Team,&quot; a phishing gang that brazenly advertises a specialization in &quot;brand research.&quot;" width="580" height="453" /></a><p class="wp-caption-text">The Web site for the &#8220;Manipulaters Team,&#8221; a phishing gang that brazenly advertises a specialization in &#8220;brand research.&#8221;</p></div>
<p>Manipulaters[dot]com is a pretty amusing site all around. Their home page advises that Mainpulaters &#8220;is an institute that caters to brand research &amp; development. We have studied computer related products immensely, and are confident that we can get the job done. The learning never stops for us though, as we are always looking for ways to improve.&#8221; Brand research. Yeah, right.</p>
<p>&#8220;Our goal is to help each business and brand reach their ultimate potential,&#8221; explains the &#8220;Our Members&#8221; section of the site. &#8220;We have contracts with our members that allows us to have guidelines for them to follow on their path to success. We have put these in place for a reason. This provides the stability and direction that companies/brands need to succeed.&#8221; Points for brazenness.</p>
<p>Their site advises that interested parties can &#8220;become a member&#8221; of the Manipulaters Team just by paying a one-time membership fee of $15, and providing a driver&#8217;s license/ID card plus a phone or electricity bill. Ah, there&#8217;s nothing quite like phishers phishing phishers.</p>
<p>The scary aspect of this fraud gang is that they appear to play in the Web hosting space as well. Most of their phishing pages are in fact hosted on Internet address space that is assigned to Manipulaters[dot]com: Incredibly, the group is listed as the current occupants of an entire Class C range of Internet addresses, from 167.160.46.0 to 167.160.46.255.<span id="more-31017"></span></p>
<p>One common name across most of the online properties erected by the Manipulators Team is <strong><a href="https://www.linkedin.com/profile/view?id=38336173&amp;authType=name&amp;authToken=tro6" target="_blank">Madih-ullah Riaz</a></strong>, a resident of Pakistan who appears to manage this Manipulaters out of a high-rise apartment building in Karachi. Interestingly, Riaz&#8217;s email address &#8212; <strong>madihrb@hotmail.com</strong> &#8212; was among those listed as a user of <strong>BestRecovery</strong>, a phishing and malware deployment service <a href="http://krebsonsecurity.com/?s=bestrecovery&amp;x=0&amp;y=0" target="_blank">whose user database was hacked last year</a>. Mr. Riaz did not respond to requests for comment.</p>
<p>Mr. Riaz is listed as the founding member on the &#8220;About Us&#8221; page of the Manipulaters Team, along with a guy named <a href="https://www.facebook.com/speed.demon.7334504?fref=ufi" target="_blank">Omer Fareed</a>. Both men also are listed as founders of a software company called <a href="http://www.postingkit.com/ourteam.php" target="_blank">Posting Kit</a>, which is a company included in the job history on Riaz&#8217;s LinkedIn profile.</p>
<p>The Manipulaters Team likes to use domain name service (DNS) settings from another blatantly fraudulent service called &#8220;FreshSpamTools[dot]eu&#8221;, a scammer-friendly service offered by a fellow Pakistani that also conveniently sells phishing toolkits targeting a number of popular brands. Manipulators indeed.</p>


feed_id: http://krebsonsecurity.com/?p=31131
title: Malware Evolution Calls for Actor Attribution?
uri: Malware-Evolution-Calls-for-Actor-Attribution
url: http://krebsonsecurity.com/2015/05/malware-evolution-calls-for-actor-attribution/
content:
<p>What makes one novel strain of malicious software more dangerous or noteworthy than another? Is it the sheer capability and feature set of the new malware, or are these qualities meaningless without also considering the skills, intentions and ingenuity of the person wielding it? Most experts probably would say it’s important to consider attribution insofar as it is knowable, but it’s remarkable how seldom companies that regularly publish reports on the latest criminal innovations go the extra mile to add context about the crooks apparently involved in deploying those tools.</p>
<p><a class="lightbox" href="media/a1dc80c3.mysteryman.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/mysteryman.png"><img class="alignright  wp-image-31145" src="media/a1dc80c3.mysteryman.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/mysteryman.png" alt="mysteryman" width="244" height="288" /></a></p>
<p>Perhaps with some new malware samples, the associated actor attribution data is too inconclusive to publish —particularly when corporate lawyers are involved and such findings are juxtaposed to facts about a new code sample that can be demonstrated empirically. Maybe in other cases, the company publishing the research privately has concerns that airing their findings on attribution will somehow cause people to take them or the newfound threat less seriously?</p>
<p>I doubt many who are familiar with my reporting will have trouble telling where I come down on this subject, which explains why I’m fascinated by a bit of digging done into the actor behind a new malware sample that recently received quite a bit of media attention. That threat, known variously as “<strong>Rombertik</strong>” and “<strong>Carbon Grabber</strong>,” is financial crimeware that gained media attention because of a curious feature: it was apparently designed to overwrite key sections of the hard drive, rendering the host system unbootable.</p>
<p>News about Rombertik’s destructive ways was <a href="http://blogs.cisco.com/security/talos/rombertik" target="_blank">first published by Cisco</a>, which posited that the feature was a defense mechanism built into the malware to frustrate security researchers who might be trying to unlock its secrets. Other security firms published competing theories about the purpose of the destructive component of the malware. Some argued it was the malware author’s way of enforcing licensing agreements with his customers: Those who tried to use the malware on Web addresses or domains that were not authorized as part of the original sale would be considered in violation of the software agreement — their malware infrastructure thus exposed to (criminal) a copyright enforcement regime of the most unforgiving kind.</p>
<p>Incredibly, none of these companies bothered to look more closely at the clues rather clumsily left behind by the person apparently responsible for spreading <a href="https://www.google.com/search?q=0d11a13f54d6003a51b77df355c6aa9b1d9867a5af7661745882b61d9b75bccf&amp;oq=0d11a13f54d6003a51b77df355c6aa9b1d9867a5af7661745882b61d9b75bccf&amp;aqs=chrome..69i57.304j0j7&amp;sourceid=chrome&amp;es_sm=91&amp;ie=UTF-8" target="_blank">the malware sample</a> that prompted Cisco to blog about Rombertik in the first place. Had they done so, they might have discovered that this ultra-sophisticated new malware strain was unearthed precisely because it was being wielded by a relatively unsophisticated actor who seems to pose more of a threat to himself than to others.</p>
<p><span style="text-decoration: underline;">AFRICAN PERSISTENT THREAT</span></p>
<p>As much as I would love to take credit for this research, that glory belongs to the community which has sprung up around <a href="http://www.threatconnect.com/" target="_blank">ThreatConnect</a>, a company that specializes in threat attribution with a special focus on crowdsourcing raw actor data across a large community of users.</p>
<p class="p1"><span class="s1">In this case, ThreatConnect dug deeper into <strong>centozos[dot]org[dot]in</strong>, the control server used in the Rombertik sample featured in the original Cisco report. The Web site registration records for that domain lists an individual in Lagos, Nigeria who used the email address <span class="s2">genhostkay@dispostable.com</span>. For those unfamiliar with Dispostable, it is a free, throwaway email service that allows anyone to send and receive email without supplying a password for the account. While this kind of service relieves the user of having to remember their password, it also allows anyone who knows the username to read all of the mail associated with that account.</span></p>
<div id="attachment_31144" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/3a5eb072.kallyinbox.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/kallyinbox.png"><img class="size-medium wp-image-31144" src="media/a1682e78.kallyinbox-580x371.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/kallyinbox-580x371.png" alt="KallySky's inbox at Dispostable." width="580" height="371" /></a><p class="wp-caption-text">KallySky&#8217;s inbox at Dispostable.</p></div>
<p><span id="more-31131"></span>Reviewing the messages in that <strong><span class="s2">genhostkay@dispostable.com</span></strong> account reveals that the account holder registered the domain centozos[dot]org[dot]in with registrar <strong>Internet.bs</strong>, and that he asked to be CC’d on another email address, “<strong><span class="s2">kallysky@yahoo.com</span></strong>”. ThreatConnect found that same <strong><span class="s2">genhostkay@dispostable.com</span></strong> email address used to register a number of other domains associated with distributing malware, including <strong>kallyguru[dot]in</strong>, <strong>nimoru[dot]com</strong>, <strong>directxex[dot]net</strong>, and <strong>norqren[dot]com</strong>.</p>
<p>The email address <strong><span class="s2">kallysky@yahoo.com</span></strong> is tied to a Facebook account for a 30-year-old <strong>Kayode Ogundokun</strong> from Lagos, Nigeria, who maintains a robust online presence from his personal and “business” Facebook accounts, Blogger, LinkedIn, Twitter and Youtube,” ThreatConnect wrote.</p>
<p class="p1"><a href="media/1435e7bb.kallysocial.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/kallysocial.png"><img class="aligncenter size-medium wp-image-31143" src="media/8aa5c88e.kallysocial-580x371.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/kallysocial-580x371.png" alt="kallysocial" width="580" height="371" /></a></p>
<p>“In fact Ogundokun has done very little in the way of <span class="s1">operational security (OPSEC). His efforts in covering tracks his tracks have been minimal to non-existent,&#8221; ThreatConnect continued. &#8220;</span><span class="s1">Ogundokun’s skillset appears to be limited to using commodity RATs and botnets </span><span class="s1">within email borne attacks and is motivated primarily on financial gain rather than espionage or ideological purposes. [We assess] that Ogundokun likely purchased a new version of Carbon Grabber from a much more capable and sophisticated tool author, where the author subsequently licensed it to a less capable operator. His particular sample of Carbon Grabber was simply caught up in a headline grabbing story.&#8221;</span></p>
<p><span style="text-decoration: underline;">REVEALING INTERNET SECRETS TO YOU</span></p>
<p>For several years until very recently, Kally/Koyode maintained <a href="http://kallysky.com"><span class="s2">kallysky.com</span></a>, which thanks to <a href="http://archive.org"><span class="s2">archive.org</span></a> we can still review in all its glory. In it, Kally’s site — which boldly and confidently displays the banner message “Revealing Internet Secrets to You” — links to dozens of video tutorials he produced and stars in on how to use various malware tools.</p>
<p><div id="attachment_31142" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/fe692c35.kallysecrets.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/kallysecrets.png"><img class="size-medium wp-image-31142" src="media/622f5cee.kallysecrets-580x480.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/kallysecrets-580x480.png" alt="One of countless pages archived from Kallysky[dot]com" width="580" height="480" /></a><p class="wp-caption-text">One of countless pages archived from Kallysky[dot]com</p></div>“He claims to offer services for Citadel Bot, Cybergate RAT, Darkcomet RAT with cpanel web services, ‘Fully Undetectable’ by anti-virus as well as other capabilities such as binders and file extension spoofers, all for educational purposes, of course,” ThreatConnect notes. “He also provides his phone number, BlackBerry Pin and the same kallysky@yahoo[dot]com email address that we observed earlier with the genhostkay@dispostable[dot]com norqren[dot]com domain expiration email.”</p>
<div class="page" title="Page 19">
<div class="layoutArea">
<div class="column">
<p>In an April 2014 video, Ogundokun provides a Carbon Form Grabber / Carbon Grabber tutorial. At the beginning of the video, he includes his kallysky@yahoo[dot]com contact details.</p>
</div>
</div>
</div>
<p>Sadly, Kally did not respond to requests for an interview about his work sent to his <a href="http://yahoo.com"><span class="s2">yahoo.com</span></a> address. But his case and the initial industry writeups on Rombertik are illustrative of a trend within the security industry that’s become all-too-common: Threat reports that lack context — particularly on attribution that is so trivially discoverable, ThreatConnect observed.</p>
<p>“As news of Rombertik spread, we saw sensationalized reporting which used attention grabbing terms such as &#8216;terrifying,&#8217; &#8216;deadly&#8217; and &#8216;suicide bomber malware&#8217; dominate the security news headlines,” the company wrote. “Now if we consider for a moment the man hours and ad hoc reprioritization for many security teams globally who were queried or tasked to determine if their organization was at risk to Rombertik &#8211; had the organizations also had adversary intelligence of Ogundokun’s rudimentary technical and operational sophistication, they would have seen a clearer comparison of the functional capabilities of the Rombertik/Carbon Grabber contrasted against <span class="s1">the operator’s (Ogundokun) intent, and could have more effectively determined the level of risk.”</span></p>


feed_id: http://krebsonsecurity.com/?p=30911
title: States Seek Better Mousetrap to Stop Tax Refund Fraud
uri: States-Seek-Better-Mousetrap-to-Stop-Tax-Refund-Fraud
url: http://krebsonsecurity.com/2015/06/states-seek-better-mousetrap-to-stop-tax-refund-fraud/
content:
<p>With the 2014 tax filing season in the rearview mirror, state tax authorities are struggling to incorporate new approaches to identifying and stopping fraudulent tax refund requests, a $6 billion-a-year problem that&#8217;s hit many states particularly hard this year. But some states say they are encountering resistance to those efforts on nearly every front, from Uncle Sam to online tax vendors and from the myriad of financial firms that profit handsomely from processing phony tax refunds.</p>
<div id="attachment_31160" style="width: 327px" class="wp-caption alignright"><a href="http://krebsonsecurity.com/2015/06/phony-tax-refunds-a-cash-cow-for-everyone/"><img class=" wp-image-31160" src="media/97dc6b74.cashcow-e1433131582818-580x337.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/cashcow-e1433131582818-580x337.png" alt="Cash Cow: Check out this primer on which companies are profiting from tax refund fraud." width="317" height="184" /></a><p class="wp-caption-text">Cash Cow: Click on the image above for a primer on how many companies are profiting from tax refund fraud.</p></div>
<p>Last week, the Internal Revenue Service (IRS) disclosed that thieves had stolen up to $50 million in phony refunds by <a href="http://krebsonsecurity.com/2015/05/irs-crooks-stole-data-on-100k-taxpayers-via-get-transcript-feature/" target="_blank">pulling tax data on more than 100,000 Americans directly from the agency&#8217;s own Web site</a>. The thieves were able to do this for the same reason that fraudsters are able to get away with filing and getting paid for bogus refunds: The IRS, the states and the tax preparation firms all try to authenticate filers based on static identifiers about the filer &#8212; such as birthdays and Social Security numbers, as well as answers to a handful of easily-guessed or researched &#8220;knowledge based-authentication&#8221; questions.</p>
<p>I spoke at length with several state tax commissioners about the size and scope of the tax refund fraud problem, and what the IRS and the states are doing to move beyond reliance on static identifiers to authenticate taxpayers. One of the state experts I spoke with was <strong>Julie Magee</strong>, <a href="http://governor.alabama.gov/cabinet/revenue/" target="_blank">commissioner Alabama&#8217;s Department of Revenue</a>.</p>
<p>Magee described her work on a new task force organized by the IRS aimed at finding solutions for reducing the tax refund fraud problem across the board. Magee is one of several folks working on a fraud and authentication working group within the IRS&#8217;s task force, which is trying to come to a consensus about ways to do a better job authenticating taxpayers and to <a href="http://krebsonsecurity.com/2015/03/intuit-failed-at-know-your-customer-basics/" target="_blank">improve security around online tax preparation services such as TurboTax</a>.</p>
<p>Earlier this year, TurboTax <a href="http://krebsonsecurity.com/2015/02/citing-tax-fraud-spike-turbotax-suspends-state-e-filings/" target="_blank">briefly suspended the online filing of state tax returns</a> after dozens of state revenue departments complained about a massive spike in fraudulent refund requests &#8212; many of which were tied back to hijacked or fraudulently-created TurboTax accounts.</p>
<p><em>One of those victimized in that scourge was <strong>Joe W. Garrett</strong>, &#8212; Magee&#8217;s deputy commissioner &#8212; who had a $7,700 fraudulent return filed in his name after thieves created a duplicate TurboTax account with his personal information.</em></p>
<p>Magee said her working group &#8212; one of three on the IRS&#8217;s task force &#8212; is populated by stakeholders with competing agendas.</p>
<p>&#8220;You have companies like <strong>Intuit</strong> that don&#8217;t want the government getting into the online tax preparation business, and then there are the bricks-and-mortar operations like <strong>Liberty</strong> and <strong>H&amp;R Block</strong> that don&#8217;t want to see their businesses cannibalized by the do-it-yourself online firms like TurboTax,&#8221; Magee said. &#8220;And then we have the banking industry, which is making a fortune off of this whole problem. <span class="pullquote pqleft">Right now, the only entities that are really losing out are states and the US Treasury.&#8221;</span> (For a look at which companies stand to profit from fraudulent refunds, see <a href="http://krebsonsecurity.com/2015/06/phony-tax-refunds-a-cash-cow-for-everyone/" target="_blank">this sidebar</a>).</p>
<p>In February, KrebsOnSecurity published <a href="http://krebsonsecurity.com/2015/02/turbotaxs-anti-fraud-efforts-under-scrutiny/" target="_blank">exclusive interviews with two former TurboTax security professionals</a> who accused TurboTax of making millions of dollars knowingly processing state and federal tax refunds filed by identity thieves. Magee said Intuit &#8212; the company that owns TurboTax &#8212; came to the first two working group meetings with a plan to provide states with an anti-fraud screening mechanism similar to <strong>Apple Pay</strong>&#8216;s <a href="http://www.theverge.com/2015/3/4/8149663/apple-pay-credit-card-fraud-banks" target="_blank">&#8220;green/yellow/red path&#8221; program</a>, which seeks to offer participating banks some idea of the relative likelihood that a given new customer is in fact a fraudster signing up in the name of an ID theft victim.</p>
<p>&#8220;The first two meetings, Intuit acted like they were leading the charge on this, and they were really amenable to everything,&#8221; Magee said. &#8220;They had come up with an idea that was very much like the red- yellow-green kind of thing, and they were asking us what data elements they should be looking at and sharing.&#8221; <a href="media/e10a0a09.greenyellowred.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/greenyellowred.png"><img class="alignleft wp-image-31128" src="media/e10a0a09.greenyellowred.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/greenyellowred.png" alt="greenyellowred" width="126" height="298" /></a></p>
<p>According to the Alabama tax commissioner, that&#8217;s when the <a href="http://americancoalitionfortaxpayerrights.org/" target="_blank">American Coalition for Taxpayer Rights</a> (ACTR), a trade group representing the tax preparation firms, stepped in. &#8220;The lobbyist group put the kibosh on that idea. They basically said it&#8217;s not their right to be the police – that it should be the IRS or the states &#8212; but that they would be more than willing to send us the indicators and that we could use our own system to do the scoring,&#8221; Magee said. &#8220;The states aren’t hung up on getting some red, yellow, green type system. I think we’re more interested in making sure data elements we can use to make a score are passed on to us.&#8221;</p>
<p>Magee said ACTR also protested that tax prep firms like Intuit couldn&#8217;t legally share certain information about their customers with the states and the IRS. Representatives with ACTR did not respond to requests for comment. Intuit declined to be interviewed for this story.</p>
<p>&#8220;They threw up a red flag and basically said, &#8216;We can’t you pass that information because it&#8217;s protected by IRS code sections regarding taxpayer confidentiality issues,'&#8221; Magee recalled. &#8220;Thankfully, the IRS brought in their attorneys and the commissioner a few weeks ago and they said, &#8216;That’s bunk, you can most certainly send that information to us and to the states. So we won that battle.&#8221;<span id="more-30911"></span> So how will Alabama and other states process returns differently next year?</p>
<p>&#8220;On a high level, what we’ve determined as of this week is that &#8212; unless the lobbyists derail our efforts – we’re going to ask for different authentication measures on a new customer, and different on returning customer, and then we’re going to ask for whole bunch of data elements that we’re not getting now that will allow us to filter the returns on receipt and will allow us to put the returns in various buckets of scores for possible fraud.&#8221;</p>
<p>For example, one telltale sign of a fraudulent return is one that takes the filer a very short time to fill out.</p>
<p>&#8220;If someone takes two minutes or less to fill out a tax return, that’s pretty much fraud 100 percent of the time, because they&#8217;re just cutting and pasting information from somewhere else,&#8221;  said Magee&#8217;s deputy Garrett. &#8220;So we said, okay, send us information about how long it takes them to fill out a return.&#8221;</p>
<p>Magee said there are a number of other data elements that the tax preparation firms could share about the way its customers file refund requests that would be helpful in separating legitimate returns from those filed by fraudsters.</p>
<p>&#8220;The states and the IRS are really trying to figure out what other data elements about customers is reasonable to ask of the software vendors in terms of helping us screen suspicious returns,&#8221; Magee said. &#8220;But end of the day, the best thing they can do for us is avoid account takeovers and to authenticate that it’s not a criminal setting up the account, that it’s a legitimate taxpayer.&#8221;</p>
<p>Garrett said the states believe they have some power to drive change because the states ultimately get to decide whether or not they accept a tax return filed through an electronic tax preparation firm.</p>
<p>&#8220;We get to choose whether or not we accept returns from vendor or not, but we have not exercised that choice in the past,&#8221; Garrett said. &#8220;What we’re going to do this is say let&#8217;s make sure that not only does the return have all the right data filled out in all the right fields, but let&#8217;s make sure you doing certain things on customer authentication as well.&#8221;</p>
<p>Magee said regardless of what happens with the IRS task force, her state will be requiring more from tax preparation firms in the coming months.</p>
<p>&#8220;Every summer we provide software vendors with file format that they must program into their systems, and usually the changes have to do with new laws or new tax structure,&#8221; Magee said. &#8220;But this year, that’s also going to include security measures. Ultimately, our goal is to deter people from using information on Alabama residents to file fraudulent tax returns. Then we could actually get back to the type of tax administration we’re used to, which is catching plain old tax cheats.&#8221;</p>
<p>One final note: The U.S. Senate Homeland Security and Governmental Affairs Committee is set to hold hearings today about the IRS transcript problem mentioned at the top of this piece. When I <a href="http://krebsonsecurity.com/2015/03/sign-up-at-irs-gov-before-crooks-do-it-for-you/" target="_blank">broke the news about this fraud back in March</a>, I did so by telling the nightmarish story of <strong>Michael Kasper</strong>, a taxpayer who reached out after discovering he&#8217;d been victimized by tax fraud and that someone had pulled his tax transcript after creating an account at the IRS&#8217;s site using his personal information. Kasper is set to testify before the committee today. (Update: Watch a recorded version of today&#8217;s hearing <a href="http://www.hsgac.senate.gov/hearings/the-irs-data-breach-steps-to-protect-americans-personal-information" target="_blank">here</a>).</p>
<p>There&#8217;s also been a minor update on Kasper&#8217;s tax fraud case. In my original report, I noted that Kasper had tracked down a local woman who&#8217;d willingly or unwittingly helped fraudsters funnel the money from Kasper&#8217;s fraudulent IRS refund to scammers in Nigeria. That individual, a woman named <strong>Isha Sesay</strong>, declined my requests for an interview at the time. But on May 29, the Williamsport, Pa. police department <a href="media/7ffa12bd.ishasesay.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/ishasesay.png" target="_blank">posted a notice on their Facebook page</a> about a standing warrant for her arrest: According to Kasper, she is also wanted for helping to funnel refund fraud money from an ID theft victim in South Dakota.</p>
<p>This is significant because these so-called &#8220;<a href="http://krebsonsecurity.com/?s=money+mules&amp;x=0&amp;y=0" target="_blank">money mules</a>&#8221; so seldom get prosecuted or held accountable for the very critical role that they play in these fraud schemes. <strong>UPDATE:</strong> <a href="https://www.facebook.com/permalink.php?story_fbid=714326165359644&amp;id=115866195205647" target="_blank">A notice</a> posted to the police department&#8217;s Facebook page states that Sesay has been arrested.</p>


feed_id: http://krebsonsecurity.com/?p=30916
title: Phony Tax Refunds: A Cash Cow for Everyone
uri: Phony-Tax-Refunds-A-Cash-Cow-for-Everyone
url: http://krebsonsecurity.com/2015/06/phony-tax-refunds-a-cash-cow-for-everyone/
content:
<p>When identity thieves filed a phony $7,700 tax refund request in the name of <strong>Joe Garrett</strong>, Alabama’s deputy tax commissioner, they didn’t get all of the money they requested. A portion of the cash went to more than a half dozen U.S. companies that each grab a slice of the fraudulent refund, including banks, payment processing firms, tax preparation companies and e-commerce giants.</p>
<p><a href="media/0d8de76c.treas7700.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/treas7700.png"><img class="aligncenter size-medium wp-image-31122" src="media/f3169103.treas7700-580x248.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/treas7700-580x248.png" alt="treas7700" width="580" height="248" /></a></p>
<p>When tax scammers file a fraudulent refund request, they usually take advantage of a process called a refund transfer. That allows the third party firm that helped prepare and process the return for filing (e.g. <strong>TurboTax</strong>) to get paid for their services by deducting the amount of their fee from the refund. Effectively, this lets identity thieves avoid paying a dime to TurboTax or other providers for processing the return.</p>
<p>In Garrett’s case, as with no doubt countless other fraudulent returns filed this year, the thieves requested that the return be deposited into a prepaid debit card account, which they could then use as a regular debit card to pay for goods and services, and/or use at ATMs to withdraw the ill-gotten gains in cash.</p>
<p>What’s more, the crooks asked the government to deposit $2,000 of the $7,700 they applied for in his name to an <strong>Amazon</strong> gift card ($2,000 is the maximum allowed under the Amazon gift card program). This is just another way for thieves to hedge their bets in case the debit card to which the majority of the stolen funds gets canceled.</p>
<p>“There are so many people making money off of electronic transfer of funds, it’s ridiculous,” said Julie Magee, Garrett’s boss and commissioner of Alabama’s Department of Revenue. “Five different financial institutions touched the fraudulent refund they filed in Joe’s name before it went to the thieves.”<span id="more-30916"></span></p>
<p>Garrett explained that his refund went from the U.S. Treasury to an account at <strong>Sunrise Banks</strong> of St. Paul, Minn. controlled by <strong>Santa Barbara Tax Products Group </strong>(TPG), which is a subsidiary of <strong>Greendot</strong> — the world’s largest prepaid card issuer (the other bank authorized to handle refund transfers is <strong>Citizens Banking Company</strong> of Sandusky, OH).</p>
<p><a href="media/f7bf1362.cashcow-e1433131582818.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/cashcow-e1433131582818.png"><img class="alignleft  wp-image-31160" src="media/97dc6b74.cashcow-e1433131582818-580x337.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/cashcow-e1433131582818-580x337.png" alt="cashcow" width="302" height="175" /></a>As TPG explains on its site, the company is integrated as the tax refund processing and settlement engine for 4 out of the 6 leading consumer online and in-person tax preparation companies. Additionally, TPG’s services are integrated into the offerings of the nation’s leading tax software companies, which, together, enable TPG to serve nearly 25,000 independent tax preparers and accountants nationwide. In the most recent tax season, TPG processed approximately $32 billion in tax refunds on behalf of approximately 11 million U.S. tax filers.</p>
<p>When the money was deposited into the Sunrise account, TPG extracted three fees: $35 for handling the federal refund, $10 for state refunds and $10 fee for TurboTax (since thieves had used TurboTax to fraudulently file his request.</p>
<p>Another $2,000 from the refund was diverted to an Amazon gift card. For thieves, diverting some of the funds to Amazon hedges their bets in case somehow the prepaid card that receives the bulk of the funds gets canceled by authorities cracking down on tax return fraud. These gift cards also are easily resold for cash.</p>
<p>“For Amazon, it guarantees a flow of future purchases in the Amazon system, and potentially generates more profit as consumers often forget to use all the value on their gift cards,” Garrett said.</p>
<p>The prepaid debit card which thieves used to receive most of the phony refund filed in Garrett’s name is operated by Rush Card and <strong>JPM Chase Bank</strong>. Rush Card charges a one-time card fee of between $3.95 &#8211; $9.95, and on a monthly fee ranging from $5.95 &#8211; $7.95. Each time the thieves went to an ATM to pull out cash from the card, Rush Card charged an additional $1 fee.</p>
<p>So, tax refund fraud is clearly lucrative for a great many companies. But how long before Congress or states turn this cash cow out to pasture? Joe Garrett&#8217;s boss &#8212; Alabama&#8217;s Revenue Department Commissioner <strong>Julie Magee</strong> &#8212; said she&#8217;s not holding her breath.</p>
<p>“This is a bit like regulatory whack a mole, and very difficult to track down who’s getting what,” she said. “This has been driver of why it’s so lucrative; Because it shifts so easy for thieves to get the money off the card as soon as it hits the account.”</p>
<p>This story was published as a complement to another piece on tax fraud, available <a href="http://krebsonsecurity.com/2015/06/states-seek-better-mousetrap-to-stop-tax-refund-fraud/" target="_blank">here</a>. Stay tuned later this week for an interview with another state tax official on ways to crack down on tax refund fraud.</p>


feed_id: http://krebsonsecurity.com/?p=31191
title: How I Learned to Stop Worrying and Embrace the Security Freeze
uri: How-I-Learned-to-Stop-Worrying-and-Embrace-the-Security-Freeze
url: http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/
content:
<p class="p1"><span class="s1">If you’ve been paying attention in recent years, you might have noticed that just about everyone is losing your personal data. Even if you haven’t noticed (or maybe you just haven’t actually received a breach notice), I’m here to tell you that if you’re an American, your basic personal data is already for sale. What follows is a primer on what you can do to avoid becoming a victim of identity theft as a result of all this data (s)pillage. </span></p>
<div id="attachment_25386" style="width: 295px" class="wp-caption alignright"><a  href="http://krebsonsecurity.com/2014/03/are-credit-monitoring-services-worth-it/"><img class="size-medium wp-image-25386" src="media/7dee3b03.shreddedID-copy-285x189.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/03/shreddedID-copy-285x189.png" alt="Click here for a primer on identity theft protection services." width="285" height="189" /></a><p class="wp-caption-text">Click here for a primer on identity theft protection services.</p></div>
<p class="p1"><span class="s1">A seemingly never-ending stream of breaches at banks, healthcare providers, insurance companies and data brokers has created a robust market for thieves who sell identity data. Even without the help of mega breaches like the 80 million identities leaked in <a href="http://krebsonsecurity.com/2015/02/china-to-blame-in-anthem-hack/" target="_blank">the Anthem compromise</a> or last week&#8217;s news about <a href="https://www.bostonglobe.com/news/nation/2015/06/05/chinese-hacking-data-may-extend-insurance-companies/oWFOZYdXLY8uBpmd7fUwDL/story.html" target="_blank">4 million records from the U.S. Office of Personnel Management</a> gone missing, crooks <a href="http://krebsonsecurity.com/2014/12/toward-a-breach-canary-for-data-brokers/" target="_blank">already have access to the information needed</a> to open new lines of credit or file phony tax refund requests in your name.</span></p>
<p class="p1"><span class="s1">If your response to this breachapalooza is to do what each of the breached organizations suggest — to take them up on one or two years’ worth of free credit monitoring services — you might sleep better at night but you will probably not be any more protected against crooks stealing your identity. As I discussed at length <a href="http://krebsonsecurity.com/2014/03/are-credit-monitoring-services-worth-it/" target="_blank">in this primer</a>, credit monitoring services aren’t really built to prevent ID theft. The most you can hope for from a credit monitoring service is that they give you a heads up when ID theft does happen, and then help you through the often labyrinthine process of getting the credit bureaus and/or creditors to remove the fraudulent activity and to fix your credit score. </span></p>
<p class="p1"><span class="s1">In short, if you have already been victimized by identity theft (fraud involving existing credit or debit cards is <i>not</i> identity theft), it might be worth paying for these credit monitoring and repair services (although more than likely, you are already eligible for free coverage thanks to a recent breach at any one of dozens of companies that have lost your information over the past year). <em>Otherwise, I’d strongly advise you to consider freezing your credit file at the major credit bureaus. </em></span></p>
<p class="p1"><span class="s1">There is shockingly little public knowledge or education about the benefits of a security freeze, also known as a &#8220;credit freeze.&#8221; I routinely do public speaking engagements in front of bankers and other experts in the financial industry, and I’m amazed at how often I hear from people in this community who are puzzled to learn that there is even such a thing as a security freeze (to be fair, most of these people are in the business of opening new lines of credit, not blocking such activity). </span></p>
<p class="p1"><span class="s1">Also, there is a great deal of misinformation and/or bad information about security freezes available online. As such, I thought it best to approach this subject in the form of a Q&amp;A, which is the most direct method I know how to impart knowledge about a subject in way that is easy for readers to digest.</span></p>
<p class="p1"><span class="s1"><b>Q: What is a security freeze?</b></span></p>
<p class="p1"><span class="s1"><b>A:</b> A security freeze essentially blocks any potential creditors from being able to view or “pull” your credit file, unless you affirmatively unfreeze or thaw your file beforehand. With a freeze in place on your credit file, ID thieves can apply for credit in your name all they want, but they will not succeed in getting new lines of credit in your name because few if any creditors will extend that credit without first being able to gauge how risky it is to loan to you (i.e., view your credit file). And because each credit inquiry caused by a creditor has the potential to lower your credit score, the freeze also helps protect your score, which is what most lenders use to decide whether to grant you credit when you truly do want it and apply for it. </span></p>
<p class="p1"><span class="s1"><b>Q: What’s involved in freezing my credit file? </b></span></p>
<p class="p1"><span class="s1"><b>A:</b> Freezing your credit involves notifying each of the major credit bureaus that you wish to place a freeze on your credit file. This can usually be done online, but in a few cases you may need to contact one or more credit bureaus by phone or in writing. Once you complete the application process, each bureau will provide a unique personal identification number (PIN) that you can use to unfreeze or “thaw” your credit file in the event that you need to apply for new lines of credit sometime in the future. Depending on your state of residence and your circumstances, you may also have to pay a small fee to place a freeze at each bureau. There are four consumer credit bureaus, including <a href="https://help.equifax.com/app/answers/detail/a_id/75/search/1" target="_blank">Equifax</a>, <a href="https://www.experian.com/freeze/center.html" target="_blank">Experian</a>, <a href="https://www.innovis.com/personal/securityFreeze" target="_blank">Innovis</a> and <a href="http://www.transunion.com/securityfreeze" target="_blank">Trans Union</a>. </span></p>
<p class="p1"><span class="s1"><b>Q: How much is the fee, and how can I know whether I have to pay it? </b></span></p>
<p class="p1"><span class="s1"><b>A: </b>The fee ranges from $0 to $15 per bureau, meaning that it can cost upwards of $60 to place a freeze at all four credit bureaus (recommended). However, in most states, consumers can freeze their credit file for free at each of the major credit bureaus if they also supply a copy of a police report and in some cases an affidavit stating that the filer believes he/she is or is likely to be the victim of identity theft. In many states, that police report can be filed and obtained online. The fee covers a freeze as long as the consumer keeps it in place. Equifax has <a href="https://help.equifax.com/app/answers/detail/a_id/75/~/security-freeze-fees-and-requirements" target="_blank">a decent breakdown</a> of the state laws and freeze fees/requirements.</span><span id="more-31191"></span></p>
<p class="p1"><span class="s1"><b>Q: What’s involved in unfreezing my file? </b></span></p>
<p class="p1"><span class="s1"><b>A:</b> The easiest way to unfreeze your file for the purposes of gaining new credit is to spend a few minutes on the phone with the company from which you hope to gain the line of credit (or perhaps research the matter online) to see which credit bureau they rely upon for credit checks. It will most likely be one of the major bureaus. Once you know which bureau the creditor uses, contact that bureau either via phone or online and supply the PIN they gave you when you froze your credit file with them. The thawing process should not take more than 24 hours.</span></p>
<p class="p1"><span class="s1"><b>Q: I’ve heard about something called a fraud alert. What’s the difference between a security freeze and a fraud alert on my credit file?</b></span></p>
<p class="p1"><span class="s1"><b>A:</b> With a fraud alert on your credit file, lenders or service providers should not grant credit in your name without first contacting you to obtain your approval — by phone or whatever other method you specify when you apply for the fraud alert. To place a fraud alert, merely contact one of the credit bureaus via phone or online, fill out a short form, and answer a handful of multiple-choice, out-of-wallet questions about your credit history. Assuming the application goes through, the bureau you filed the alert with must by law share that alert with the other bureaus.</span></p>
<p class="p1"><span class="s1">Consumers also can get an <b>extended fraud alert</b>, which remains on your credit report for seven years. Like the free freeze, an extended fraud alert requires a police report or other official record showing that you&#8217;ve been the victim of identity theft. </span></p>
<p class="p1"><span class="s1">An <b>active duty alert</b> is another alert available if you are on active military duty. The active duty alert is similar to an initial fraud alert except that it lasts 12 months and your name is removed from pre-approved firm offers of credit or insurance (prescreening) for 2 years.</span></p>
<p class="p1"><span class="s1"><b>Q: Why would I pay for a security freeze when a fraud alert is free?</b></span></p>
<p class="p1"><span class="s1"><b>A:</b> Fraud alerts only last for 90 days, although you can renew them as often as you like. More importantly, <em>while lenders and service providers are supposed to seek and obtain your approval before granting credit in your name if you have a fraud alert on your file,</em> <i>they’re not legally required to do this.</i></span></p>
<p class="p1"><span class="s1"><b>Q: Hang on: If I thaw my credit file after freezing it so that I can apply for new lines of credit, won’t I have to pay to refreeze my file at the credit bureau where I thawed it? </b></span></p>
<p class="p1"><span class="s1"><b>A:</b> Yes (unless you’ve previously qualified for a free freeze). However, even if you have to do this once or twice a year, the cost of doing so is almost certainly less than paying for a year’s worth of credit monitoring services.</span></p>
<p class="p1"><span class="s1"><b>Q: Is there anything I should do in addition to placing a freeze that would help me get the upper hand on ID thieves? </b></span></p>
<p class="p1"><span class="s1"><b>A:</b> Yes: Periodically order a free copy of your credit report. By law, each of the three major credit reporting bureaus must provide a free copy of your credit report each year — via a government-mandated site: <a href="http://annualcreditreport.com"><span class="s2">annualcreditreport.com</span></a>. The best way to take advantage of this right is to make a notation in your calendar to request a copy of your report every 120 days, to review the report and to report any inaccuracies or questionable entries when and if you spot them.</span></p>
<p class="p1"><span class="s1"><b>Q: I’ve heard that tax refund fraud is a big deal now. Would having a fraud alert or security freeze prevent thieves from filing phony tax refund requests in my name with the states and with the Internal Revenue Service?</b></span></p>
<p class="p1"><span class="s1"><b>A:</b> Neither would stop thieves from fraudulently requesting a refund in your name. However, a freeze on your credit file would have prevented thieves from <a href="http://krebsonsecurity.com/2015/05/irs-crooks-stole-data-on-100k-taxpayers-via-get-transcript-feature/" target="_blank">using the IRS’s own Web site to request a copy of your previous year’s tax transcript</a> — a problem the IRS said led to tax fraud on 100,000 Americans this year and that prompted the agency to suspend online access to the information. For more information on what you can do to minimize your exposure to tax refund fraud, see <a href="http://krebsonsecurity.com/what-tax-fraud-victims-can-do/" target="_blank">this primer</a>.</span></p>
<p class="p1"><span class="s1"><b>Q: Okay, I’ve got a security freeze on my file, what else should I do? </b></span></p>
<p class="p1"><span class="s1"><b>A:</b> It’s also a good idea to notify a company called <strong>ChexSystems</strong> to keep an eye out for fraud committed in your name. Thousands of banks rely on ChexSystems to verify customers that are requesting new checking and savings accounts, and ChexSystems lets consumers place a security alert on their credit data to make it more difficult for ID thieves to fraudulently obtain checking and savings accounts. For more information on doing that with ChexSystems, see <a href="https://www.consumerdebit.com/consumerinfo/us/en/chexsystems/theftaffidavit/index.htm" target="_blank">this link</a>. </span></p>
<p class="p1"><strong>Q: If I freeze my file, won&#8217;t I have trouble getting new credit going forward? </strong></p>
<p class="p1"><strong>A: </strong>If you&#8217;re in the habit of applying for a new credit card each time you see a 10 percent discount for shopping in a department store, a security freeze may cure you of that impulse. Other than that, as long as you already have existing lines of credit (credit cards, loans, etc) the credit bureaus should be able to continue to monitor and evaluate your creditworthiness should you decide at some point to take out a new loan or apply for a new line of credit.</p>
<p class="p1"><span class="s1"><b>Q: Anything else? </b></span></p>
<p class="p1"><span class="s1"><b>A: </b>ID thieves like to intercept offers of new credit and insurance sent via postal mail, so it’s a good idea to opt out of pre-approved credit offers. If you decide that you don&#8217;t want to receive prescreened offers of credit and insurance, you have two choices: You can opt out of receiving them for five years or opt out of receiving them permanently.</span></p>
<p class="p1"><span class="s1">To opt out for five years: Call toll-free 1-888-5-OPT-OUT (1-888-567-8688) or visit www.optoutprescreen.com. The phone number and website are operated by the major consumer reporting companies.</span></p>
<p class="p1"><span class="s1">To opt out permanently: You can begin the permanent Opt-Out process online at <a href="http://www.optoutprescreen.com/" target="_blank">www.optoutprescreen.com</a>. To complete your request, you must return the signed Permanent Opt-Out Election form, which will be provided after you initiate your online request. </span></p>
<p class="p1"><span style="text-decoration: underline;">PERSONAL EXPERIENCE</span></p>
<p class="p1">A couple of years back, I was signed up for a credit monitoring service and had several unauthorized applications for credit filed in my name in rapid succession. Over a period of weeks, I fielded numerous calls from the credit monitoring firm, and spent many grueling hours on the phone with the firm&#8217;s technicians and with the banks that had been tricked into granting the credit &#8212; all in a bid to convince the latter that I had not in fact asked them for a new credit line.</p>
<p class="p1">The banks in question insisted that I verify my identity by giving them all of my personal information that they didn&#8217;t already have, and I was indignant that they should have been that careful before opening the new fraudulent accounts. Needless to say, the experience was extremely frustrating and massively time-consuming.</p>
<p class="p1">We eventually got that straightened out, but it took weeks. Not long after that episode, I decided to freeze my credit and that of my wife&#8217;s at all of the major bureaus. Turns out, I did that none too soon: A few weeks later, I <a href="http://krebsonsecurity.com/2014/03/sally-beauty-hit-by-credit-card-breach/" target="_blank">broke a story about a credit card breach at nationwide beauty chain Sally Beauty</a>, detailing how the cards stolen from Sally Beauty customers had wound up for sale on <a href="http://krebsonsecurity.com/?s=rescator&amp;x=0&amp;y=0" target="_blank">Rescator[dot]cc</a>, the same fraud shop that had been principally responsible for selling cards stolen in the wake of the massive data breaches at <a href="http://krebsonsecurity.com/?s=home+depot+breach&amp;x=0&amp;y=0" target="_blank">Home Depot</a> and <a href="http://krebsonsecurity.com/?s=target+breach&amp;x=0&amp;y=0" target="_blank">Target</a>.</p>
<div id="attachment_31202" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/b8990a9e.resc-thanks.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/resc-thanks.png"><img class="size-medium wp-image-31202" src="media/04633bae.resc-thanks-580x327.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/resc-thanks-580x327.png" alt="Rescator's message to his customers urging them to steal my identity." width="580" height="327" /></a><p class="wp-caption-text">Rescator&#8217;s message to his customers urging them to steal my identity.</p></div>
<p class="p1">In response to my reporting about him and his site, Rescator changed his site&#8217;s home page to a photoshopped picture of my driver&#8217;s license, and linked his customers (mostly identity thieves and credit card hustlers) to a full copy of my credit report along with links to dozens of sites where one can apply for instant credit. Rescator also encouraged his friends and customers to apply for new credit in my name.</p>
<p class="p1">Over the next few weeks, I received multiple rejection letters from various financial firms, stating that although they had hoped to be able to grant my application for new credit, they were unable to do so because they could not view my credit file. The freeze had done its job.</p>
<p class="p1">In summary, credit monitoring services are helpful in digging you out of an identity theft ditch. But if you want true piece of mind, freeze your credit file.</p>


feed_id: http://krebsonsecurity.com/?p=31125
title: Firms Could Be Forced to Disgorge Profits from Tax Refund Fraud
uri: Firms-Could-Be-Forced-to-Disgorge-Profits-from-Tax-Refund-Fraud
url: http://krebsonsecurity.com/2015/06/firms-could-be-forced-to-disgorge-profits-from-tax-refund-fraud/
content:
<p>Last week, KrebsOnSecurity ran <a href="http://krebsonsecurity.com/2015/06/states-seek-better-mousetrap-to-stop-tax-refund-fraud/" target="_blank">an interview</a> with <strong>Julie Magee</strong>, Alabama’s chief tax administrator, to examine what the states are doing in tandem with the IRS and others to make it harder for ID thieves to commit tax refund fraud — a $6 billion a year problem. Today we’ll hear from <strong>John Valentine</strong>, chair of <a href="http://tax.utah.gov/commission-office/commissioners" target="_blank">Utah’s State Tax Commission</a>, about the challenges his state faced this year, as well as the prospect that tax preparation firms could be forced return to the U.S. Treasury any profits they make from processing fraudulent tax refunds.</p>
<p><a href="media/7f282dfb.taxfraud.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud.jpg"><img class="alignright size-medium wp-image-25751" src="media/964c2000.taxfraud-285x285.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-285x285.jpg" alt="The Growing Tax Fraud Menace" width="285" height="285" /></a>Valentine was a tax attorney before being appointed the chair of Utah’s tax commission, so he’s familiar with the challenges facing both the tax preparation industry as well as the tax agencies.</p>
<p>“I came out of the private sector and spent nearly 40 years suing the state tax commission and the IRS,” Valentine said. “Now I am that.”</p>
<p>Utah is actively engaged in an IRS task force made up of state, federal and industry tax experts trying to quash refund fraud. Like Alabama’s deputy tax commissioner <strong>Joe Garrett</strong> — who <a href="http://krebsonsecurity.com/2015/06/phony-tax-refunds-a-cash-cow-for-everyone/" target="_blank">had a $7,700 fraudulent refund filed in his name</a> — several of Utah’s senior tax administration officials also were victimized by ID thieves this year.</p>
<p>“We’ve had some of our senior people who had tax returns filed on their behalf,” Valentine said. “Of course, they had not filed them yet and we knew that they were more than a little suspicious.”</p>
<p>Among the steps the task force is considering is whether to mail all taxpayers an Identity Protection Personal Identification Number (IP PIN) that is tied to each taxpayer and must be included in each tax return. The IRS issues the IP PINs to taxpayers who have suffered tax return fraud. Additionally, consumers willing to swear they have been victims of identity theft can apply for a filing PIN, however <a href="http://blogs.wsj.com/totalreturn/2015/02/12/irs-offers-extra-fraud-protection-but-only-to-a-few/" target="_blank">the IRS is picky about granting those requests</a>.</p>
<p>Even if the IRS were to switch to issuing IP PINs to all taxpayers, the agency would still run up against the thorny problem of how to verify consumers’ identity (no doubt, that challenge would be exacerbated by millions of taxpayers phoning the IRS after losing or misplacing their assigned PINs). A major focus of the working groups attention is finding better ways to authenticate people beyond merely requesting static identifiers (Social Security numbers, dates of birth) and other data that is frequently exposed in data breaches and is readily for sale on underground markets.</p>
<p>“They’re going to have to switch to a 2-factor authentication system, where they really strengthen the front-end of that authentication,” Valentine said of the tax preparation firms like <strong>TurboTax</strong>, which briefly <a href="http://krebsonsecurity.com/2015/02/citing-tax-fraud-spike-turbotax-suspends-state-e-filings/" target="_blank">shut down all state tax filing this year</a> after a massive spike in phony refund requests put through its systems via hijacked and fraudulently created TurboTax accounts.</p>
<p>Valentine also made the decision to halt all Utah tax refunds around that same time.</p>
<p>“When we installed our [anti-fraud] analytics program, we thought we were getting a lot of false positives, so we did a bunch of back checking,” he said “While we were doing that, I made a decision to stop all refunds. For a period of two weeks Utah gave no refunds while we worked through the analytics to make sure we’d identified the nature and extent of the fraud. It turned out to be much more extensive than we’ve ever seen.”</p>
<p>In fact, ten times as much as any year prior, according to Valentine.</p>
<p>“We’ve always seen fraud where a tax practitioner will file a whole bunch of fraudulent returns, or we’ll see ID theft targeting a large employer. But this fraud wave was a little tougher, because it went across spectrum of employers, across the entire demographic of taxpayers, high low and middle income. Also, the fraud wasn’t regionalized &#8212; it was across the whole state &#8212; and [the fraudsters] didn’t seem to be selective as to who they hit. They got people of notoriety and people nobody knew. In the end, it appeared that the common factor among all of them was how you filed in 2013,” because the phony 2014 returns all included nearly identical information as the victim’s 2013 returns.</p>
<p>“What we saw in Utah was a population of the same information in the 2013 return into the 2014 return, with the exception of bank routing and bank account number,” Valentine said. “That’s a different fraud that we’d just never seen before.”</p>
<p>TurboTax&#8217;s <a href="http://krebsonsecurity.com/2015/03/intuit-failed-at-know-your-customer-basics/" target="_blank">lax security around authentication</a> for new and existing accounts played <a href="http://krebsonsecurity.com/2015/02/turbotaxs-anti-fraud-efforts-under-scrutiny/" target="_blank">a well-documented role</a> in the type of fraud described by Valentine this year. But ID thieves also got help directly from the IRS this year. Late last month, the agency suspended the &#8220;get transcript&#8221; function that previously allowed taxpayers to order a copy of their previous year&#8217;s W2 information, among other data; turns out, crooks had <a href="http://krebsonsecurity.com/2015/05/irs-crooks-stole-data-on-100k-taxpayers-via-get-transcript-feature/" target="_blank">used the service to pull tax data on more than 100,000 citizens</a>, stealing tens of millions from the U.S. Treasury in the process.<span id="more-31125"></span></p>
<p><span style="text-decoration: underline;">PREPAID MADNESS</span></p>
<p>In March, Valentine testified on Capitol Hill on the tax fraud issue, and he urged lawmakers to change the way prepaid cards are numbered so that banks and tax administrators can more easily block or filter refunds destined for prepaid debit cards — the money laundering vehicle of choice for virtually all fraudulent refund requests.</p>
<p>Prepaids are notoriously easy for crooks to use for tax fraud because the process for opening a new prepaid and using it to receive funds can be done anonymously, unlike opening a new checking account at a local bank branch. When the refunds get deposited to prepaids, crooks can then very easily and anonymously use them as cash or to withdraw money at ATMs.</p>
<p>“The process for opening a prepaid debit card appears to be very easy,” Valentine said. “The normal ‘know your customer’ rules [that banks typically are required to follow] appear to be glossed over with this industry.”</p>
<p>Specifically, Valentine proposed modifying the routing number on prepaid cards so that the cards would be more easily distinguishable from debit cards attached to actual checking and savings accounts. Valentine said his suggestion was followed by many head nods by lawmakers in the committee hearing, but so far there doesn’t appear to have been any movement to change the status quo.</p>
<p>And that inertia seems to suit the prepaid card industry just fine. <strong>Brad Fauss</strong>, interim executive director and general counsel of the <strong>Network Branded Prepaid Card Association</strong>, said<br />
the NBPCA believes that the key to solving identity theft tax refund fraud is to attack the problem at its source – where the identification credentials are compromised &#8211; rather than focusing on the method of disbursement after the fraud has occurred.</p>
<p>“Separately tracking routing and transit numbers, or RTNs, for prepaid accounts is impractical because financial institutions often use the same RTN’s for multiple banking products, such as checking accounts and prepaid cards, and fundamentally falls short since it will not stop fraud but will only prompt fraudsters to utilize alternative disbursement vehicles,” Fauss said.</p>
<p>Nevertheless, tax return fraud could become a dicey legal and financial quagmire for banks, tax preparation firms and prepaid card providers, each of which charge hefty fees for processing such transactions (see <a href="http://krebsonsecurity.com/2015/06/phony-tax-refunds-a-cash-cow-for-everyone/" target="_blank">this story</a> for a breakdown of how these companies are profiting from refund fraud).</p>
<p>Asked whether he was aware of anyone urging or requiring financial and tax providers to disgorge profits from tax refunds they process that turn out to be fraudulent, the formerly litigious tax attorney said these firms should be very concerned about that risk.</p>
<p>“I’m not aware of anyone calling for that, no, but under general principles of law, that’s one that would be a normal recourse,” he said. “Coming from the private sector, that would be the type of thing you would normally expect to see someone asserting. If I were general counsel for these third-party vendors, I would be saying, ‘Man, we run exposure here for disgorgement of fees that were from fraudulent returns, so we’ve got to clean this up right away.’”</p>


feed_id: http://krebsonsecurity.com/?p=31222
title: Adobe, Microsoft Issue Critical Security Fixes
uri: 2015-06-10-Adobe-Microsoft-Issue-Critical-Security-Fixes
url: http://krebsonsecurity.com/2015/06/adobe-microsoft-issue-critical-security-fixes-4/
content:
<p><strong>Adobe</strong> today released software updates to plug at least 13 security holes in its <strong>Flash Player</strong> software. Separately, <strong>Microsoft</strong> pushed out fixes for at least three dozen flaws in <strong>Windows</strong> and associated software.</p>
<p><a href="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png"><img class="alignright  wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="209" height="219" /></a>The bulk of the flaws Microsoft addressed today (23 of them) reside in the Internet Explorer Web browser. Microsoft also issued fixes for serious problems in <strong>Office</strong>, the Windows OS itself and <strong>Windows Media Player</strong>, among other components. A link to an index of the individual Microsoft updates released today is <a href="https://technet.microsoft.com/en-us/library/security/ms15-jun.aspx" target="_blank">here</a>.</p>
<p>As it normally does on Patch Tuesday, Adobe issued fixes for its Flash and AIR software, plugging a slew of dangerous flaws in both products. Flash continues to be one of the more complex programs to manage and update on a computer, mainly because its auto-update function tends to lag the actual patches by several days at least (your mileage may vary), and it&#8217;s difficult to know which version is the latest.<span id="more-31222"></span></p>
<p>If you’re unsure whether your browser has Flash installed or what version it may be running, browse to <a title="https://www.adobe.com/software/flash/about/" href="https://www.adobe.com/software/flash/about/" target="_blank">this link</a>. Users of the <span class="il">Adobe</span> Flash Player Desktop Runtime for Windows and Macintosh should update to <em><span class="il">Adobe</span> Flash Player 18.0.0.160</em>. Adobe Flash Player installed with <strong>Google Chrome</strong>, as well as <strong>Internet Explorer</strong> on<strong>Windows 8.x</strong>, should automatically update to <em>version 18.0.0.160</em>, although Chrome users on Mac systems will find <em>18.0.0.161</em> is actually the latest version, according to Adobe. To force the installation of an available update, click the triple bar icon to the right of the address bar, select “About Google” Chrome, click the apply update button and restart the browser.</p>
<p><a href="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png"><img class="alignleft  wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="190" height="162" /></a></p>
<p>The most recent versions of Flash should be available from the <a title="http://get.adobe.com/flashplayer/" href="http://get.adobe.com/flashplayer/" target="_blank">Flash home page</a>, but beware potentially unwanted add-ons, like <strong>McAfee Security Scan</strong>. To avoid this, uncheck the pre-checked box before downloading, or grab your OS-specific Flash download from <a title="https://www.adobe.com/products/flashplayer/distribution3.html" href="https://www.adobe.com/products/flashplayer/distribution3.html" target="_blank">here</a>. Windows users who browse the Web with anything other than Internet Explorer may need to apply this patch twice, once with IE and again using the alternative browser (<strong>Firefox</strong>, <strong>Opera</strong>, e.g.). See <a href="media/0d1ff664.adobeflashjune2015.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/adobeflashjune2015.png" target="_blank">this graphic</a> for the full Adobe version release.</p>
<p>Most applications bundled with Adobe AIR should check for updates on startup. If prompted, please download and install the AIR update. If you need to update manually, grab the latest version <a href="https://get.adobe.com/air/" target="_blank">here</a>.</p>
<p>As usual, please sound off in the comments section if you experience any issues applying any of these patches.</p>


feed_id: http://krebsonsecurity.com/?p=31218
title: Breach at Winery Card Processor Missing Link
uri: Breach-at-Winery-Card-Processor-Missing-Link
url: http://krebsonsecurity.com/2015/06/breach-at-winery-card-processor-missing-link/
content:
<p><strong>Missing Link Networks Inc.</strong>, a credit card processor and point-of-sale vendor that serves a number of wineries in Northern California and elsewhere, disclosed today that a breach of its networks exposed card data for transactions it processed in the month of April 2015.</p>
<p><a href="media/1b85386f.ecellar.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/ecellar.png"><img class="alignright  wp-image-31229" src="media/36ec1285.ecellar-580x436.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/ecellar-580x436.png" alt="ecellar" width="297" height="223" /></a>Earlier this week, I heard from a source at one of Sonoma, Calif.&#8217;s fancier wineries that their card processor had been breached. On Tuesday, I reached out to Calistoga, Calif. based Missing Link. Today, the company responded that it had begun notifying its customers about the incident, and that it was working with law enforcement and the card associations on an investigation.</p>
<p>&#8220;Beginning on May 27, 2015, we began notifying our winery customers that <strong>eCellar Systems</strong>, our consumer-direct sales platform, had been breached during the month of April, 2015 by an unknown intruder,&#8221; the company&#8217;s founder and CEO, <strong>Paul Thienes</strong>, said in a written statement. &#8220;To that end, each of our winery clients will be sending out notice of this event to their customers and it is likely that individual consumers may receive a similar notice from multiple wineries.&#8221;</p>
<p>&#8220;The intruder gained access to customer names, credit/debit card numbers, the related billing addresses, and any dates of birth in our system during the window of April 1st through 30th this year,&#8221; Thienes wrote. &#8220;The intruder did not have access to any driver license numbers, Social Security numbers, CVV verification numbers, or PIN numbers (data which we would typically not collect anyway). We have identified and secured the method that was used to breach our platform. Additionally, to prevent a future reoccurrence, we are in the process of converting to a &#8216;token&#8217; system so that credit card numbers will no longer be stored by the eCellar platform.&#8221;<span id="more-31218"></span></p>
<p>Tokenization as a card security solution tends to be most attractive to businesses that must keep customer card numbers on file until the transaction is finalized, such as hotels, bars and rental car services. A January 2015 report by <strong>Gartner Inc.</strong> fraud analyst <strong>Avivah Litan </strong>found that at least 50 percent of <a title="http://usa.visa.com/merchants/protect-your-business/cisp/merchant-pci-dss-compliance.jsp" href="http://usa.visa.com/merchants/protect-your-business/cisp/merchant-pci-dss-compliance.jsp" target="_blank">Level 1 through Level 3</a> U.S. merchants have already adopted or will adopt tokenization in the next year.</p>
<p>Merchants retain tokens because they need to hang on to a single unique identifier of the customer for things like recurring billing, loyalty programs, and chargebacks and disputes. But experts say tokenization itself does not solve the problem that has fueled most retail card breaches in recent years: Malware remotely installed on point-of-sale devices that steals customer card data before it can be tokenized.</p>
<p>An alternative and far more secure approach to handling card data involves <a title="https://www.pcisecuritystandards.org/documents/P2PE_Hardware_Solution_%20Requirements_Initial_Release.pdf" href="media/b18d085b.P2PE_Hardware_Solution_20Requirements_Initial_Release.pdf" data-original-source="https://www.pcisecuritystandards.org/documents/P2PE_Hardware_Solution_%20Requirements_Initial_Release.pdf" target="_blank">point-to-point encryption</a> — essentially installing card readers and other technology that ensures customer card data is never transmitted in plain text anywhere in the retail environment. But many businesses have chosen tokenization in favor of encryption because it is cheaper and less complicated to implement in the short run. Merchants that adopt point-to-point encryption may also find themselves locked into a single credit card processor, because the encryption technology built into the newer readers often only works with a specific processor.</p>
<p>Chip card technology also will help. Merchants in the United States are gradually shifting to installing card readers that can accommodate <a title="http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signature/" href="http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signature/" target="_blank">more secure chip cards</a> that adhere to the Europay, MasterCard and Visa or EMV standard. These chip cards are designed to be far more expensive and difficult for thieves to counterfeit than regular credit cards that most U.S. consumers have in their wallets. Non-chip cards store cardholder data on a magnetic stripe, which can be trivially copied by point-of-sale malware.</p>
<p>Missing Link Networks offers a variety of products and services through its <a href="http://www.ecellar1.com/ecellar.php" target="_blank">eCellar line</a>, including point-of-sale technology and database solutions. The company joins a long list of other POS vendors that have disclosed breaches in recent months, including <a href="http://krebsonsecurity.com/2015/03/point-of-sale-vendor-nextep-probes-breach/" target="_blank">NEXTEP</a>, <a href="http://krebsonsecurity.com/2015/05/harbortouch-is-latest-pos-vendor-breach/" target="_blank">HarborTouch</a> and <a href="http://krebsonsecurity.com/2014/09/signature-systems-breach-expands/" target="_blank">Signature Systems</a>.</p>


feed_id: http://krebsonsecurity.com/?p=31220
title: Discount Chain Fred’s Inc. Probes Card Breach
uri: Discount-Chain-Fred-s-Inc-Probes-Card-Breach
url: http://krebsonsecurity.com/2015/06/discount-chain-freds-inc-probes-card-breach/
content:
<p><strong>Fred&#8217;s Inc.</strong>, a discount general merchandise and pharmacy chain that operates 650 stores in more than a dozen states, disclosed today that it is investigating a potential credit card breach.</p>
<p><a href="media/536f5370.freds.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/freds.png"><img class="alignright  wp-image-31239" src="media/536f5370.freds.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/freds.png" alt="freds" width="268" height="168" /></a>KrebsOnSecurity contacted Fred&#8217;s earlier this week, after hearing from multiple financial institutions about a pattern of fraud on customer cards indicating that Fred&#8217;s was the latest victim of card-stealing malware secretly installed on point-of-sale systems at checkout lanes.</p>
<p>Sources said it was unclear how many Fred&#8217;s locations were affected, but that the pattern of fraudulent charges traced back to Fred&#8217;s stores across <a href="https://www.fredsinc.com/corporate/about-us/" target="_blank">the company&#8217;s footprint</a> in the midwest and south, including Alabama, Arkansas, Georgia, Indiana, Kentucky, Louisiana, Mississippi, Tennessee and Texas.</p>
<p>Reached for comment about the allegations, the company issued the following response today:</p>
<blockquote><p>Fred’s Inc. recently became aware of a potential data security incident and immediately launched an internal investigation to determine the scope of the issue. We retained Mandiant, a leading independent forensics firm, to examine our data security systems.</p>
<p>We want to assure our customers that protecting their information is one of our top priorities and we are taking this potential incident very seriously. Until this investigation is completed, it will be difficult to determine with certainty the scope or nature of any potential incident, but we will continue to work vigilantly to address any potential issues that may affect our customers.</p></blockquote>
<p>I am hearing about so many different retail breaches at retail and restaurant chains right now that I could do nothing but write about them full time and still fall behind.</p>
<p>A quick note about this blog: I&#8217;ve been on vacation for the past two weeks in Australia and New Zealand, which is why posting has been sporadic at best of late. Also, a glitch in our email server prevented many readers from receiving notifications of new updates over the last few weeks. Fixing the glitch caused subscribers to receive 10 days&#8217; worth of email notifications all at once. Sorry for the inconvenience.</p>


feed_id: http://krebsonsecurity.com/?p=31243
title: Catching Up on the OPM Breach
uri: Catching-Up-on-the-OPM-Breach
url: http://krebsonsecurity.com/2015/06/catching-up-on-the-opm-breach/
content:
<p>I heard from many readers last week who were curious why I had not weighed in on the massive (and apparently still unfolding) data breach at the <strong>U.S. Office of Personnel Management</strong> (OPM). Turns out, the easiest way for a reporter to make sure everything hits the fan from a cybersecurity perspective is to take a two week vacation to the other end of the world. What follows is a timeline that helped me get my head on straight about the events that preceded this breach, followed by some analysis and links to other perspectives on the matter.</p>
<div id="attachment_31251" style="width: 369px" class="wp-caption alignright"><a href="media/a65b2540.opmoffices.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/opmoffices.png"><img class=" wp-image-31251" src="media/b8175c46.opmoffices-580x348.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/opmoffices-580x348.png" alt="OPM offices in Washington, DC. Image: Flickr." width="359" height="215" /></a><p class="wp-caption-text">OPM offices in Washington, DC. Image: Flickr.</p></div>
<p><strong>July 2014:</strong> OPM investigates a breach of its computer networks dating back to March 2014. Authorities trace the intrusion to China. OPM offers employees free credit monitoring and <a href="http://www.washingtonpost.com/news/politics/wp/2014/07/10/e-mail-to-opm-staff-on-security-breach/" target="_blank">assures employees</a> that no personal data appears to have been stolen.</p>
<p><strong>Aug. 2014:</strong> It emerges that <strong>USIS</strong>, a background check provider for the <strong>U.S. Department of Homeland Security</strong>, was hacked. USIS <a href="http://archive.federaltimes.com/article/20140918/MGMT03/309180013/USIS-offers-DHS-employees-credit-monitoring-after-breach" target="_blank">offers</a> 27,000 DHS employees credit monitoring through <strong>AllClearID</strong> (full disclosure: AllClear is an advertiser on this blog). Investigators say Chinese are hackers responsible, and that the attackers broke in by <a href="http://www.nextgov.com/cybersecurity/2015/05/third-party-software-was-entry-point-background-check-system-hack/112354/" target="_blank">exploiting a vulnerability</a> in an enterprise management software product from SAP. OPM soon suspends work with USIS.</p>
<p><strong>November 2014:</strong> A <a href="media/1bc8e2c6.sar52.pdf" data-original-source="http://www.opm.gov/news/reports-publications/semi-annual-reports/sar52.pdf" target="_blank">report</a> (PDF) by OPM&#8217;s <strong>Office of the Inspector General</strong> on the agency&#8217;s compliance with <a href="https://en.wikipedia.org/wiki/Federal_Information_Security_Management_Act_of_2002" target="_blank">Federal Information Security Management Act</a> finds &#8220;significant&#8221; deficiencies in the department&#8217;s IT security. The report found OPM did not maintain a comprehensive inventory of servers, databases and network devices, nor were auditors able to tell if OPM even had a vulnerability scanning program. The audit also found that multi-factor authentication (the use of a token such as a smart card, along with an access code) was not required to access OPM systems. &#8220;We believe that the volume and sensitivity of OPM systems that are operating without an active Authorization represents a material weakness in the internal control structure of the agency’s IT security program,&#8221; the report concluded.</p>
<p><strong>Dec. 2014</strong>: <strong>KeyPoint</strong>, a company that took over background checks for USIS, <a href="http://www.washingtonpost.com/business/economy/keypoint-suffers-network-breach-thousands-of-fed-workers-could-be-affected/2014/12/18/e6c7146c-86e1-11e4-a702-fa31ff4ae98e_story.html" target="_blank">suffers breach</a>. OPM states that there is &#8220;no conclusive evidence to confirm sensitive information was removed from the system.&#8221; OPM vows to notify 48,439 federal workers that their information may have been exposed in the attack.</p>
<p><strong>Feb. 2015:</strong> Health insurance giant Anthem <a href="http://krebsonsecurity.com/2015/02/data-breach-at-health-insurer-anthem-could-impact-millions/" target="_blank">discloses breach</a> impacting nearly 80 million customers. Experts later <a href="http://krebsonsecurity.com/2015/02/anthem-breach-may-have-started-in-april-2014/" target="_blank">trace domains, IP addresses implicated in attack to Chinese hackers</a>. Anthem <a href="https://www.google.com/url?sa=t&amp;rct=j&amp;q=&amp;esrc=s&amp;source=web&amp;cd=3&amp;cad=rja&amp;uact=8&amp;ved=0CCoQFjACahUKEwj_-sPKgZHGAhULkA0KHdrSDHw&amp;url=https%3A%2F%2Fanthem.allclearid.com%2F&amp;ei=tmh-Vf_HN4ugNtqls-AH&amp;usg=AFQjCNHyDfcWZ8qhaGwUhwemB1k1GzIoiQ&amp;sig2=q7dZYgHHzLN4ZS9ZSiLZKQ&amp;bvm=bv.95515949,d.eXY" target="_blank">offers</a> two years of free credit monitoring services through AllClearID.</p>
<p><strong>May 2015:</strong> Premera Blue Cross, one of the insurance carriers that participates in the Federal Employees Health Benefits Program, discloses a breach affecting 11 million customers. Federal auditors at OPM <a href="http://www.seattletimes.com/business/local-business/feds-warned-premera-about-security-flaws-before-breach/" target="_blank">warned Premera</a> three weeks prior to the breach that its network security procedures were inadequate. Unlike the Anthem breach, the incident at Premera exposes clinical medical information in addition to personally identifiable information. Premera <a href="http://www.premeraupdate.com/free-credit-monitoring" target="_blank">offers</a> two years of free credit monitoring through <strong>Experian</strong>.</p>
<p><strong>May 2015:</strong> Carefirst Blue Cross discloses breach impacting 1.1 million customers. Clues unearthed by researchers <a href="http://krebsonsecurity.com/2015/05/carefirst-blue-cross-breach-hits-1-1m/" target="_blank">point to the same attack infrastructure and methods</a> used in the Anthem and Premera breach. Carefirst<a href="http://www.carefirstanswers.com/monitoring.html" target="_blank"> offers</a> two years free credit monitoring through Experian.</p>
<p><strong>June 2015:</strong> OPM discloses breach affecting up to 4 million federal employees, <a href="https://www.csid.com/opm/" target="_blank">offers</a> 18 months of free credit monitoring through <strong>CSID</strong>. Follow-up reports indicate that the breach may extend well beyond federal employees to individuals who applied for security clearances with the federal government.</p>
<p><span style="text-decoration: underline;">ANALYSIS</span></p>
<p>As the OPM&#8217;s Inspector General report put it, &#8220;attacks like the ones on Anthem and Premera [and OPM] are likely to increase. In these cases, the risk to Federal employees and their families will probably linger long after the free credit monitoring offered by these companies expires.&#8221;</p>
<p>That would appear to be the understatement of the year. The OPM runs a little program called <a href="https://en.wikipedia.org/wiki/E-QIP" target="_blank">e-QIP</a>, which processes applications for security clearances for federal agencies, including top secret and above. This bit, from <a href="http://www.washingtonpost.com/world/national-security/chinese-hackers-go-after-us-workers-personal-data/2014/07/10/92db92e8-0846-11e4-8a6a-19355c7e870a_story.html" target="_blank">a July 10, 2014 story</a> in <em>The Washington Post</em>, puts the depth and breadth of this breach in better perspective:</p>
<blockquote><p>&#8220;In those files are huge treasure troves of personal data, including &#8220;applicants&#8217; financial histories and investment records, children&#8217;s and relatives&#8217; names, foreign trips taken and contacts with foreign nationals, past residences, and names of neighbors and close friends such as college roommates and co-workers. Employees log in using their Social Security numbers.&#8221;</p></blockquote>
<p>That quote aptly explains why a nation like China might wish to hoover up data from the OPM and a network of healthcare providers that serve federal employees: If you were a state and wished to recruit foreign spies or uncover traitors within your own ranks, what sort of goldmine might this data be? Imagine having access to files that include interviews with a target&#8217;s friends and acquaintances over the years, some of whom could well have shared useful information about that person&#8217;s character flaws, weaknesses and proclivities.</p>
<p>For its part, China has steadfastly denied involvement. Politico cites a news story from the Chinese news service <em>Xinhua</em> which <a href="http://news.xinhuanet.com/english/2015-06/05/c_134300869.htm" target="_blank" rel="noreferrer">dismissed</a> the U.S. allegations as “obviously another case of Washington’s habitual slander against Beijing on cybersecurity.”<span id="more-31243"></span></p>
<p>&#8220;It also pointed to the information disclosed by former NSA subcontractor Edward Snowden, saying the U.S. itself is guilty of &#8216;large-scale, organized cyber theft, wiretapping and supervision of political figures, enterprises and individuals of other countries, including China&#8217;,&#8221; <strong>Politico</strong>&#8216;s <strong>David Perera</strong> <a href="http://www.politico.com/story/2015/06/personal-data-of-4-million-federal-employees-hacked-118655.html" target="_blank">writes</a>.</p>
<p>There are some who would say it is wrong or at least foolhardy to dwell on <a href="http://www.threatconnect.com/news/opm-breach-analysis-update/" target="_blank">forensic data and other clues</a> suggesting that hackers closely allied with the Chinese government were involved in these attacks. Indeed, there is a contingent of experts who argue that placing so much emphasis on attribution in these sorts of attacks is a diversion that distracts attention and resources from what really matters: learning from one&#8217;s mistakes and focusing on better securing and maintaining our critical systems.</p>
<p>As part of my visit to Australia (and then to <a href="media/bffd720e.bfGYW.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/bfGYW.jpg" target="_blank">gorgeous</a> New Zealand) these past few weeks, I was invited to speak at two separate security conferences. At one of them, my talk was preceded by a speech from <strong>Mike Burgess</strong>, chief information security officer at <strong>Telstra</strong>, Australia&#8217;s largest telecom provider. Burgess knows a few things about attribution: He is an 18-year veteran of the <a href="http://www.asd.gov.au/" target="_blank">Australian Signals Directorate</a> (formerly the <strong>Defence Signals Directorate</strong> and the Australian equivalent of the <strong>U.S. National Security Agency</strong>).</p>
<p>In his speech, Burgess railed against media reports about high-profile cyber attacks that created an atmosphere of what he called &#8220;attribution distraction&#8221; and &#8220;threat distraction.&#8221; A reporter with <a href="http://www.zdnet.com/article/telstra-ciso-blasts-cyber-attribution-distraction/" target="_blank">ZDNet captured</a> Burgess&#8217;s thoughts with this quote:</p>
<blockquote><p>&#8220;Don&#8217;t get me wrong&#8230;.I&#8217;m not saying that attribution isn&#8217;t important. I&#8217;m not saying that issues of source, great technical intelligence, and other forms of intelligence to understand the threat and the intentions of those looking to steal information from you, or disrupt your organisation for some purpose that may be unknown to you, [are not important].&#8221;</p>
<p>&#8220;But what I observe, what I fear, what I see too much of, is many commentators, many in the industry, and many in media, focus on attribution, with very little focus on the root cause. No-one should lose valuable information where at the root cause there is a known remedy. For me, that is unforgivable in this day and age. And I&#8217;ve got to tell you &#8212; my view at least &#8212; too much of this distraction around attribution takes away from focusing on what&#8217;s really important here.&#8221;</p></blockquote>
<p>There is, no doubt, a great deal of wisdom in Mr. Burgess&#8217;s words. After all, OPM <a href="http://arstechnica.com/security/2015/06/why-the-biggest-government-hack-ever-got-past-opm-dhs-and-nsa/" target="_blank">clearly could have been doing much more</a> to beef up security around its very sensitive stores of data. But perhaps Burgess was onto something for a different reason: At least as it relates to the United States&#8217; tenuous relations with China, having strong indicators of attribution in an attack of this magnitude puts the White House rather publicly between a rock and a hard place.</p>
<p>As <em>The New York Times</em> <a href="http://www.nytimes.com/2015/06/13/us/white-house-weighs-sanctions-after-second-breach-of-a-computer-system.html" target="_blank">writes</a>, the Obama administration now finds itself under pressure to respond in some way, and is reportedly considering financial sanctions against China. But as <em>The National Journal</em> wryly observes, this is a bit of an awkward position for a government that hardly holds the moral high ground when it comes to spying on and hoovering up data from foreign governments.</p>
<p>&#8220;That&#8217;s partially because in the two years since Edward Snowden&#8217;s leaks about U.S. surveillance, the Obama administration has repeatedly argued that hacking into computer networks to spy on foreigners is completely acceptable behavior,&#8221; <a href="http://www.nationaljournal.com/tech/does-nsa-spying-leave-the-u-s-without-moral-high-ground-in-china-hack-20150614" target="_blank">writes</a> Brendan Sasso. &#8220;It won&#8217;t be so easy for the U.S. to express indignant outrage just because it&#8217;s on the opposite side of the surveillance this time.&#8221;</p>
<p>If you&#8217;re affected by these breaches and wondering what you can do to protect yourself besides signing up for credit monitoring services, <a href="http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">please see this story</a>.</p>


feed_id: http://krebsonsecurity.com/?p=31259
title: Password Manager LastPass Warns of Breach
uri: Password-Manager-LastPass-Warns-of-Breach
url: http://krebsonsecurity.com/2015/06/password-manager-lastpass-warns-of-breach/
content:
<p><strong>LastPass</strong>, a company that offers users a way to centrally manage all of their passwords online with a single master password, <a href="https://blog.lastpass.com/2015/06/lastpass-security-notice.html/" target="_blank">disclosed</a> Monday that intruders had broken into its databases and made off with user email addresses and password reminders, among other data.</p>
<p><a href="media/2c2fb318.lastpass.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/lastpass.png"><img class="alignright  wp-image-31264" src="media/7e77e69f.lastpass-580x132.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/lastpass-580x132.png" alt="lastpass" width="290" height="66" /></a>In an alert posted to its blog, LastPass said the company has found no evidence that its encrypted user vault data was taken, nor that LastPass user accounts were accessed.</p>
<p>&#8220;The investigation has shown, however, that LastPass account email addresses, password reminders, server per user salts, and authentication hashes were compromised,&#8221; the company said. &#8220;We are confident that our encryption measures are sufficient to protect the vast majority of users. LastPass strengthens the authentication hash with a random salt and 100,000 rounds of server-side PBKDF2-SHA256, in addition to the rounds performed client-side. This additional strengthening makes it difficult to attack the stolen hashes with any significant speed.&#8221;</p>
<p class="p1"><span class="s1">Parsing LastPass&#8217;s statement requires a basic understanding of the way that passwords are generally stored. Passwords are &#8220;hashed&#8221; by taking the plain text password and running it against a theoretically one-way mathematical algorithm that turns the user&#8217;s password into a string of gibberish numbers and letters that is supposed to be challenging to reverse. </span></p>
<p class="p1"><span class="s1">The weakness of this approach is that hashes by themselves are static, meaning that the password &#8220;123456,&#8221; for example, will always compute to the same password hash. To make matters worse, there are plenty of tools capable of very rapidly mapping these hashes to common dictionary words, names and phrases, which essentially negates the effectiveness of hashing. These days, computer hardware has gotten so cheap that attackers can easily and very cheaply build machines capable of computing tens of millions of possible password hashes per second for each corresponding username or email address.</span></p>
<p class="p1">But by adding a unique element, or &#8220;salt,&#8221; to each user password, database administrators can massively complicate things for attackers who may have stolen the user database and rely upon automated tools to crack user passwords.</p>
<p class="p1">&#8220;What a salt does it makes it hard to go after a lot of passwords at once as opposed to one users&#8217; password, because every user requires a separate guess and that separate guess is going to take a considerable amount of time,&#8221; said <strong>Steve Bellovin</strong>, a professor in computer science at <strong>Columbia University</strong> . &#8220;With a salt, even if a bunch of users have the same password, like &#8216;123456,&#8217; everyone would have a different hash.&#8221;</p>
<p class="p1">More concerning in this particular breach, Bellovin said, is that users&#8217; password reminders also were stolen.</p>
<p class="p1"><span id="more-31259"></span></p>
<p class="p1"><span class="s1">&#8220;I suspect that for a significant number of people, the password reminder &#8212; in addition to the user&#8217;s email address &#8212; is going to be useful for an attacker,&#8221; he said. &#8220;But password reminders are useful for targeted attacks, not massive attacks. That means that if your password reminder or hint is not particularly revealing to someone who doesn’t know you, it probably doesn’t matter much. Except in the case of targeted phishing attacks,&#8221; which might try to leverage data known about a specific target (such as a password hint) to trick the user into giving up the answer to their password reminder. </span></p>
<p class="p1">So what&#8217;s the takeaway here? If you entrust all of your passwords to LastPass, now would be a terrific time to change your master password.</p>


feed_id: http://krebsonsecurity.com/?p=31272
title: Critical Flaws in Apple, Samsung Devices
uri: Critical-Flaws-in-Apple-Samsung-Devices
url: http://krebsonsecurity.com/2015/06/critical-flaws-in-apple-samsung-devices/
content:
<p>Normally, I don&#8217;t cover vulnerabilities about which the user can do little or nothing to prevent, but two newly detailed flaws affecting hundreds of millions of <strong>Android</strong>, <strong>iOS</strong> and <strong>Apple</strong> products probably deserve special exceptions.</p>
<p><a href="media/c3b16044.keychain.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/keychain.png"><img class="alignright  wp-image-31279" src="media/8f4be6cb.keychain-580x409.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/keychain-580x409.png" alt="keychain" width="316" height="223" /></a>The first is a zero-day bug in <strong>iOS</strong> and <strong>OS X</strong> that allows the theft of both <a href="https://en.wikipedia.org/wiki/Keychain_(software)" target="_blank">Keychain</a> (Apple&#8217;s password management system) and app passwords. The flaw, first revealed in an <a href="https://drive.google.com/file/d/0BxxXk1d3yyuZOFlsdkNMSGswSGs/view" target="_blank">academic paper</a> (PDF) released by researchers from <strong>Indiana University</strong>, <strong>Peking University</strong> and the <strong>Georgia Institute of Technology</strong>, involves a vulnerability in Apple&#8217;s latest operating system versions that enable an app approved for download by the Apple Store to gain unauthorized access to other apps&#8217; sensitive data.</p>
<p>&#8220;More specifically, we found that the inter-app interaction services, including the keychain&#8230;can be exploited&#8230;to steal such confidential information as the passwords for iCloud, email and bank, and the secret token of Evernote,&#8221; the researchers wrote.</p>
<p>The team said they tested their findings by circumventing the restrictive security checks of the Apple Store, and that their attack apps were approved by the App Store in January 2015. According to the researchers, more than 88 percent of apps were &#8220;completely exposed&#8221; to the attack.</p>
<p>News of the research was first reported by <em>The Register</em>, which said that Apple was initially notified in October 2014 and that in February 2015 the company asked researchers to hold off disclosure for six months.</p>
<p>&#8220;The team was able to raid banking credentials from Google Chrome on the latest Mac OS X 10.10.3, using a sandboxed app to steal the system&#8217;s keychain and secret iCloud tokens, and passwords from password vaults,&#8221; The Register <a href="http://www.theregister.co.uk/2015/06/17/apple_hosed_boffins_drop_0day_mac_ios_research_blitzkrieg/" target="_blank">wrote</a>. &#8220;Google&#8217;s Chromium security team was more responsive and removed Keychain integration for Chrome noting that it could likely not be solved at the application level. <strong>AgileBits</strong>, owner of popular software <a href="https://agilebits.com/onepassword" target="_blank">1Password</a>, said it could not find a way to ward off the attacks or make the malware &#8216;work harder&#8217; some four months after disclosure.&#8221;</p>
<p>A story at <strong>9to5mac.com</strong> suggests the malware the researchers created to run their experiments can&#8217;t directly access existing keychain entries, but instead does so indirectly by forcing users to log in manually and then capturing those credentials in a newly-created entry.</p>
<p>&#8220;For now, the best advice would appear to be cautious in downloading apps from unknown developers – even from the iOS and Mac App Stores – and to be alert to any occasion where you are asked to login manually when that login is usually done by Keychain,&#8221; 9to5&#8217;s <strong>Ben Lovejoy</strong> <a href="http://9to5mac.com/2015/06/17/major-zero-day-security-flaws-in-ios-os-x-allow-theft-of-both-keychain-and-app-passwords/" target="_blank">writes</a>.</p>
<p><span style="text-decoration: underline;">SAMSUNG KEYBOARD FLAW</span></p>
<p>Separately, researchers at mobile security firm <strong>NowSecure</strong> disclosed they&#8217;d found a serious vulnerability in a third-party keyboard app that is <em>pre-installed</em> on more than 600 million Samsung mobile devices &#8212; including the recently released <strong>Galaxy S6</strong> &#8212; that allows attackers to remotely access resources like GPS, camera and microphone, secretly install malicious apps, eavesdrop on incoming/outgoing messages or voice calls, and access pictures and text messages on vulnerable devices.<span id="more-31272"></span></p>
<p>The vulnerability in this case resides with an app called <strong>Swift keyboard</strong>, which according to researcher <strong>Ryan Welton</strong> runs from a privileged account on Samsung devices. The flaw can be exploited if the attacker can control or compromise the network to which the device is connected, such as a wireless hotspot or local network.</p>
<p>&#8220;This means that the keyboard was signed with Samsung’s private signing key and runs in one of the most privileged contexts on the device, system user, which is a notch short of being root,&#8221; Welton wrote in <a href="https://www.nowsecure.com/blog/2015/06/16/remote-code-execution-as-system-user-on-samsung-phones/" target="_blank">a blog post</a> about the flaw, which was first disclosed at <a href="https://www.blackhat.com/ldn-15/summit.html#abusing-android-apps-and-gaining-remote-code-execution" target="_blank">Black Hat London</a> on Tuesday, along the release of proof-of-concept code.</p>
<p>Welton said NowSecure alerted Samsung in November 2014, and that at the end of March Samsung reported a patch released to mobile carriers for Android 4.2 and newer, but requested an additional three months deferral for public disclosure. Google&#8217;s Android security team was alerted in December 2014.</p>
<p>&#8220;While Samsung began providing a patch to mobile network operators in early 2015, it is unknown if the carriers have provided the patch to the devices on their network,&#8221; Welton said. &#8220;In addition, it is difficult to determine how many mobile device users remain vulnerable, given the devices models and number of network operators globally.&#8221; NowSecure has released <a href="media/b109d176.swift-carrier.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/swift-carrier.png" target="_blank">a list</a> of Samsung devices indexed by carrier and their individual patch status.</p>
<p>Samsung issued a statement saying it takes emerging security threats very seriously.</p>
<p>&#8220;Samsung KNOX has the capability to update the security policy of the phones, over-the-air, to invalidate any potential vulnerabilities caused by this issue. The security policy updates will begin rolling out in a few days,&#8221; the company said. &#8220;In addition to the security policy update, we are also working with SwiftKey to address potential risks going forward.”</p>
<p>A spokesperson for Google said the company took steps to mitigate the issue with the release of Android 5.0 in November 2014.</p>
<p>&#8220;Although these are most accurately characterized as application level issues, back with Android 5.0, we took proactive measures to reduce the risk of the issues being exploited,&#8221; Google said in a statement emailed to KrebsOnSecurity. &#8220;For the longer term, we are also in the process of reaching out to developers to ensure they follow best practices for secure application development.&#8221;</p>
<p>SwiftKey released a statement emphasizing that the company only became aware of the problem this week, and that it does not affect its keyboard applications available on Google Play or Apple App Store. &#8220;We are doing everything we can to support our long-time partner Samsung in their efforts to resolve this important security issue,&#8221; SwiftKey said in <a href="http://swiftkey.com/en/blog/samsung-keyboard-security-vulnerability-swiftkey/" target="_blank">a blog post</a>.</p>
<p><strong>Update:</strong> SwiftKey&#8217;s <strong>Jennifer Kutz</strong> suggests that it&#8217;s incorrect to use the phrase &#8220;pre-installed app&#8221; to describe the component that Samsung ships with its devices: &#8220;A pre-installed app is definitely different from how we work with Samsung, who licenses/white-labels our technology &#8211; or prediction engine &#8211; to power their devices&#8217; default/stock keyboards,&#8221; Kutz said. &#8220;The keyboard is not branded as SwiftKey, and the functionality between our Google Play app, or pre-installed SwiftKey app, is different from what Samsung users have (in short, the official SwiftKey app has a much more robust feature set). The SwiftKey SDK powers the word predictions &#8211; it&#8217;s a core part of our technology but it is not our full app.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=31290
title: OPM’s Database for Sale? Nope, It Came from Another US .Gov
uri: OPM-s-Database-for-Sale-Nope-It-Came-from-Another-US-Gov
url: http://krebsonsecurity.com/2015/06/opms-database-for-sale-nope-it-came-from-another-us-gov/
content:
<p>A database supposedly from a sample of information stolen in the much publicized hack at the <strong>Office of Personnel Management</strong> (OPM) has been making the rounds in the cybercrime underground, with some ne&#8217;er-do-wells even offering to sell it as part of a larger package. But a review of the information made available as a teaser indicates that the database is instead a list of users stolen from a different government agency &#8212; <strong>Unicor.gov, </strong>also known as <strong>Federal Prison Industries</strong>.</p>
<div id="attachment_31297" style="width: 334px" class="wp-caption alignright"><a href="media/0cd6e10b.unicorflag.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/unicorflag.png"><img class=" wp-image-31297" src="media/0cd6e10b.unicorflag.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/unicorflag.png" alt="Source: Unicor.gov" width="324" height="243" /></a><p class="wp-caption-text">Source: Unicor.gov</p></div>
<p>Earlier this week, miscreants who frequent the <strong>Hell cybercrime forum</strong> (a &#8220;Deep Web&#8221; site reachable only via the Tor network) began passing around a text file that contained more than 23,000 records which appeared to be a user database populated exclusively by user accounts with dot-gov email addresses. I thought it rather unlikely that the file had anything to do with the OPM hack, which was widely attributed to Chinese hackers who are typically interested in espionage &#8212; not selling the data they steal on open-air markets.</p>
<p>As discussed in my Oct. 2014 post, <a href="http://krebsonsecurity.com/2014/10/how-to-tell-data-leaks-from-publicity-stunts/" target="_blank">How to Tell Data Leaks from Publicity Stunts</a>, there are several simple techniques that often can be used to tell whether a given data set is what it claims to be. One method involves sampling email addresses from the leaked/hacked database and then using them in an attempt to create new accounts at the site in question. In most cases, online sites and services will allow only one account per email address, so if a large, random sampling of email addresses from the database all come back as already registered at the site you suspect is the breached entity, then it&#8217;s a safe guess the data came from that entity.</p>
<p>How to know the identity of the organization from which the database was stolen? In most cases, database files list the users in the order in which they registered on the site. As a result, the email addresses and/or usernames for the first half-dozen or more users listed in the database are most often from the database administrators and/or site designers. When all of those initial addresses have the same top-level domain &#8212; in this case &#8220;unicor.gov&#8221; &#8212; it&#8217;s a good bet that&#8217;s your victim organization.</p>
<div id="attachment_31298" style="width: 331px" class="wp-caption alignleft"><a href="media/231c4dc4.unicor-phone.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/unicor-phone.png"><img class=" wp-image-31298" src="media/231c4dc4.unicor-phone.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/unicor-phone.png" alt="Image: Unicor.gov" width="321" height="250" /></a><p class="wp-caption-text">Image: Unicor.gov</p></div>
<p>According to <a href="https://en.wikipedia.org/wiki/Federal_Prison_Industries" target="_blank">Wikipedia</a>, UNICOR is a wholly owned United States government corporation created in 1934 that uses penal labor from the Federal Bureau of Prisons to produce goods and services. It is apparently restricted to selling its products and services to federal government agencies, although recently private companies gained some access to UNICOR workforce. For instance, companies can outsource call centers to UNICOR. Case in point: If you call UNICOR&#8217;s main number off-hours, the voicemail message states that during business hours your call may be handled by an inmate!<span id="more-31290"></span></p>
<p>On Tuesday, I reached out to UNICOR to let them know that it appeared their user database &#8212; including hashed passwords and other information &#8212; was being traded on underground cybercrime forums. On Wednesday, I heard back from <strong>Marianne Cantwell</strong>, the public information officer for UNICOR. Cantwell said a review of the information suggests it is related to an incident in September 2013, when Federal Prison Industries discovered unauthorized access to its public Web site.</p>
<p>&#8220;Since that time, the website software has been replaced to improve security. Assessments by proper law enforcement authorities were conducted to determine the extent of the incident, at the time it was discovered,&#8221; said Cantwell, who confirmed the incident hadn&#8217;t been previously disclosed publicly. &#8220;Limited individuals were deemed to be potentially impacted, and notifications were made as a precautionary measure. Federal Prison Industries is sensitive to ensuring the security of its systems and will continue to monitor this issue.&#8221;</p>
<p>The &#8220;website software&#8221; in question was <strong>ColdFusion</strong>, a Web application platform owned by <strong>Adobe Systems Inc. </strong> Around that same time, hackers were running around <a href="http://krebsonsecurity.com/?s=coldfusion&amp;x=0&amp;y=0" target="_blank">breaking into a number of government and corporate Web sites and databases</a> using ColdFusion vulnerabilities. In October 2013, I wrote about <a href="http://krebsonsecurity.com/2013/10/data-broker-hackers-also-compromised-nw3c/" target="_blank">criminals who had used ColdFusion exploits</a> to break into and steal the database from the <a href="http://www.nw3c.org/" target="_blank">National White Collar Crime Center</a> (NW3C), a congressionally-funded non-profit organization that provides training, investigative support and research to agencies and entities involved in the prevention, investigation and prosecution of cybercrime.</p>
<p>There is no information to link the hack at UNICOR to the crooks behind the NW3C compromise, but it&#8217;s interesting to note that those responsible for the NW3C attack also had control over the now-defunct identity theft service <strong>ssndob[dot]ms</strong>. That service, which was advertised on cybercrime forums, was powered in part by a <a href="http://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/" target="_blank">small but powerful collection of hacked computers exclusively at top data brokers</a>, including LexisNexis, Dun &amp; Bradstreet, and HireRight/Kroll.</p>


feed_id: http://krebsonsecurity.com/?p=31322
title: “Free” Proxies Aren’t Necessarily Free
uri: Free-Proxies-Aren-t-Necessarily-Free
url: http://krebsonsecurity.com/2015/06/free-proxies-arent-necessarily-free/
content:
<p><strong>Netflix</strong>, <strong>Hulu</strong> and a host of other content streaming services block non-U.S. users from viewing their content. As a result, many people residing in or traveling outside of the United States seek to circumvent such restrictions by using services that advertise &#8220;free&#8221; and &#8220;open&#8221; Web proxies capable of routing browser traffic through U.S.-based computers and networks. Perhaps unsurprisingly, new research suggests that most of these &#8220;free&#8221; offerings are anything but, and actively seek to weaken browser security and privacy.</p>
<p><a href="media/dadfaa21.proxy.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/proxy.png"><img class="alignright  wp-image-31323" src="media/dadfaa21.proxy.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/proxy.png" alt="proxy" width="323" height="135" /></a>The data comes from Austrian researcher and teacher <a href="https://twitter.com/geek_at" target="_blank">Christian Haschek</a>, who published a simple script to check 443 open Web proxies (no, that number was <a href="https://www.grc.com/port_443.htm" target="_blank">not accidental</a>). His script tries to see if a given proxy allows encrypted browser traffic (https://), and whether the proxy tries to modify site content or inject any content into the user&#8217;s browser session, such as ads or malicious scripts.</p>
<p>Haschek found that 79 percent of the proxies he tested forced users to load pages in unencrypted (http://) mode, meaning the owners of those proxies could see all of the traffic in plain text.</p>
<p>&#8220;It could be because they want you to use http so they can analyze your traffic and steal your logins,&#8221; Haschek said. &#8220;If I&#8217;m a good guy setting up a server so that people can use it to be secure and anonymous, I&#8217;m going to allow people to use https. But what is my motive if I tell users http only?&#8221;</p>
<p>Haschek&#8217;s research also revealed that slightly more than 16 percent of the proxy servers were actively modifying static HTML pages to inject ads.</p>
<p>Virtual private networks (VPNs) allow users to tunnel their encrypted traffic to different countries, but increasingly online content providers are <a href="http://www.computerworld.com/article/2864454/netflix-blocks-customers-using-vpns-itbwgk.html" target="_blank">blocking popular VPN services as well</a>. Tor offers users the ability to encrypt and tunnel traffic for free, but in my experience the service isn&#8217;t reliably fast enough to stream video.<span id="more-31322"></span></p>
<p>Haschek suggests that users who wish to take advantage of open proxies pick ones that allow https traffic. He&#8217;s created and posted online <a href="https://proxycheck.haschek.at/" target="_blank">a free tool</a> that allows anyone to test whether a given proxy permits encrypted Web traffic, as well as whether the proxy truly hides the user&#8217;s real Internet address. <a href="https://blog.haschek.at/2015-analyzing-443-free-proxies" target="_blank">This blog post</a> explains more about his research methodology and script.</p>
<p>Users who wish to take advantage of open proxies also should consider doing so using a <a href="http://krebsonsecurity.com/2012/07/banking-on-a-live-cd/" target="_blank">Live CD</a> or virtual machine setup that makes it easy to reset the system to a clean installation after each use. I rely on <a href="https://www.virtualbox.org/wiki/Downloads" target="_blank">the free VirtualBox platform</a> to run multiple virtual machines, a handful of which I use to do much of my regular browsing, tweeting, emailing and other things that can lead sometimes to malicious links, scripts, etc.</p>
<p>I&#8217;ll most likely revisit setting up your own VirtualBox installation in a future post, but <a href="https://www.linuxliteos.com/forums/tutorials/virtualbox-create-vm-for-booting-live-isoscdsdvds/" target="_blank">this tutorial</a> offers a fairly easy-to-follow primer on how to run a <a href="http://livecdlist.com/" target="_blank">Live CD installation of a Linux distribution of your choosing</a> on top of VirtualBox.</p>


feed_id: http://krebsonsecurity.com/?p=31342
title: Emergency Patch for Adobe Flash Zero-Day
uri: Emergency-Patch-for-Adobe-Flash-Zero-Day
url: http://krebsonsecurity.com/2015/06/emergency-patch-for-adobe-flash-zero-day/
content:
<p><strong>Adobe Systems Inc</strong>. today released an emergency update to fix a dangerous security hole in its widely-installed <strong>Flash Player</strong> browser plugin. The company warned that the vulnerability is already being exploited in targeted attacks, and urged users to update the program as quickly as possible.</p>
<p>In <a href="https://helpx.adobe.com/security/products/flash-player/apsb15-14.html" target="_blank">an advisory</a> issued Tuesday morning, Adobe said the latest version of Flash &#8212; <span style="text-decoration: underline;"><em>v. 18.0.0.194</em></span> on <strong>Windows</strong> and <strong>Mac OS X</strong> &#8212; fixes a critical flaw (CVE-2015-3113) that is being actively exploited in &#8220;limited, targeted attacks.&#8221; The company said systems running <strong>Internet Explorer</strong> for <strong>Windows 7</strong> and below, as well as <strong>Firefox</strong> on <strong>Windows XP</strong>, are known targets of these exploits.<span id="more-31342"></span></p>
<p>If you’re unsure whether your browser has Flash installed or what version it may be running, browse to <a title="https://www.adobe.com/software/flash/about/" href="https://www.adobe.com/software/flash/about/" target="_blank">this link</a>. Adobe Flash Player installed with <strong>Google Chrome</strong>, as well as <strong>Internet Explorer</strong> on <strong>Windows 8.x</strong>, should automatically update to the latest version. To force the installation of an available update on Chrome, click the triple bar icon to the right of the address bar, select “About Google” Chrome, click the apply update button and restart the browser.</p>
<p>The most recent versions of Flash should be available from the <a title="http://get.adobe.com/flashplayer/" href="http://get.adobe.com/flashplayer/" target="_blank">Flash home page</a>, but beware potentially unwanted add-ons, like <strong>McAfee Security Scan</strong>. To avoid this, uncheck the pre-checked box before downloading, or grab your OS-specific Flash download from <a title="https://www.adobe.com/products/flashplayer/distribution3.html" href="https://www.adobe.com/products/flashplayer/distribution3.html" target="_blank">here</a>. Windows users who browse the Web with anything other than Internet Explorer may need to apply this patch twice, once with IE and again using the alternative browser (<strong>Firefox</strong>, <strong>Opera</strong>, e.g.)</p>
<p>In lieu of patching Flash Player yet again, it might be worth considering whether you really need to keep Flash Player installed at all. In a happy coincidence, earlier today I <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">published a piece about my experience going a month without having Flash Player installed</a>. The result? I hardly missed it at all.</p>


feed_id: http://krebsonsecurity.com/?p=28770
title: A Month Without Adobe Flash Player
uri: A-Month-Without-Adobe-Flash-Player
url: http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/
content:
<p>I&#8217;ve spent the better part of the last month running a little experiment to see how much I would miss <strong>Adobe</strong>&#8216;s buggy and insecure <strong>Flash Player</strong> <strong>software</strong> if I removed it from my systems altogether. Turns out, not so much.</p>
<p><a href="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png"><img class="alignright size-full wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="211" height="180" /></a>Browser plugins are favorite targets for malware and miscreants because they are generally full of unpatched or undocumented security holes that cybercrooks can use to seize complete control over vulnerable systems. The Flash Player plugin is a stellar example of this: It is among the most widely used browser plugins, and it requires monthly patching (if not more frequently).</p>
<p>It&#8217;s also not uncommon for Adobe to release emergency fixes for the software to patch flaws that bad guys started exploiting before Adobe even knew about the bugs. This happened most recently <a href="http://krebsonsecurity.com/2015/02/yet-another-flash-patch-fixes-zero-day-flaw/" target="_blank">in February 2015, and <em>twice</em> the month prior</a>. Adobe also shipped out-of-band Flash fixes in <a href="http://krebsonsecurity.com/2014/12/microsoft-adobe-push-critical-security-fixes-2/" target="_blank">December</a> and <a href="http://krebsonsecurity.com/2014/11/adobe-pushes-critical-flash-patch/" target="_blank">November 2014</a>.</p>
<p><strong>Update, 11:30 a.m. ET: </strong>Oddly enough, Adobe just minutes ago released an out-of-band patch to fix <a href="http://krebsonsecurity.com/2015/06/emergency-patch-for-adobe-flash-zero-day/" target="_blank">a zero-day flaw in Flash</a>.</p>
<p><em>Original story:</em></p>
<p>Time was, Oracle&#8217;s Java plugin was the <a href="http://krebsonsecurity.com/?s=exploit+kit+and+java&amp;x=0&amp;y=0" target="_blank">favorite target of exploit kits</a>, software tools made to be stitched into hacked or malicious sites and foist on visiting browsers a kitchen sink of exploits for various plugin vulnerabilities. Lately, however, it seems to pendulum has swung back in favor of exploits for Flash Player. A popular exploit kit known as <strong>Angler</strong>, for example, bundled a new exploit for a Flash vulnerability <a href="https://www.fireeye.com/blog/threat-research/2015/04/angler_ek_exploiting.html" target="_blank">just three days after Adobe fixed it</a> in April 2015.</p>
<p>So, rather than continue the patch madness and keep this insecure software installed, I decided to the pull the&#8230;er&#8230;plugin. I tend to (ab)use different browsers for different tasks, and so uninstalling the plugin was almost as simple as uninstalling Flash, except with <strong>Chrome</strong>, which bundles its own version of Flash Player. Fear not: <a href="https://support.google.com/chrome/answer/108086?hl=en" target="_blank">disabling Flash in Chrome</a> is simple enough. On a <strong>Windows</strong>, <strong>Mac</strong>, <strong>Linux</strong> or <strong>Chrome OS</strong> installation of Chrome, type &#8220;chrome:plugins&#8221; into the address bar, and on the Plug-ins page look for the &#8220;Flash&#8221; listing: To disable Flash, click the disable link (to re-enable it, click &#8220;enable&#8221;).</p>
<p>In almost 30 days, I only ran into just two instances where I encountered a site hosting a video that I absolutely needed to watch and that required Flash (an instructional video for a home gym that I could find nowhere else, and a live-streamed legislative hearing). For these, I opted to cheat and load the content into a Flash-enabled browser inside of a Linux virtual machine I have running inside of <a href="https://www.virtualbox.org/wiki/Downloads" target="_blank">VirtualBox</a>. In hindsight, it probably would have been easier simply to temporarily re-enable Flash in Chrome, and then disable it again until the need arose.<span id="more-28770"></span></p>
<p>If you decide that removing Flash altogether or disabling it until needed is impractical, there are in-between solutions. Script-blocking applications like <a title="https://noscript.net/" href="https://noscript.net/" target="_blank" rel="noreferrer">Noscript</a> and <a title="https://chrome.google.com/webstore/detail/scriptsafe/oiigbmnaadbkfbmpbfijlflahbdbdgdf?hl=en" href="https://chrome.google.com/webstore/detail/scriptsafe/oiigbmnaadbkfbmpbfijlflahbdbdgdf?hl=en" target="_blank">ScriptSafe</a> are useful in blocking Flash content, but script blockers can be challenging for many users to handle.</p>
<p>Another approach is <a title="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" href="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" target="_blank">click-to-play</a>, which is a feature available for most browsers (except IE, sadly) that blocks Flash content from loading by default, replacing the content on Web sites with a blank box. With click-to-play, users who wish to view the blocked content need only click the boxes to enable Flash content inside of them (click-to-play also blocks Java applets from loading by default).</p>
<p>Windows users who decide to keep Flash installed and/or enabled also should take full advantage of the <a title="http://www.microsoft.com/en-us/download/details.aspx?id=43714" href="http://www.microsoft.com/en-us/download/details.aspx?id=43714" target="_blank" rel="noreferrer">Enhanced Mitigation Experience Toolkit</a> (EMET), a free tool from Microsoft that can <a title="http://krebsonsecurity.com/2013/06/windows-security-101-emet-4-0/" href="http://krebsonsecurity.com/2013/06/windows-security-101-emet-4-0/" target="_blank">help Windows users</a> beef up the security of third-party applications.</p>


feed_id: http://krebsonsecurity.com/?p=31330
title: Hershey Park Investigates Card Fraud Pattern
uri: Hershey-Park-Investigates-Card-Fraud-Pattern
url: http://krebsonsecurity.com/2015/06/hershey-park-investigates-card-fraud-pattern/
content:
<p><strong>Hershey Park</strong>, a popular resort and amusement park in Hershey, Pa. has hired a security firm to investigate reports from multiple financial institutions about a possible credit card breach, KrebsOnSecurity has learned.</p>
<p><a href="media/a5dd97cb.hershey.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/hershey.png"><img class="alignright  wp-image-31356" src="media/d1b10083.hershey-580x434.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/hershey-580x434.png" alt="hershey" width="308" height="230" /></a>Contacted after reports by several financial institutions about a pattern of fraudulent charges on customer cards that trace back to Hershey properties, the company says it is investigating.</p>
<p>&#8220;We have received reports from some of our guests that fraud charges appeared on their payment cards after they visited our property,&#8221; said <strong>Kathleen McGraw</strong>, director of communications for <strong>Hershey Entertainment and Resorts Company</strong>.</p>
<p>&#8220;We take reports like this very seriously,&#8221; McGraw continued. &#8220;While our company does have security measures in place designed to prevent unauthorized access to our network, we immediately began to investigate our system for signs of an issue and engaged an external computer security firm to assist us. The investigation is ongoing.&#8221;</p>
<p>Sources at three financial institutions say they have detected a pattern of fraudulent activity on customer cards that were used at Hershey properties in Pennsylvania between mid-March and late May 2015. According to the banks, the cards were used at a variety of Hershey locations, including food and beverage outlets, ticketing stations and the Hershey Lodge.</p>


feed_id: http://krebsonsecurity.com/?p=31368
title: A Busy Week for Ne’er-Do-Well News
uri: A-Busy-Week-for-Ne-er-Do-Well-News
url: http://krebsonsecurity.com/2015/06/a-busy-week-for-neer-do-well-news/
content:
<p>We often hear about the impact of cybercrime, but too seldom do we read about the successes that law enforcement officials have in apprehending those responsible and bringing them to justice. Last week was an especially busy time for cybercrime justice, with authorities across the globe bringing arrests, prosecutions and some cases stiff sentences in connection with a broad range of cyber crimes, including ATM and bank account cashouts, malware distribution and &#8220;swatting&#8221; attacks.</p>
<div id="attachment_31375" style="width: 288px" class="wp-caption alignright"><a href="media/7a5706a7.findikoglu.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/findikoglu.png"><img class="size-full wp-image-31375" src="media/7a5706a7.findikoglu.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/findikoglu.png" alt="Ercan Findikoglu, posing with piles of cash." width="278" height="213" /></a><p class="wp-caption-text">Ercan Findikoglu, posing with piles of cash.</p></div>
<p>Prosecutors in New York had a big week. Appearing in the U.S. court system for the first time last week was <strong>Ercan &#8220;Segate&#8221; Findikoglu</strong>, a 33-year-old Turkish man who <a href="http://www.justice.gov/usao/nye/pr/June15/2015-June-24.php" target="_blank">investigators say</a> was the mastermind behind a series of Oceans 11-type ATM heists between 2011 and 2013 that netted thieves more than $55 million.</p>
<p>According to prosecutors, Findikoglu organized the so-called &#8220;ATM cashouts&#8221; by hacking into networks of several credit and debit card payment processors. With each processor, the intruders were able to simultaneously lift the daily withdrawal limits on numerous prepaid accounts and dramatically increase the account balances on those cards to allow ATM withdrawals far in excess of the legitimate card balances.</p>
<p>The cards were then cloned and sent to dozens of co-conspirators around the globe, who used the cards at ATMs to withdraw millions in cash in the span of just a few hours. Investigators say these attacks are known in the cybercrime underground as &#8220;unlimited operations&#8221; because the manipulation of withdrawal limits lets the crooks steal literally unlimited amounts of cash until the operation is shut down.</p>
<p>Two of the attacks attributed to Findikoglu and his alleged associates were first reported on this blog, including <a href="http://krebsonsecurity.com/2011/08/coordinated-atm-heist-nets-thieves-13m/" target="_blank">a February 2011 attack</a> against <strong>Fidelity National Information Services</strong> (FIS), and <a href="http://krebsonsecurity.com/2013/02/crooks-net-millions-in-coordinated-atm-heists/" target="_blank">a $5 million heist in late 2012</a> involving a card network in India. The most brazen and lucrative heist, a nearly $40 million cashout against the <strong>Bank of Muscat</strong> in Oman, was covered in <a href="http://www.nytimes.com/2013/05/10/nyregion/eight-charged-in-45-million-global-cyber-bank-thefts.html" target="_blank">a May 2013 New York Times piece</a>, which concludes with a vignette about the violent murder of alleged accomplice in the scheme.</p>
<p>Also in New York, a Manhattan federal judge <a href="https://www.fbi.gov/newyork/press-releases/2015/swedish-co-creator-of-blackshades-malware-that-enabled-users-around-the-world-to-secretly-and-remotely-control-victims-computers-sentenced-to-57-months-in-prison" target="_blank">sentenced</a> the co-creator of the &#8220;Blackshades&#8221; Trojan to nearly five years in prison after pleading guilty to helping hundreds of people use and spread the malware. Twenty-five year old Swedish national <strong>Alexander Yucel </strong>was ordered to forfeit $200,000 and relinquish all of the computer equipment he used in commission of his crimes.</p>
<p>As detailed in this May 2014 piece, <a href="http://krebsonsecurity.com/2014/05/blackshades-trojan-users-had-it-coming/" target="_blank">Blackshades Users Had It Coming</a>, the malware was sophisticated but marketed mainly on English language cybecrime forums to young men who probably would have a hard time hacking their way out of a paper bag, let alone into someone&#8217;s computer. Initially sold via PayPal for just $40, Blackshades offered users a way to remotely spy on victims, and even included tools and tutorials to help users infect victim PCs. Many of Yucel&#8217;s customers also have been rounded up by law enforcement here in the U.S. an abroad.<span id="more-31368"></span></p>
<div id="attachment_31380" style="width: 199px" class="wp-caption alignleft"><a href="media/d0e50248.tollis.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/tollis.png"><img class="size-full wp-image-31380" src="media/d0e50248.tollis.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/tollis.png" alt="Matthew Tollis" width="189" height="230" /></a><p class="wp-caption-text">Matthew Tollis</p></div>
<p>In a small victory for people fed up with so-called &#8220;swatting&#8221; &#8212; the act of calling in a fake hostage or bomb threat to emergency services with the intention of prompting a heavily-armed police response to a specific address &#8212; 22-year-old Connecticut resident <strong>Matthew Tollis</strong> <a href="https://www.fbi.gov/newhaven/press-releases/2015/wethersfield-man-admits-participating-in-multiple-swatting-incidents" target="_blank">pleaded guilty</a> last week to multiple swatting incidents. (In an unrelated incident in 2013, <a href="http://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank">this reporter was the victim of swatting</a>, which resulted in our home being surrounded by a dozen or so police and Yours Truly being handcuffed in front of the whole neighborhood).</p>
<p>Tollis admitted belonging to a group that called itself &#8220;<strong>TeAM CrucifiX or Die</strong>,&#8221; a loose-knit cadre of young <strong>Microsoft XBox</strong> and swatting enthusiasts which later renamed itself the &#8220;<strong>ISIS Gang</strong>.&#8221; Interestingly, these past few weeks have seen the prosecution of another alleged ISIS Gang member &#8212; 17-year-old Finnish miscreant who goes by the nicknames &#8220;<strong>Ryan</strong>&#8221; and &#8220;<strong>Zeekill</strong>.&#8221; Ryan, whose real name is <strong>Julius Kivimaki</strong>, was one of several individuals who claimed to be involved in the <a href="http://krebsonsecurity.com/?s=lizard+squad&amp;x=0&amp;y=0" target="_blank">Lizard Squad</a> attacks that <a href="http://krebsonsecurity.com/2014/12/cowards-attack-sony-playstation-microsoft-xbox-networks/" target="_blank">brought down the XBox and Sony Playstation networks</a> in December 2014.</p>
<p>Kivimaki is being prosecuted in Finland for multiple alleged offenses, including payment fraud, money laundering and telecommunications harassment. Under Finnish law, Kivimaki cannot be extradited, but prosecutors there are<a href="http://yle.fi/uutiset/hakkerille_vaaditaan_vankeutta__epaillaan_kymmenistatuhansista_tietomurroista/8036708" target="_blank"> seeking at least two to three years of jail time</a> for the young man, who will turn 18 in August.</p>
<div id="attachment_29338" style="width: 295px" class="wp-caption alignright"><a href="media/a9ae7a8d.ryan-k.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/ryan-k.png"><img class="size-medium wp-image-29338" src="media/8fa28550.ryan-k-285x270.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/ryan-k-285x270.png" alt="Julius &quot;Ryan&quot; Kivimaki." width="285" height="270" /></a><p class="wp-caption-text">Julius &#8220;Ryan&#8221; Kivimaki.</p></div>
<p>Finally, investigators with Europol announced the arrest of five individuals in Ukraine who are suspected of developing, exploiting and distributing the ZeuS and SpyEye malware &#8212; well known banking Trojans that have been used to steal hundreds of millions of dollars from consumers and small businesses.</p>
<p>According to Europol, each cybercriminal in the group had their specialty, but that the group as a whole specialized in creating malware, infecting machines, harvesting bank credentials and laundering the money through so-called money mule networks.</p>
<p>&#8220;On the digital underground forums, they actively traded stolen credentials, compromised bank account information and malware, while selling their hacking ‘services’ and looking for new cooperation partners in other cybercriminal activities,&#8221; Europol said. &#8220;This was a very active criminal group that worked in countries across all continents, infecting tens of thousands of users’ computers with banking Trojans, and subsequently targeted many major banks</p>
<p>The Europol <a href="https://www.europol.europa.eu/content/major-cybercrime-ring-dismantled-joint-investigation-team" target="_blank">statement</a> on the action is otherwise light on details, but says the group is suspected of using Zeus and SpyEye malware to steal at least EUR 2 million from banks and their customers.</p>


feed_id: http://krebsonsecurity.com/?p=31364
title: Crooks Use Hacked Routers to Aid Cyberheists
uri: Crooks-Use-Hacked-Routers-to-Aid-Cyberheists
url: http://krebsonsecurity.com/2015/06/crooks-use-hacked-routers-to-aid-cyberheists/
content:
<p>Cybercriminals have long relied on compromised Web sites to host malicious software for use in drive-by download attacks, but at least one crime gang is taking it a step further: New research shows that crooks spreading the <a href="http://www.emergingthreats.net/about-us/blog/dyre-upatre-constant-development" target="_blank">Dyre malware</a> for use in cyberheists are leveraging hacked wireless routers to deliver their password-stealing crimeware.</p>
<div id="attachment_31391" style="width: 245px" class="wp-caption alignright"><a href="media/75bb5eb6.ubiquity.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/ubiquity.png"><img class=" wp-image-31391" src="media/75bb5eb6.ubiquity.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/ubiquity.png" alt="Ubiquity Networks airRouter" width="235" height="236" /></a><p class="wp-caption-text">Ubiquity Networks airRouter</p></div>
<p><strong>Dyre</strong> (a.k.a. &#8220;Dyreza&#8221;) is generally installed by a downloader Trojan that is flagged by most tools under the name &#8220;<strong>Upatre</strong>.&#8221; The latter is most often delivered via malicious e-mails containing a link which directs unsuspecting users to servers hosting malicious javascript or a basic redirection to a malicious payload. If the user clicks the malicious link, it may serve a bogus file &#8212; such as an invoice or bank statement &#8212; that if extracted and opened reaches out to an Upatre control server to download Dyre.</p>
<p>According to a <a href="media/84642746.dyre-emerging-threat.pdf" data-original-source="http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/dyre-emerging-threat.pdf" target="_blank">recent in-depth report</a> from <strong>Symantec</strong>, Dyre is a highly developed piece of malware, capable of hijacking all three major web browsers and intercepting internet banking sessions in order to harvest the victim’s credentials and send them to the attackers. Dyre is often used to download additional malware on to the victim’s computer, and in many cases the victim machine is added to a botnet which is then used to send out thousands of spam emails in order to spread the threat.</p>
<p>Recently, researchers at the <strong>Fujitsu Security Operations Center</strong> in Warrington, UK began tracking Upatre being served from hundreds of compromised home routers &#8212; particularly routers powered by <a href="https://en.wikipedia.org/wiki/MikroTik" target="_blank">MikroTik</a> and <a href="https://wiki.ubnt.com/Main_Page" target="_blank">Ubiquiti&#8217;s AirOS</a>.</p>
<p>&#8220;We have seen literally hundreds of wireless access points, and routers connected in relation to this botnet, usually AirOS,&#8221; said <strong>Bryan Campbell</strong>, lead threat intelligence analyst at Fujitsu. &#8220;The consistency in which the botnet is communicating with compromised routers in relation to both distribution and communication leads us to believe known vulnerabilities are being exploited in the firmware which allows this to occur.&#8221;</p>
<p><a href="media/309b5f47.airos.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/airos.png"><img class="aligncenter size-medium wp-image-31390" src="media/66815291.airos-580x184.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/airos-580x184.png" alt="airos" width="580" height="184" /></a></p>
<p><span id="more-31364"></span></p>
<p>Campbell said it&#8217;s not clear why so many routers appear to be implicated in the botnet. Perhaps the attackers are merely exploiting routers with default credentials (e.g., &#8220;ubnt&#8221; for both username and password on most Ubiquiti AirOS routers). Fujitsu also found a disturbing number of the systems in the botnet had the port for <a href="https://en.wikipedia.org/wiki/Telnet" target="_blank">telnet connections</a> wide open.</p>
<p>In January 2015, KrebsOnSecurity <a href="http://krebsonsecurity.com/2015/01/lizard-stresser-runs-on-hacked-home-routers/" target="_blank">broke the news</a> that the botnet used to attack and briefly knock offline <strong>Microsoft&#8217;s Xbox</strong> and <strong>Sony Playstation&#8217;s</strong> networks relied entirely on hacked routers, all of which appeared to have been compromised remotely via telnet.</p>
<p>Whether you use a router from Ubiquiti or any other manufacturer, if you haven’t changed the default credentials on the device, it’s time to take care of that. If you don’t know whether you’ve changed the default administrative credentials for your wired or wireless router, you probably haven’t. Pop on over to <a title="http://www.routerpasswords.com" href="http://www.routerpasswords.com/" target="_blank">routerpasswords.com</a> and look up the make and model of your router.</p>
<p>To see whether your credentials are the default, you’ll need to open up a browser and enter the numeric address of your router’s administration page. For most routers, this will be 192.168.1.1 or 192.168.0.1. <a title="http://www.techspot.com/guides/287-default-router-ip-addresses/" href="http://www.techspot.com/guides/287-default-router-ip-addresses/" target="_blank">This page</a> lists the default internal address for most routers. If you have no luck there, <a title="http://portforward.com/networking/routers_ip_address.htm" href="http://portforward.com/networking/routers_ip_address.htm" target="_blank">here’s a decent tutorial</a> that should help most users find this address. And check out my <a title="http://krebsonsecurity.com/tools-for-a-safer-pc/" href="http://krebsonsecurity.com/tools-for-a-safer-pc/" target="_blank">Tools for a Safer PC primer</a> for more tips on how to beef up the security of your router and your Web browser.</p>


feed_id: http://krebsonsecurity.com/?p=31352
title: Banks: Card Breach at Trump Hotel Properties
uri: Banks-Card-Breach-at-Trump-Hotel-Properties
url: http://krebsonsecurity.com/2015/07/banks-card-breach-at-trump-hotel-properties/
content:
<p>The <strong>Trump Hotel Collection</strong>, a string of luxury hotel properties tied to business magnate and <a href="http://www.mediaite.com/tv/jon-stewart-thanks-trump-for-making-my-last-6-weeks-my-best-6-weeks/" target="_blank">now Republican presidential candidate</a> <a href="https://en.wikipedia.org/wiki/Donald_Trump" target="_blank">Donald Trump</a>, appears to be the latest victim of a credit card breach, according to data shared by several U.S.-based banks.</p>
<div id="attachment_31406" style="width: 261px" class="wp-caption alignright"><a href="media/44bac754.trumpchicago.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/trumpchicago.png"><img class=" wp-image-31406" src="media/44bac754.trumpchicago.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/trumpchicago.png" alt="Trump International Hotel and Tower in Chicago." width="251" height="337" /></a><p class="wp-caption-text">Trump International Hotel and Tower in Chicago.</p></div>
<p>Contacted regarding reports from sources at several banks who traced a pattern of fraudulent debit and credit card charges to accounts that had all been used at Trump hotels, the company declined multiple requests for comment.</p>
<p><strong>Update, 4:56 p.m. ET: The Trump Organization</strong> just acknowledged the issue with a brief statement from <strong>Eric Trump</strong>, executive vice president of development and acquisitions: &#8220;Like virtually every other company these days, we have been alerted to potential suspicious credit card activity and are in the midst of a thorough investigation to determine whether it involves any of our properties,&#8221; the statement reads. &#8220;We are committed to safeguarding all guests’ personal information and will continue to do so vigilantly.”</p>
<p><em>Original story:</em></p>
<p>But sources in the financial industry say they have little doubt that Trump properties in several U.S. locations &#8212; including Chicago, Honolulu, Las Vegas, Los Angeles, Miami, and New York &#8212; are dealing with a card breach that appears to extend back to at least February 2015.</p>
<p>If confirmed, the incident would be the latest in a long string of credit card breaches involving hotel brands, restaurants and retail establishments. In March, upscale hotel chain <strong>Mandarin Oriental</strong> <a href="http://krebsonsecurity.com/2015/03/credit-card-breach-at-mandarian-oriental/" target="_blank">disclosed a compromise</a>. The following month, hotel franchising firm <strong>White Lodging</strong> acknowledged that, <a href="http://krebsonsecurity.com/2015/04/white-lodging-confirms-second-breach/" target="_blank">for the second time in 12 months</a>, card processing systems at several of its locations were breached by hackers.</p>
<p>It is likely that the huge number of card breaches at U.S.-based organizations over the past year represents a response by fraudsters to upcoming changes in the United States designed to make credit and debit cards more difficult and expensive to counterfeit. Non-chip cards store cardholder data on a magnetic stripe, which can be trivially copied and re-encoded onto virtually anything else with a magnetic stripe.<span id="more-31352"></span></p>
<p><a href="media/2eabeeab.emvkey.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/10/emvkey.png"><img class="alignleft size-full wp-image-28544" src="media/2eabeeab.emvkey.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/10/emvkey.png" alt="emvkey" width="235" height="166" /></a>Magnetic-stripe based cards are the primary target for hackers who have been breaking into retailers like <a title="http://krebsonsecurity.com/?s=target+breach&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=target+breach&amp;x=0&amp;y=0" target="_blank">Target</a> and <a title="http://krebsonsecurity.com/?s=home+depot+breach&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=home+depot+breach&amp;x=0&amp;y=0" target="_blank">Home Depot</a> and installing malicious software on the cash registers: The data is quite valuable to crooks because it can be sold to thieves who encode the information onto new plastic and go shopping at big box stores for stuff they can easily resell for cash (think high-dollar gift cards and electronics).</p>
<p>In October 2015, merchants that have not yet installed card readers which accept more secure chip-based cards will <a href="http://blogs.wsj.com/corporate-intelligence/2014/02/06/october-2015-the-end-of-the-swipe-and-sign-credit-card/" target="_blank">assume responsibility</a> for the cost of fraud from counterfeit cards. While most experts believe it may be years after that deadline before most merchants have switched entirely to chip-based card readers (and many U.S. banks are only now thinking about issuing chip-based cards to customers) cyber thieves no doubt well understand they won&#8217;t have this enormously profitable cash cow around much longer, and they&#8217;re busy milking it for all it&#8217;s worth.</p>
<p>For more on chip cards and why most U.S. banks are moving to chip-and-signature over the more widely used chip-and-PIN approach, check out <a href="http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signature/" target="_blank">this story</a>.</p>


feed_id: http://krebsonsecurity.com/?p=31402
title: Don’t Be Fooled By Phony Online Reviews
uri: Don-t-Be-Fooled-By-Phony-Online-Reviews
url: http://krebsonsecurity.com/2015/07/dont-be-fooled-by-phony-online-reviews/
content:
<p>The Internet is a fantastic resource for researching the reputation of companies with which you may wish to do business. Unfortunately, this same ease-of-use can lull the unwary into falling for marketing scams originally perfected by spammers: Namely, fake reviews and dodgy search engine manipulation techniques that seek to drown out legitimate, negative reviews in a sea of glowing but fake endorsements.</p>
<div id="attachment_31442" style="width: 336px" class="wp-caption alignright"><a href="media/cb2c62df.fullservicevanlines.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/fullservicevanlines.png"><img class=" wp-image-31442" src="media/5e564f02.fullservicevanlines-580x358.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/fullservicevanlines-580x358.png" alt="The home page of Full Service Van Lines." width="326" height="201" /></a><p class="wp-caption-text">The home page of Full Service Van Lines.</p></div>
<p>Perhaps the most common example of this can be found among companies that offer moving and storage services, an industry that consistently ranks in the top 10 across the United States for consumer fraud complaints.</p>
<p>Trust your family heirlooms and other belongings to a moving company without scratching beneath the surface of that glowing review online and at best you could end up paying way more than the agreed-upon price once the company has all of your possessions loaded onto the truck. In most cases, the consumer horror stories about moves-gone-bad also include tales of massive damage to the customer&#8217;s stuff &#8212; <em>if indeed the customer&#8217;s stuff ever arrives</em>.</p>
<p>Even people who are steeped in the ways of the Interwebs can get bamboozled by slick search engine manipulation tricks. Last month I heard from <strong>David Matusiak</strong>, a longtime reader and information security professional who hired a Florida-based moving company that got five-star reviews from dozens of sites. Unfortunately for Matusiak, many of those &#8220;review&#8221; sites appear to have been <a href="http://krebsonsecurity.com/wp-content/uploads/2015/07/salesatrelocationdotlivedotcomwhois.txt" target="_blank">set up and maintained by the people behind the company he hired</a>.</p>
<p>Based in Morrisville, NC, Matusiak had just landed a job in California that wanted him to start right away. So after a couple of hours of reading reviews online for a reputable moving company, Matusiak settled on <strong>Full Service Van Lines</strong> based in Coconut Creek, Fla. Now, more than 30 days after his truckload of belongs left his home on the East Coast, Matusiak is still waiting for his stuff to arrive in California.</p>
<p><span style="text-decoration: underline;">HUGE RED FLAGS</span></p>
<p>Matusiak said he read page after page of glowing reviews about Full Service Van Lines. Little did he know, the same email address used to register <strong>fullservicevanlines.com</strong> was used to register many of those &#8220;review&#8221; Web sites, which naturally list Full Service at the top of their supposed consumer rankings.</p>
<p>Interestingly, if you conduct a simple Google search on Full Service Van Lines, you&#8217;ll notice the top review sites &#8212; <a href="https://www.google.com/search?q=%22MOVING+AND+STORAGE+ACCOUNTING+INC%22&amp;rlz=1C1CHFX_enUS568US568&amp;oq=%22MOVING+AND+STORAGE+ACCOUNTING+INC%22&amp;aqs=chrome..69i57j0.720j0j7&amp;sourceid=chrome&amp;es_sm=93&amp;ie=UTF-8" target="_blank">Google</a> and <a href="http://www.yelp.com/biz/full-service-van-lines-coconut-creek" target="_blank">Yelp</a> &#8212; have two types of reviews for this company: Very positive and extremely negative, and not much in between.<span id="more-31402"></span></p>
<p>In retrospect, Matusiak said, the stark disparity in consumer reviews about the company should have been one of many red flags. Another red flag was that the company gave him an estimate for his moving costs over the phone &#8212; and refused to send anyone to his home to more accurately and realistically price the move.</p>
<p>The lack of an in-home inspection by the potential moving company is one of the red flags listed at the <a href="http://www.fmcsa.dot.gov/protect-your-move/how-to/moving-fraud/red-flags" target="_blank">Protect Your Move site</a> maintained by the <strong>Federal Motor Carrier Safety Administration</strong> (FMCSA), the federal agency which oversees the moving industry in the United States.</p>
<p>According to Matusiak, Full Service Van Lines exhibited just about every other red flag listed by the FMCSA, including a requirement that some ($1,441.65) of the total moving estimate ($4,225.52) be paid up-front. The other red flag? When the movers arrived on Sunday, May 24, 2015 to load up his belongings, <em>they showed up in a rented Penske truck</em> &#8212; not a company-owned and marked fleet truck as displayed on the company&#8217;s <a href="http://www.fullservicevanlines.com" target="_blank">home page</a>.</p>
<p>Yet another red flag: As soon as the movers had all of his furniture and belongings loaded onto the truck, the foreman &#8212; a guy who Matusiak said had a thick Russian accent and offered his name only as &#8220;Serge&#8221; &#8212; said Matusiak&#8217;s stuff took up 375 more cubic feet than the estimate had stated, and that as a result the company would be charging him an additional $2,437!</p>
<p>&#8220;He said it had to be paid right now in cash or money order or they were going to start unpacking the truck,&#8221; Matusiak recalled. &#8220;Since this was on a Sunday afternoon, coming up with that kind of cash was pretty impossible, and I couldn&#8217;t risk taking all of this stuff off the truck and finding another moving company to get out to my new job in time.&#8221;</p>
<p>So, Matusiak said he told Serge to charge the overage to the credit card that Full Service Van Lines had used to fund his initial deposit. After a heated conversation with someone from Full Service, Serge told Matusiak he needed to take a picture of Matusiak&#8217;s credit card and driver&#8217;s license. That was the last time Matusiak saw Serge or any of his worldly possessions.</p>
<p>Matusiak said he arrived in southern California on May 28, thinking the moving van would be a few days behind. When the promised delivery date of June 1 came and went, Matusiak reached out to Full Service Van Lines to inquire about the status of the moving van. The manager at Full Service assured him his stuff was on its way, so Matusiak decided to stay in a hotel for a few days. On June 7, unable to get a straight answer from his contact at Full Service about the van&#8217;s location, Matusiak moved into his apartment, minus any furniture, clothes or bed.</p>
<p>Growing increasingly alarmed, the North Carolina native said he was able to convince a police officer in Coconut Creek, Fla. to visit the company&#8217;s offices there, but the officer ultimately came back and said it was clear that this was a contract dispute &#8212; not a criminal matter &#8212; and that Matusiak needed to take his claims to civil court.</p>
<p>&#8220;I didn&#8217;t get a straight answer out of them for nearly a month until I asked a Coconut Creek police officer to go visit them, and they finally told him that it had been sitting &#8216;in their warehouse in Virginia&#8217; since it was taken from my home on May 24th,&#8221; he told KrebsOnSecurity. &#8220;They promised to send photos of my items to prove that they still existed and had not been destroyed, stolen or sold. So far, they have yet to send me these pictures despite several requests.&#8221;</p>
<p>The week after that, Matusiak said, the company told him it couldn&#8217;t get in touch with the driver, and that they didn&#8217;t quite know exactly where the truck was.</p>
<p>&#8220;They said they thought the truck was somewhere near Texas, but that was pretty much when they stopped talking to me,&#8221; he said. &#8220;The whole thing has been a nightmare, and I&#8217;m hoping it can come to some resolution. I doubt most of my stuff will be in good condition should it ever be returned. And it would cost me tens of thousands of dollars to replace most of it, plus there are things that can never be replaced. Most of the work I&#8217;ve produced in the past 12 years existed on those computers.&#8221;</p>
<p><span style="text-decoration: underline;">A LONG, SPOTTY HISTORY</span></p>
<p>While the Internet can help companies hide a pattern of misdeeds or crooked practices, careful research into public documents about an organization&#8217;s corporate history and company ownership can often reveal quite a bit about this activity. And as it turns out, Full Service Van Lines is just the latest venture by a company that appears to have a history of ripping people off and disappearing with their stuff (the company has not yet responded to requests for comment).</p>
<p><strong>Update, July 7, 2015, 12:29 p.m., ET: </strong>I received a response from a <strong>Jason Stokes</strong> at Full Service Van Lines, who said Matusiak was one of a handful of customers who were inconvenienced by a unpredictable and sudden increase in demand for moving services at the height of the summer moving season. Stokes said Full Service was in the process of sending a truck to pick up Matusiak&#8217;s things from its warehouse in Virginia, although he noted that the truck first would need to be loaded with other customers&#8217; items and passed through either Florida or New York before heading to California. &#8220;This isn&#8217;t something that&#8217;s normal for us,&#8221; Stokes said of the delays. &#8220;We&#8217;re going to go above and beyond monetarily to make this right with our customers.&#8221;</p>
<p><em>Original story:</em></p>
<p>Search on &#8220;Full Service Van Lines&#8221; at the <a href="http://search.sunbiz.org/Inquiry/CorporationSearch/SearchResults?inquiryType=EntityName&amp;searchNameOrder=FULLSERVICEVANLINES&amp;searchTerm=full%20service%20van%20lines" target="_blank">corporation search page</a> of the Florida Department of State&#8217;s Web site turns up zero results. But a search for that company using <a href="http://www.sunbiz.org/ficinam.html" target="_blank">the &#8220;fictitious names&#8221; lookup</a> at the same site reveals that this company is registered to a firm in Pompano Beach, Fla. called <a href="http://www.sunbiz.org/scripts/ficidet.exe?action=DETREG&amp;docnum=G13000106529&amp;rdocnum=G13000106529" target="_blank">Moving and Storage Accounting</a>.</p>
<p>A search on Moving and Storage Accounting shows that the company is run by a <strong>Grace Metzger</strong> and a <strong>Maxx Socher</strong>. A simple Google search on this last individual leads to <a href="https://www.google.com/search?q=%22grace+metzger%22+coconut+creek&amp;rlz=1C1CHFX_enUS568US568&amp;oq=%22grace+metzger%22+coconut+creek&amp;aqs=chrome..69i57.9807j0j7&amp;sourceid=chrome&amp;es_sm=93&amp;ie=UTF-8#q=maxx+socher" target="_blank">several interesting results</a>, including <a href="http://www.ripoffreport.com/r/8261/pompano-beach-florida-33069/remax-van-lines-liars-brokersmaxx-sochers-new-company-same-scam-remax-vanlines-liars-1115168" target="_blank">a scathing Ripoff Report listing</a>, as well as several <a href="http://movingscambusters.blogspot.com/" target="_blank">blogs</a> documenting consumer experiences very similar to the nightmare that Matusiak has endured.</p>
<p>Among the search results for Socher is an <a href="http://www.nbcmiami.com/investigations/Headaches-and-Heartaches-for-Couple-That-Used-South-Florida-Moving-Company-244062381.html#comments" target="_blank">NBC Miami story from February 2014</a> that recounts the heartbreaking story of a Florida couple who trusted <strong>Ryder Moving and Storage</strong> &#8212; a <a href="http://search.sunbiz.org/Inquiry/CorporationSearch/SearchResultDetail?inquirytype=EntityName&amp;directionType=Initial&amp;searchNameOrder=STORAGEMOVINGSERVICES%20P110000585450&amp;aggregateId=domp-p11000058545-ee3b06f9-b48c-4aaa-9536-faf34b8e4bca&amp;searchTerm=STORAGE%20%26%20MOVING%20SERVICES%20INC&amp;listNameOrder=STORAGEMOVINGSERVICES%20P110000585450" target="_blank">moving company owned by Maxx Socher&#8217;s brother Joshua Socher and Josh&#8217;s wife Jodi</a> under the slightly modified company name <a href="http://www.sunbiz.org/scripts/ficidet.exe?action=DETREG&amp;docnum=G12000045665&amp;rdocnum=G12000045665" target="_blank">Storage &amp; Moving Services Inc.</a> in Pompano Beach, Fla &#8212; and ran into the same fate as Matusiak. That story notes that the Better Business Bureau got so many complaints that it awarded Ryder an &#8220;F&#8221; rating.</p>
<p>In addition, the FMCSA fined the company $50,000 for false and deceptive billing, among other violations. And as noted triumphantly by <a href="http://movingscambusters.blogspot.com/2014/04/pam-bondi-finally-does-her-job.html" target="_blank">Movingscambusters blog</a> &#8212; a site set up by another victim of Ryder who sought to expose the company&#8217;s practices &#8212; the Florida Attorney General is now suing the Sochers after receiving hundreds of consumer complaints about the company.</p>
<p>Public records searches also can yield revealing results. For example, searching the FMCSA&#8217;s database on &#8220;Full Service Van Lines,&#8221; produces two results, both for companies in Coconut Beach, Fla. The first <strong>Department of Transportation</strong> (DOT) license number listed <a href="http://ai.fmcsa.dot.gov/hhg/SearchDetails.asp?ads=&amp;id=30718949&amp;id2=33393071&amp;f=search%3D3%26CNS%3D1%26CN%3Dfull%2Bservice%2Bvan%2Blines%26DOT%3D%26MC%3D%26Submit%3DSearch" target="_blank">is no longer active</a>, apparently because the operator of that license incurred a high number of consumer complaints and safety inspection violations.</p>
<p>The <a href="http://ai.fmcsa.dot.gov/hhg/SearchDetails.asp?ads=&amp;id=30544185&amp;id2=33118087&amp;f=search%3D3%26CNS%3D1%26CN%3Dfull%2Bservice%2Bvan%2Blines%26DOT%3D%26MC%3D%26Submit%3DSearch" target="_blank">second DOT license listed</a> &#8212; issued to a company by the same name at a different suite number &#8212; is active but also includes a number of consumer complaints about final charges and lost or damaged shipments. Oddly enough given this company&#8217;s history, the active license for Full Service Van Lines (which is a DBA of &#8220;Dr. Schlepper Inc.&#8221;), has yet to receive an inspection from the FMCSA.</p>
<p>Finally, while the Better Business Bureau is hardly the arbiter of which companies are legitimate and which are potentially crooked, the BBB&#8217;s <a href="http://www.bbb.org/south-east-florida/business-reviews/moving-and-storage-company/full-service-van-lines-in-coconut-creek-fl-90106213/complaints" target="_blank">consumer complaint listing on Full Service Van Lines</a> fairly well tracks Matusiak&#8217;s awful experience.</p>
<p>Matusiak says he&#8217;s in the process of documenting his case and sending the supporting evidence to regulators and law enforcement in Florida and North Carolina.</p>
<p>&#8220;I&#8217;m trying to piece this all together and contact relevant authorities,&#8221; he said. &#8220;It is complicated by the nature of being in multiple states. Each office I contact merely asks me to get in touch with another state. It looks like I&#8217;m at the will of this company and can only wait. Without broader attention I doubt they will do much and they may close this company before I can take any legal action.&#8221;</p>
<p>Matusiak told me that in hindsight, he definitely should have spent more time investigating the history of Full Service Van Lines and its owners. But he said he doubts most consumers would do that before-the-fact.</p>
<p>&#8220;I certainly didn’t think that all of the review sites would be run by them,&#8221; he said. &#8220;But also, I don&#8217;t think the average consumer could or should have to do all this research on federal and state filings just to find out if a company is legitimate.&#8221;</p>
<p>Whether consumers should have to do this or not is debatable, but it seems fairly clear that there is simply far too much money to be made in moving scams and far too few consequences for people engaged in this type of fraud.</p>
<p>For example, several states have begun <a href="http://searchenginewatch.com/sew/news/2296366/fake-online-reviews-cost-19-companies-usd350-000" target="_blank">cracking down on &#8220;reputation management&#8221; and &#8220;search engine optimization&#8221; (SEO) companies</a> that engage in writing or purchasing fake reviews, but the fines being enforced for violations are likely a fraction of the revenues that companies gain by engaging in this deceptive practice. It&#8217;s worth noting that Full Service Van Lines&#8217; home page says the site was created by a company called <strong>Affordable SEO Miami</strong>, a reputation management firm that <a href="http://www.affordableseomiami.com/contact-us.php" target="_blank">lists as its address the same location</a> as Full Service Van Line&#8217;s <a href="http://ai.fmcsa.dot.gov/hhg/SearchDetails.asp?ads=&amp;id=30544185&amp;id2=33118087&amp;f=search%3D3%26CNS%3D1%26CN%3Dfull%2Bservice%2Bvan%2Blines%26DOT%3D%26MC%3D%26Submit%3DSearch" target="_blank">license with the Department of Transportation</a>.</p>
<p>I hope it&#8217;s clear that consumers investing in high-dollar services would be wise to spend some time using the resources available to look up public records on companies before doing business with them. True, it is easy even for computer-savvy people to get snookered by fake reviews and search engine manipulation tricks, but public records can be powerful tools in the hands of the wary consumer. <a href="https://en.wikipedia.org/wiki/Caveat_emptor" target="_blank">Caveat emptor</a>!</p>


feed_id: http://krebsonsecurity.com/?p=31458
title: Adobe to Patch Hacking Team’s Flash Zero-Day
uri: Adobe-to-Patch-Hacking-Team-s-Flash-Zero-Day
url: http://krebsonsecurity.com/2015/07/adobe-to-patch-hacking-teams-flash-zero-day/
content:
<p><strong>Adobe Systems Inc.</strong> says its plans to issue a patch on Wednesday to fix a zero-day vulnerability in its <strong>Flash Player</strong> software that is reportedly being exploited in active attacks. The flaw was disclosed publicly over the weekend after <a href="http://www.csoonline.com/article/2944333/data-breach/hacking-team-responds-to-data-breach-issues-public-threats-and-denials.html" target="_blank">hackers broke into and posted online</a> hundreds of gigabytes of data from <strong>Hacking Team</strong>, a controversial Italian company that&#8217;s long been accused of helping repressive regimes spy on dissident groups.</p>
<div id="attachment_31459" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/43e87b55.HT-exploit.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/HT-exploit.png"><img class="size-medium wp-image-31459" src="media/9193c12e.HT-exploit-580x430.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/HT-exploit-580x430.png" alt="A knowledge base file stolen from Hacking Team explaining how to use the company's zero-day Flash exploit." width="580" height="430" /></a><p class="wp-caption-text">A knowledge base file stolen from Hacking Team explaining how to use a Flash exploit developed by the company.</p></div>
<p>In an advisory published today, Adobe said &#8220;a critical vulnerability (CVE-2015-5119) has been identified in <em>Adobe Flash Player 18.0.0.194</em> and earlier versions for Windows, Macintosh and Linux. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system.&#8221;</p>
<p><strong>Update, July 8, 12:13 p.m. ET: </strong>The patch is now available in Flash Player <em>18.0.0.203</em> for Windows and Mac systems. See <a href="https://helpx.adobe.com/security/products/flash-player/apsb15-16.html" target="_blank">this advisory</a> for more information and for links to downloads.</p>
<p><em>Original story:</em></p>
<p>Several reports on Twitter suggested the exploit could be used to bypass <strong>Google Chrome</strong>&#8216;s <a href="http://krebsonsecurity.com/2012/02/forcing-flash-to-play-in-the-sandbox/" target="_blank">protective &#8220;sandbox&#8221; technology</a>, a security feature that forces the program to run in a heightened security mode designed to block attacks that target vulnerabilities in Flash. A spokesperson for Google confirmed that attackers could evade the Chrome sandbox by using the Flash exploit in tandem with another <a href="https://twitter.com/pwnallthethings/status/618333922200551424" target="_blank">Windows vulnerability</a> that appears to be unpatched at the moment. Google also says its already in the process of pushing the Flash fix out to Chrome users.</p>
<p>The Flash flaw was uncovered after Hacking Team&#8217;s proprietary information was posted online by hacktivists seeking to disprove the company&#8217;s <a href="http://mashable.com/2014/02/23/hacking-team-spyware-governments/" target="_blank">claims</a> that it does not work with repressive regimes (the leaked data suggests that Hacking Team has contracted to develop exploits for a variety of countries, including Egypt, Lebanon, Ethiopia, Sudan and Thailand). Included in the cache are several exploits for unpatched flaws, including apparently a Windows vulnerability.<span id="more-31458"></span></p>
<p>According to new research from security firm <strong>Trend Micro</strong>, there is <a href="http://blog.trendmicro.com/trendlabs-security-intelligence/unpatched-flash-player-flaws-more-pocs-found-in-hacking-team-leak/" target="_blank">evidence</a> that the Flash bug is being exploited in active attacks.</p>
<p>&#8220;A separate attack against one of these vulnerabilities shows that not sharing the discovery of vulnerabilities with the vendor or broader security community leaves everyone at risk,&#8221; wrote <strong>Christopher Budd</strong>, global threat communications manager at Trend. &#8220;This latest attack is yet another demonstration that Adobe is a prime target for exploit across commercial and consumer IT systems.”</p>
<p>There is no question that Adobe Flash Player is a major target of attackers. This Wednesday will mark the seventh time in as many months that Adobe has issued an emergency update to fix a zero-day flaw in Flash Player (the last one was on <a href="http://krebsonsecurity.com/2015/06/emergency-patch-for-adobe-flash-zero-day/" target="_blank">June 23</a>).</p>
<p>Perhaps a more sane approach to incessantly patching Flash Player is to remove it altogether. Late last month, I blogged about my experience doing just that, and found I didn&#8217;t miss the program much at all. In any case, I&#8217;ll update this post once Adobe has issued an official fix.</p>


feed_id: http://krebsonsecurity.com/?p=31471
title: Finnish Decision is Win for Internet Trolls
uri: Finnish-Decision-is-Win-for-Internet-Trolls
url: http://krebsonsecurity.com/2015/07/finnish-decision-is-win-for-internet-trolls/
content:
<p>In a win for <a href="https://en.wikipedia.org/wiki/Internet_troll" target="_blank">Internet trolls</a> and teenage cybercriminals everywhere, a Finnish court has decided not to incarcerate a 17-year-old found guilty of more than 50,000 cybercrimes, including data breaches, payment fraud, operating a huge botnet and calling in bomb threats, among other violations.</p>
<div id="attachment_29338" style="width: 295px" class="wp-caption alignright"><a href="media/a9ae7a8d.ryan-k.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/ryan-k.png"><img class="size-medium wp-image-29338" src="media/8fa28550.ryan-k-285x270.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/ryan-k-285x270.png" alt="Julius &quot;Ryan&quot; Kivimaki." width="285" height="270" /></a><p class="wp-caption-text">Julius &#8220;Ryan&#8221; Kivimaki.</p></div>
<p>As the Finnish daily <em>Helsingin Sanomat</em> <a href="http://www.hs.fi/kotimaa/a1436234526466?jako=690ff31e50d3e4753ccd2daca0d392d4&amp;ref=tw-share" target="_blank">reports</a>, <strong>Julius Kivimäki</strong> &#8212; a.k.a. &#8220;Ryan&#8221; and &#8220;Zeekill&#8221; &#8212; was given a two-year suspended sentence and ordered to forfeit EUR 6,558.</p>
<p>Kivimaki vaulted into the media spotlight late last year when he <a href="http://krebsonsecurity.com/2014/12/whos-in-the-lizard-squad/" target="_blank">claimed affiliation</a> with the <strong>Lizard Squad</strong>, a group of young hooligans who knocked offline the gaming networks of <strong>Microsoft</strong> and <strong>Sony</strong> for most of Christmas Day.</p>
<p>According to <a href="http://www.bbc.co.uk/news/technology-33442419" target="_blank">the BBC</a>, evidence presented at Kivimaki&#8217;s trial showed that he compromised more than 50,000 computer servers by <a href="http://krebsonsecurity.com/?s=cold+fusion&amp;x=0&amp;y=0" target="_blank">exploiting vulnerabilities in Adobe&#8217;s Cold Fusion web application software</a>. Prosecutors also said Kivimaki used stolen credit cards to buy luxury goods and shop vouchers, and participated in a money laundering scheme that he used to fund a trip to Mexico.</p>
<p>Kivimaki allegedly also was involved in calling in multiple fake bomb threats and &#8220;swatting&#8221; incident &#8212; reporting fake hostage situations at an address to prompt a heavily armed police response to that location. <em>DailyDot</em> <a href="http://www.dailydot.com/crime/lizard-squad-indicted-julius-kivimaki/?tw=dd" target="_blank">quotes</a> <strong>Blair Strater</strong>, a victim of Kivimaki&#8217;s swatting and harassment, who expressed disgust at the Finnish ruling.</p>
<p>Speaking with KrebsOnSecurity, Strater called Kivimaki &#8220;a dangerous sociopath&#8221; who belongs behind bars.</p>
<p>Although it did not factor into his trial, sources close to the Lizard Squad investigation say Kivimaki also was responsible for making <a href="http://www.forbes.com/sites/insertcoin/2014/08/24/sony-online-entertainment-presidents-flight-diverted-by-psn-hackers-bomb-threat/" target="_blank">an August 2014 bomb threat</a> against former <strong>Sony Online Entertainment President John Smedley</strong> that grounded an American Airlines plane. That incident was widely reported to have started with a tweet from the Lizard Squad, but Smedley and others say it started with a call from Kivimaki.</p>
<p>In a phone interview, Smedley said he was disappointed that the judicial system in Finland didn&#8217;t do more.</p>
<p>&#8220;I personally got to listen to a recording of him calling in to American Airlines, and I know it was him because I talked to him myself,&#8221; Smedley said. &#8220;He&#8217;s done all kinds of bad stuff to me, including putting all of my information out on the Internet. He even attempted to use my credit numerous times. The harassment literally just did not stop.&#8221;</p>
<p>In an online interview with KrebsOnSecurity, Kivimaki denied involvement with the American Airlines incident, and said he was not surprised by the leniency shown by the court in his trial.</p>
<p>&#8220;During the trial it became apparent that nobody suffered significant (if any) damages because of the alleged hacks,&#8221; he said.</p>
<p>The danger in a decision such as this is that it emboldens young malicious hackers by reinforcing the <a href="media/bf87ca06.You-can-go-to-jail-for-that-Only-if-youre-over-18.mp3" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/You-can-go-to-jail-for-that-Only-if-youre-over-18.mp3" target="_blank">already popular notion</a> that there are no consequences for cybercrimes committed by individuals under the age of 18.</p>
<p>Case in point: Kivimaki is now crowing about the sentence; He&#8217;s changed the description on <a href="https://twitter.com/What_Security/status/618768660933537792" target="_blank">his Twitter profile</a> to &#8220;Untouchable hacker god.&#8221; The Twitter account for the Lizard Squad tweeted the news of Kivimaki&#8217;s non-sentencing triumphantly: &#8220;All the people that said we would rot in prison don&#8217;t want to comprehend what we&#8217;ve been saying since the beginning, we have free passes.&#8221;<span id="more-31471"></span></p>
<p>It is clear that the Finnish legal system, like that of the United States, simply does not know what to do with minors who are guilty of severe cybercrimes.  The FBI has for several years now been investigating several of Kivimaki&#8217;s contemporaries, young men under the age of 18 who are responsible for a similarly long list of cybercrimes &#8212; including <a href="http://krebsonsecurity.com/2014/05/blackshades-trojan-users-had-it-coming/" target="_blank">credit card fraud</a>, massively compromising <a href="http://krebsonsecurity.com/2014/03/the-long-tail-of-coldfusion-fail/" target="_blank">a long list of Web sites</a> and organizations running Cold Fusion software, as well as <a href="http://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank">swatting my home in March 2013</a>. Sadly, to this day those individuals also remain free and relatively untouched by the federal system.</p>
<p><strong>Lance James</strong>, former head of cyber intelligence for <strong>Deloitte</strong> and a security researcher who&#8217;s followed the case closely, said he was disappointed at the court&#8217;s decision given the gravity and extensiveness of the crimes.</p>
<p><span class="pullquote pqleft">&#8220;We&#8217;re talking about the Internet equivalent of violent crimes and assault,&#8221; James said. &#8220;This is serious stuff.&#8221;</span></p>
<p>Kivimaki said he doesn&#8217;t agree with the characterization of swatting as a violent crime.</p>
<p>&#8220;I don&#8217;t see how a reasonable person could possibly compare cybercrime with violent crimes,&#8221; he said. &#8220;There&#8217;s a pretty clear distinction here. As far as I&#8217;m aware nobody has ever died in such an incident. Nor have I heard of anyone suffering bodily injury.&#8221;</p>
<p>As serious as Kivimaki&#8217;s crimes may be, kids like him need to be monitored, mentored, and molded &#8212; not jailed, says James.</p>
<p>&#8220;Studying his past, he&#8217;s extremely smart, but he&#8217;s troubled, and definitely needs a better direction,&#8221; James said. &#8220;A lot of these kids have trouble in the home, such as sibling or parental abuse and abandonment. These teenagers, they aren&#8217;t evil, they are troubled. There needs to be a diversion program &#8212; the same way they treat at-risk teenagers and divert them away from gang activity &#8212; that is designed to help them get on a better path.&#8221;</p>
<p>But Kivimaki may not get that chance. According to Smedley, there are more than a dozen criminal cases pending against the Finnish youth.</p>
<p>&#8220;Now that he&#8217;s a convicted felon, he can&#8217;t claim first time status anymore,&#8221; Smedley said. &#8220;There&#8217;s no question he&#8217;s going to get his.&#8221;</p>
<p><strong>Update, 3:30 p.m. ET:</strong> Added comments from Smedley.</p>


feed_id: http://krebsonsecurity.com/?p=31499
title: Credit Card Breach at a Zoo Near You
uri: Credit-Card-Breach-at-a-Zoo-Near-You
url: http://krebsonsecurity.com/2015/07/credit-card-breach-at-a-zoo-near-you/
content:
<p><strong>Service Systems Associates</strong>, a company that serves gift shops and eateries at zoos and cultural centers across the United States, has acknowledged a breach of its credit and debit card processing systems.</p>
<p><a href="media/06bc0c9d.ssa.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/ssa.png"><img class="alignright  wp-image-31510" src="media/d831fbbc.ssa-580x449.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/ssa-580x449.png" alt="ssa" width="338" height="262" /></a>Several banking industry sources told KrebsOnSecurity they have detected a pattern of fraud on cards that were all used at zoo gift shops operated by Denver-basd SSA<strong>.</strong> On Wednesday morning, <em>CBS Detroit</em> moved a <a href="http://detroit.cbslocal.com/2015/07/08/credit-card-data-breach-affects-gift-shops-at-detroit-zoo/" target="_blank">story</a> citing zoo officials there saying the SSA was investigating a breach involving point-of-sale malware.</p>
<p>Contacted about the findings, SSA confirmed that it was the victim of a data security breach.</p>
<p>&#8220;The violation occurred in the point of sale systems located in the gift shops of several of our clients,&#8221; the company said in a written statement. &#8220;This means that if a guest used a credit or debit card in the gift shop at one of our partner facilities between March 23 and June 25, 2015, the information on that card may have been compromised.&#8221;</p>
<p>SSA said it has been working with law enforcement officials and a third-party forensic investigator, <strong>Sikich</strong>, to investigate the breach.</p>
<p>&#8220;Though the investigation into this attack continues, the malware that caused the breach was identified and removed,&#8221; the statement continued. &#8220;All visitors should feel confident using credit or debit cards anywhere in these facilities.&#8221;<span id="more-31499"></span></p>
<p>The company declined to name the individual locations that were impacted by the breach, but financial industry sources say the breach likely involves SSA concession and gift shops at zoo locations in at least two dozen cities, including:</p>
<p>Birmingham, Ala.<br />
Tucson, Ariz.<br />
San Francisco, Calif.<br />
Fresno, Calif.<br />
Sacramento, Calif.<br />
Colorado Springs, Colo.<br />
Palm Desert, Calif.<br />
Miami, Fla.<br />
Honolulu, HI<br />
Boise, Id.<br />
Fort Wayne, Ind.<br />
Louisville, Ky.<br />
Baltimore, Md.<br />
Battle Creek, Mich.<br />
Apple Valley, Minn.<br />
Cincinnati, Ohio<br />
Tulsa, Okla.,<br />
Pittsburgh, Penn.<br />
Columbia, SC<br />
Dallas, Texas<br />
El Paso, Texas<br />
Houston, Texas<br />
Nashville, Tenn.<br />
Salt Lake City, Utah</p>
<p>Point-of-sale based malware has driven most of the credit card breaches over the past two years, including intrusions at Target and Home Depot, as well as breaches at a slew of point-of-sale vendors. The malware usually is installed via hacked remote administration tools. Once the attackers have their malware loaded onto the point-of-sale devices, they can remotely capture data from each card swiped at that cash register.</p>
<p>Thieves can then sell the data to crooks who specialize in encoding the stolen data onto any card with a magnetic stripe, and using the cards to buy gift cards and high-priced goods from big-box stores like Target and Best Buy.</p>
<p>In October 2015, merchants that have not yet installed card readers which accept more secure chip-based cards will <a href="http://blogs.wsj.com/corporate-intelligence/2014/02/06/october-2015-the-end-of-the-swipe-and-sign-credit-card/" target="_blank" rel="noreferrer">assume responsibility</a> for the cost of fraud from counterfeit cards. While most experts believe it may be years after that deadline before most merchants have switched entirely to chip-based card readers cyber thieves no doubt well understand they won’t have this enormously profitable cash cow around much longer, and they’re busy milking it for all it’s worth.</p>


feed_id: http://krebsonsecurity.com/?p=31515
title: Cybercrime Kingpin Pleads Guilty
uri: Cybercrime-Kingpin-Pleads-Guilty
url: http://krebsonsecurity.com/2015/07/cybercrime-kingpin-pleads-guilty/
content:
<p>An Estonian man who ran an organized cybercrime ring that infected more than four million PCs in over 100 countries with moneymaking malware has pleaded guilty in New York to wire fraud and computer intrusion charges.</p>
<p><strong>Vladimir Tsastsin</strong>, 35, ran an online Web hosting and advertising empire in Estonia called <strong>Rove Digital</strong>. From 2007 to 2011, Tsastin and six other men cooked up and executed a scheme to deploy malware that altered the domain name system (DNS) settings on infected computers (there were versions of the malware for both Mac and Windows systems).</p>
<div id="attachment_31517" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/03632bed.rovedigital.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/rovedigital.png"><img class="size-medium wp-image-31517" src="media/5c5b6967.rovedigital-580x220.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/rovedigital-580x220.png" alt="Tsastsin. left, along with other Rove Digital men, at a hearing in Tallinn. Image: Postimees.ee." width="580" height="220" /></a><p class="wp-caption-text">Tsastsin. right, along with other Rove Digital men, at a 2013 hearing in Tallinn. Image: Postimees.ee.</p></div>
<p>Known as <strong>DNSChanger</strong>, the malware replaced legitimate ads in victim Web browsers with ads that rewarded Rove Digital, and hijacked referral commissions from other advertisers when victims clicked on ads. The malware also prevented infected systems from downloading software updates and visiting many security Web sites.</p>
<p>Following the takedown of the crime gang, the U.S. government assumed control over the DNS servers that were used by the malware, and spearheaded <a href="http://krebsonsecurity.com/?s=dnschanger&amp;x=0&amp;y=0" target="_blank">a global effort to clean up infected systems</a>. U.S. authorities allege that the men made more than $14 million through click hijacking and advertisement replacement fraud.</p>
<p>Tsastsin and his accomplices were arrested in 2011 by Estonian authorities for their role in the scheme, but ultimately the men were acquitted. In June 2014, however, the Estonian Supreme Court <a href="http://news.postimees.ee/3233641/estonian-supreme-court-finds-tsastsin-fellow-defendants-in-ghost-click-case-guilty" target="_blank">revoked that decision</a>, finding them guilty of money laundering. Tsastsin in particular was also found guilty of leading a criminal gang. All but one of the seven were later extradited to the United States, and have already pleaded guilty and/or been imprisoned.</p>
<p>I first encountered Tsastsin in 2008, after research and collaboration with numerous security firms and researchers led to a <em>Washington Post</em> <a href="http://voices.washingtonpost.com/securityfix/2008/09/estdomains.html" target="_blank">series</a> detailing how Rove Digital and its hosting business &#8212; a company called <strong>EstDomains</strong> &#8212; were hosting huge numbers of Web sites that foisted malicious software. His response at the time to assertions that he was somehow tied to Russian organized cybercrime: &#8220;Rubbish!&#8221; <span id="more-31515"></span></p>
<p><a href="media/640e2c2d.tsastsin-thumb-228x161.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2009/12/tsastsin-thumb-228x161.jpg"><img class="alignleft size-full wp-image-22" src="media/640e2c2d.tsastsin-thumb-228x161.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2009/12/tsastsin-thumb-228x161.jpg" alt="tsastsin-thumb-228x161" width="228" height="161" /></a>&#8220;Our projects are totally legitimate and they are not involved in any shady activities,&#8221; Tsastsin told <em>The Post</em> in Sept. 2008.</p>
<p>One of those stories, <a href="http://voices.washingtonpost.com/securityfix/2008/09/estdomains_a_sordid_history_an.html" target="_blank">EstDomains: A Sordid History and A Storied CEO</a>, detailed Tsastsin&#8217;s prior convictions on money laundering and credit card fraud charges in Estonia. That revelation prompted the <a href="https://en.wikipedia.org/wiki/ICANN" target="_blank">Internet Corporation for Assigned Names and Numbers</a> (ICANN), a non-profit that oversees the domain name industry, to <a href="https://www.google.com/url?sa=t&amp;rct=j&amp;q=&amp;esrc=s&amp;source=web&amp;cd=3&amp;cad=rja&amp;uact=8&amp;ved=0CC0QFjAC&amp;url=http%3A%2F%2Fvoices.washingtonpost.com%2Fsecurityfix%2F2008%2F10%2Ficann_de-accredits_estdomains.html&amp;ei=3tWfVfnBJ4a0ggT8kICwCg&amp;usg=AFQjCNEyhAQRCIluO0wSPfL6qHQjXJV-8Q&amp;sig2=BMu1OzRm92jo3QBEvOBbgg&amp;bvm=bv.96952980,d.eXY" target="_blank">revoke EstDomains&#8217;s authority as a domain registrar</a>.</p>
<p>Interestingly, Tsastsin and Rove Digital were <a href="http://krebsonsecurity.com/2011/11/rove-digital-was-core-chronopay-shareholder/" target="_blank">among the earliest investors</a> in <strong>ChronoPay</strong>, a Russian payment processing firm <a href="http://krebsonsecurity.com/?s=vrublevsky&amp;x=0&amp;y=0" target="_blank">whose CEO</a> was another cybercrime kingpin and one of two core subjects of my book, <em><a href="http://krebsonsecurity.com/2014/07/pre-order-your-copy-of-spam-nation-now/" target="_blank">Spam Nation</a></em>.</p>
<p>Tsastsin faces a maximum sentence of 20 years in prison on the wire fraud conspiracy count and five years in prison on the computer intrusion conspiracy count. He is currently slated to be sentenced October 14, 2015. The media release from the <strong>U.S. Attorney&#8217;s Office for the Southern District of New York</strong> is <a href="http://www.justice.gov/usao-sdny/pr/estonian-national-pleads-guilty-manhattan-federal-court-charges-arising-massive-cyber" target="_blank">here</a>.</p>
<div id="attachment_15697" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/a54387cd.dnscchrono.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2012/06/dnscchrono.png"><img class="size-large wp-image-15697" src="media/c4f6c937.dnscchrono-600x426.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2012/06/dnscchrono-600x426.png" alt="DNChanger chronology. Source: InternetIdentity" width="600" height="426" /></a><p class="wp-caption-text">DNChanger chronology. Source: InternetIdentity</p></div>
<p><strong>Update, July 12, 8:56 p.m. ET:</strong> Corrected caption.</p>


feed_id: http://krebsonsecurity.com/?p=31524
title: Adobe To Fix Another Hacking Team Zero-Day
uri: Adobe-To-Fix-Another-Hacking-Team-Zero-Day
url: http://krebsonsecurity.com/2015/07/adobe-to-fix-another-hacking-team-zero-day/
content:
<p>For the second time in a week, <strong>Adobe Systems Inc.</strong> says it plans fix a zero-day vulnerability in its <strong>Flash Player</strong> software that came to light after hackers <a href="http://www.csoonline.com/article/2944333/data-breach/hacking-team-responds-to-data-breach-issues-public-threats-and-denials.html" target="_blank">broke into and posted online</a> hundreds of gigabytes of data from <strong>Hacking Team</strong>, a controversial Italian company that’s long been accused of helping repressive regimes spy on dissident groups.</p>
<p><a href="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png"><img class="alignright  wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="186" height="159" /></a>In <a href="https://helpx.adobe.com/security/products/flash-player/apsa15-04.html" target="_blank">an advisory</a> published late Friday evening, Adobe said it plans to issue another Flash patch the week of July 13, 2015. &#8220;This vulnerability was reported to us following further investigation of the data published after the Hacking Team data breach,&#8221; the advisory notes.</p>
<p>Adobe said the flaw is present in the latest version of Flash for <strong>Windows</strong>, <strong>Mac</strong> and <strong>Linux</strong> systems, and that code showing attackers how to exploit this flaw is already available online.</p>
<p>There is every reason to believe this exploit will soon be folded into exploit kits, crimeware used to foist drive-by downloads when unsuspecting visitors browse to a hacked or booby-trapped site. On Wednesday, Adobe <a href="http://krebsonsecurity.com/2015/07/adobe-to-patch-hacking-teams-flash-zero-day/" target="_blank">patched a different vulnerability</a> in Flash that was exposed in the Hacking Team breach, but not before code designed to attack the flaw was <a href="http://arstechnica.com/security/2015/07/adobe-flash-exploit-that-was-leaked-by-hacking-team-goes-wild-patch-now/" target="_blank">folded into the Angler and Nuclear exploit kits</a>.</p>
<p>If you were on the fence about removing or disabling Flash altogether, now would be a great time to reconsider. I recently <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">blogged about my experience doing just that</a>, and found I didn’t miss the program much at all after a month without it.</p>


feed_id: http://krebsonsecurity.com/?p=31533
title: Hacking Team Used Spammer Tricks to Resurrect Spy Network
uri: Hacking-Team-Used-Spammer-Tricks-to-Resurrect-Spy-Network
url: http://krebsonsecurity.com/2015/07/hacking-team-used-spammer-tricks-to-resurrect-spy-network/
content:
<p>Last week, hacktivists posted online 400 GB worth of internal emails, documents and other data stolen from <strong>Hacking Team</strong>, an Italian security firm that has earned the ire of privacy and civil liberties groups for selling spy software to governments worldwide. New analysis of the leaked Hacking Team emails suggests that in 2013 the company used techniques perfected by spammers to hijack Internet address space from a spammer-friendly Internet service provider in a bid to regain control over a spy network it apparently had set up for the <strong>Italian National Military Police</strong>.</p>
<p><a href="media/ae72c3ba.hackingteam.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/hackingteam.png"><img class="aligncenter size-full wp-image-31538" src="media/ae72c3ba.hackingteam.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/hackingteam.png" alt="hackingteam" width="536" height="314" /></a></p>
<p>Hacking Team is in the business of selling exploits that allow clients to secretly deploy spyware on targeted systems. In just the past week since the Hacking Team data was leaked, for example, Adobe has fixed <a href="http://krebsonsecurity.com/2015/07/adobe-to-fix-another-hacking-team-zero-day/" target="_blank">two previously undocumented zero-day vulnerabilities</a> in its <strong>Flash Player</strong> software that Hacking Team had sold to clients as spyware delivery mechanisms.</p>
<p>The spyware deployed by Hacking Team&#8217;s exploits are essentially remote-access Trojan horse programs designed to hoover up stored data, recorded communications, keystrokes, etc. from infected devices, giving the malware&#8217;s operator full control over victim machines.</p>
<p>Systems infested with Hacking Team&#8217;s malware are configured to periodically check for new instructions or updates at a server controlled by Hacking Team and/or its clients. This type of setup is very similar to the way spammers and cybercriminals design &#8220;botnets,&#8221; huge collections of hacked PCs that are harvested for valuable data and used for a variety of nefarious purposes.</p>
<p>No surprise, then, that Hacking Team placed its control servers in this case at an ISP that was heavily favored by spammers. Leaked Hacking Team emails show that in 2013, the company set up a malware control server for the <strong>Special Operations Group</strong> of the Italian National Military Police &#8212; also known as the &#8220;Carabinieri&#8221; &#8212; an entity focused on investigating organized crime and terrorism. One or both of these organizations chose to position that control at <strong>Santrex</strong>, a notorious Web hosting provider that at the time served as a virtual haven for spammers and malicious software downloads.</p>
<p>But that decision backfired. <a href="http://krebsonsecurity.com/2013/10/bulletproof-hoster-santrex-calls-it-quits/" target="_blank">As I documented in October 2013</a>, Santrex unexpectedly shut down all of its servers, following a series of internal network issues and extensive downtime. Santrex made that decision after several months of incessant attacks, hacks and equipment failures at its facilities caused massive and costly problems for the ISP and its customers. The company&#8217;s connectivity problems essentially made it impossible for either Hacking Team or the Carabinieri to maintain control over the machines infected with the spyware.</p>
<p>According to <a href="https://labs.opendns.com/2015/07/12/how-hacking-team-helped-italian-special-operations-group-with-bgp-routing-hijack/" target="_blank">research published Sunday</a> by <strong>OpenDNS Security Labs</strong>, around that same time the Carabinieri and Hacking Team cooked up a plan to regain control over the Internet addresses abandoned by Santrex. The plan centered around a traffic redirection technique known as &#8220;BGP hijacking,&#8221; which involves one ISP fraudulently &#8220;announcing&#8221; to the rest of the world&#8217;s ISPs that it is in fact the rightful custodian of a dormant range of Internet addresses that it doesn&#8217;t actually have the right to control.</p>
<p>IP address hijacking is hardly a new phenomenon. Spammers sometimes hijack Internet address ranges that go unused for periods of time (see <a href="http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/" target="_blank">this story from 2014</a> and <a href="http://voices.washingtonpost.com/securityfix/2008/04/a_case_of_network_identity_the_1.html" target="_blank">this piece I wrote in 2008 for The Washington Post</a> for examples of spammers hijacking Internet space). Dormant or “unannounced” address ranges are ripe for abuse partly because of the way the global routing system works: Miscreants can “announce” to the rest of the Internet that their hosting facilities are the authorized location for given Internet addresses. If nothing or nobody objects to the change, the Internet address ranges fall into the hands of the hijacker.<span id="more-31533"></span></p>
<p>Apparently nobody detected the BGP hijack at the time, and that action eventually allowed Hacking Team and its Italian government customer to reconnect with the Trojaned systems that once called home to their control server at Santrex. OpenDNS said it was able to review historic BGP records and verify the hijack, which at the time allowed Hacking Team and the Carabinieri to migrate their malware control server to another network.</p>
<p>This case is interesting because it sheds new light on the potential dual use of cybercrime-friendly hosting providers. For example, law enforcement agencies have been known to allow malicious ISPs like Santrex to operate with impunity because the alternative &#8212; shutting the provider down or otherwise interfering with its operations &#8211;can interfere with the ability of investigators to gather sufficient evidence of wrongdoing by bad actors operating at those ISPs. Indeed, the notoriously bad and spammer-friendly ISPs <a href="https://en.wikipedia.org/wiki/McColo" target="_blank">McColo</a> and <a href="https://en.wikipedia.org/wiki/Atrivo" target="_blank">Atrivo</a> were perfect examples of this prior to their being ostracized and summarily shut down by the Internet community in 2008.</p>
<p>But this example shows that some Western law enforcement agencies may also seek to conceal their investigations by relying on the same techniques and hosting providers that are patronized by the very criminals they are investigating.</p>
<p>Italian researcher <strong>Marco d&#8217;Itri</strong> dug through the leaked Hacking Team emails to unearth evidence of this plot. d&#8217;Itri has links to the emails (in Italian) at his blog <a href="http://blog.bofh.it/id_456" target="_blank">here</a>.</p>
<p><strong>Update, 2:17 p.m. ET: </strong>Swapped in &#8220;Carabinieri&#8221; for an acronym of the Italian National Military Police, and added links to leaked Hacking Team email threads discussing the alleged BGP hijack.</p>


feed_id: http://krebsonsecurity.com/?p=31550
title: Third Hacking Team Flash Zero-Day Found
uri: Third-Hacking-Team-Flash-Zero-Day-Found
url: http://krebsonsecurity.com/2015/07/third-hacking-team-flash-zero-day-found/
content:
<p>For the <a href="http://krebsonsecurity.com/2015/07/adobe-to-fix-another-hacking-team-zero-day/" target="_blank">third</a> <a href="http://krebsonsecurity.com/2015/07/adobe-to-patch-hacking-teams-flash-zero-day/" target="_blank">time</a> in a week, researchers have discovered a zero-day vulnerability in <strong>Adobe&#8217;s Flash Player</strong> browser plugin. Like the previous two discoveries, this one came to light only after hackers dumped online huge troves of documents stolen from <strong>Hacking Team</strong> &#8212; an Italian security firm that sells software exploits to governments around the world.</p>
<p>News of the latest Flash flaw comes from <strong>Trend Micro</strong>, which <a href="http://blog.trendmicro.com/update-the-hacking-team-flash-zero-day-trifecta/" target="_blank">said</a> it reported the bug (<strong>CVE-2015-5123</strong>) to Adobe&#8217;s Security Team. Adobe confirmed that it is working on a patch for the two outstanding zero-day vulnerabilities exposed in the Hacking Team breach.</p>
<p>We are likely to continue to see additional Flash zero day bugs surface as a result of this breach. Instead of waiting for Adobe to fix yet another flaw in Flash, please consider removing or at least hobbling this program.</p>
<p><a href="media/7fbabdf3.flashpotus.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/flashpotus.png"><img class="aligncenter size-full wp-image-31557" src="media/7fbabdf3.flashpotus.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/flashpotus.png" alt="flashpotus" width="552" height="511" /></a></p>
<p><span id="more-31550"></span>Google Chrome comes with its own version of Flash pre-installed, but disabling it is easy enough. On a <strong>Windows</strong>, <strong>Mac</strong>, <strong>Linux</strong> or <strong>Chrome OS</strong> installation of Chrome, type “chrome:plugins” into the address bar, and on the Plug-ins page look for the “Flash” listing: To disable Flash, click the disable link (to re-enable it, click “enable”).</p>
<p>Windows users can remove Flash from non-Chrome browsers from the Add/Remove Programs panel, and/or using <a href="https://helpx.adobe.com/flash-player/kb/uninstall-flash-player-windows.html#main_Download_the_Adobe_Flash_Player_uninstaller" target="_blank">this Flash Removal Tool</a>. Note that you must exit out of all Web browsers before running the tool. To verify that Flash has been removed, visit <a href="https://helpx.adobe.com/flash-player.html" target="_blank">this page</a>; if it says your browser needs Flash, you&#8217;ve successfully removed it.</p>
<p>For Mac users, <strong>AppleInsider</strong> carries <a href="http://appleinsider.com/articles/15/07/13/its-time-to-uninstall-adobes-flash-from-your-mac---heres-how?utm_source=dlvr.it&amp;utm_medium=twitter" target="_blank">a story</a> today that has solid instructions for nixing the program from OS X once and for all.</p>
<p>&#8220;Flash has become such an information security nightmare that Facebook&#8217;s Chief Security Officer called on Adobe to sunset the platform as soon as possible and ask browser vendors to forcibly kill it off,&#8221; AppleInsider&#8217;s <strong>Shane Cole</strong> writes. &#8220;Though most exploits are targeted at Windows, Mac users are not invincible.&#8221;</p>
<p>I removed Flash entirely more than a month ago <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">and haven&#8217;t missed the program one bit</a>. Unfortunately, some sites &#8212; including many government Web sites  &#8212; may prompt users to install Flash in order to view certain content. Perhaps it&#8217;s time for a petition to remove Flash Player from U.S. Government Web sites altogether? If you agree, make your voice heard <a href="http://wh.gov/i9Gaf" target="_blank">here</a>.  For more on spreading the word about Flash, see the campaign at <a href="http://occupyflash.org/" target="_blank">OccupyFlash.org</a>.</p>
<p>If you decide that removing Flash altogether or disabling it until needed is impractical, there are in-between solutions. Script-blocking applications like <a title="https://noscript.net/" href="https://noscript.net/" target="_blank" rel="noreferrer">Noscript</a> and <a title="https://chrome.google.com/webstore/detail/scriptsafe/oiigbmnaadbkfbmpbfijlflahbdbdgdf?hl=en" href="https://chrome.google.com/webstore/detail/scriptsafe/oiigbmnaadbkfbmpbfijlflahbdbdgdf?hl=en" target="_blank">ScriptSafe</a> are useful in blocking Flash content, but script blockers can be challenging for many users to handle.</p>
<p>Another approach is <a title="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" href="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" target="_blank">click-to-play</a>, which is a feature available for most browsers (except IE, sadly) that blocks Flash content from loading by default, replacing the content on Web sites with a blank box. With click-to-play, users who wish to view the blocked content need only click the boxes to enable Flash content inside of them (click-to-play also blocks Java applets from loading by default).</p>
<p>Windows users who decide to keep Flash installed and/or enabled also should take full advantage of the <a title="http://www.microsoft.com/en-us/download/details.aspx?id=43714" href="http://www.microsoft.com/en-us/download/details.aspx?id=43714" target="_blank" rel="noreferrer">Enhanced Mitigation Experience Toolkit</a> (EMET), a free tool from Microsoft that can <a title="http://krebsonsecurity.com/2013/06/windows-security-101-emet-4-0/" href="http://krebsonsecurity.com/2013/06/windows-security-101-emet-4-0/" target="_blank">help Windows users</a> beef up the security of third-party applications.</p>


feed_id: http://krebsonsecurity.com/?p=31569
title: Adobe, MS, Oracle Push Critical Security Fixes
uri: Adobe-MS-Oracle-Push-Critical-Security-Fixes
url: http://krebsonsecurity.com/2015/07/adobe-ms-oracle-push-critical-security-fixes/
content:
<p>This being the second Tuesday of the month, it&#8217;s officially Patch Tuesday. But it&#8217;s not just <strong>Microsoft Windows</strong> users who need to update today: <strong>Adobe</strong> has released fixes for several products, including a <strong>Flash Player</strong> bundle that patches two vulnerabilities for which exploit code is available online. Separately, <strong>Oracle</strong> issued a critical patch update that plugs more than two dozen security holes in <strong>Java</strong>.<span id="more-31569"></span></p>
<p><span style="text-decoration: underline;">ADOBE</span></p>
<p>Adobe&#8217;s Flash patch brings Flash to <em>version 18.0.0.209</em> on Windows and Mac systems. This newest release fixes <a href="http://krebsonsecurity.com/2015/07/third-hacking-team-flash-zero-day-found/" target="_blank">two vulnerabilities</a> that were discovered as part of the Hacking Team breach. Both flaws are exploitable via code that is already published online, so if you must use Flash please take a moment to update this program.</p>
<p><a href="media/528f543d.everyonegetsapatch.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/everyonegetsapatch.jpg"><img class="alignright  wp-image-31577" src="media/528f543d.everyonegetsapatch.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/everyonegetsapatch.jpg" alt="everyonegetsapatch" width="338" height="253" /></a>If you’re unsure whether your browser has Flash installed or what version it may be running, browse to <a title="https://www.adobe.com/software/flash/about/" href="https://www.adobe.com/software/flash/about/" target="_blank">this link</a>. Adobe Flash Player installed with <strong>Google Chrome</strong>, as well as <strong>Internet Explorer</strong> on <strong>Windows 8.x</strong>, should automatically update to the latest version. To force the installation of an available update on Chrome, click the triple bar icon to the right of the address bar, select “About Google” Chrome, click the apply update button and restart the browser.</p>
<p>The most recent versions of Flash should be available from the <a title="http://get.adobe.com/flashplayer/" href="http://get.adobe.com/flashplayer/" target="_blank">Flash home page</a>, but beware potentially unwanted add-ons, like <strong>McAfee Security Scan</strong>. To avoid this, uncheck the pre-checked box before downloading, or grab your OS-specific Flash download from <a title="https://www.adobe.com/products/flashplayer/distribution3.html" href="https://www.adobe.com/products/flashplayer/distribution3.html" target="_blank">here</a>. Windows users who browse the Web with anything other than Internet Explorer may need to apply this patch twice, once with IE and again using the alternative browser (<strong>Firefox</strong>, <strong>Opera</strong>, e.g.)</p>
<p>Please consider whether you really need Flash installed. It is a powerful program that is being massively leveraged by cybercriminals to break into systems. <a href="http://krebsonsecurity.com/2015/07/third-hacking-team-flash-zero-day-found/" target="_blank">Monday&#8217;s post</a> includes more information on how to remove Flash from your computer, depending on what operating system you use.</p>
<p>Adobe also issued security updates for <strong>Adobe Acrobat</strong> and its <strong>PDF Reader</strong> programs that fix at least 46 vulnerabilities in these products. Links to the latest versions of both programs are available in the <a href="https://helpx.adobe.com/security/products/acrobat/apsb15-15.html" target="_blank">Acrobat/Reader security advisory</a>.</p>
<p>Finally, Adobe released a security update for its <strong>Shockwave Player</strong> software for Windows and Mac. This is another Adobe product that I have <a href="http://krebsonsecurity.com/2014/05/why-you-should-ditch-adobe-shockwave/" target="_blank">long urged people to uninstall</a>, largely because most users have no need for Shockwave and it&#8217;s just as buggy as Flash but it doesn&#8217;t get updated nearly enough. In any case, links to the latest version of Shockwave are available <a href="https://helpx.adobe.com/security/products/shockwave/apsb15-17.html" target="_blank">in the advisory</a>.</p>
<p><span style="text-decoration: underline;">MICROSOFT</span></p>
<p><a href="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png"><img class="alignleft  wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="191" height="200" /></a>With today&#8217;s 14 patch bundles, Microsoft fixed dozens of vulnerabilities in Windows and related software. A <a href="https://technet.microsoft.com/en-us/library/security/ms15-065.aspx" target="_blank">cumulative patch</a> for <strong>Internet Explorer</strong> corrects at least 28 flaws in the default Windows browser. Three of those IE flaws were disclosed prior to today&#8217;s patches, including one zero-day flaw uncovered in the Hacking Team breach.</p>
<p>Most of these IE bugs are browse-and-get-owned vulnerabilities, meaning IE users can infect their systems merely by browsing to a hacked or malicious Web site.</p>
<p>Another <a href="https://technet.microsoft.com/en-us/library/security/ms15-070.aspx" target="_blank">noteworthy update</a> fixes at least eight flaws in various versions of Microsoft Office, including one (CVE-2424) that is actively being exploited by attackers.</p>
<p>More detailed summaries of the Microsoft patches released today can be found at Microsoft&#8217;s <a href="https://technet.microsoft.com/library/security/ms15-Jul" target="_blank">Security Bulletin Summary for July 2015</a>, and at the <a href="https://community.qualys.com/blogs/laws-of-vulnerabilities" target="_blank">Qualys blo</a>g.</p>
<p><span style="text-decoration: underline;">ORACLE</span></p>
<p>Oracle&#8217;s patch for <strong>Java SE</strong> includes fixes for 25 security vulnerabilities, including a flaw that is already being actively exploited to break into systems running Java SE. A <a href="http://blog.trendmicro.com/pawn-storm-first-java-zero-day-attack-in-two-years-targets-nato-us-defense-organizations/" target="_blank">blog post by Trend Micro</a> has more on the Java zero-day flaw, which was apparently used in targeted attacks in a cyber espionage campaign.</p>
<p><a href="media/f6d0854d.javamess.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/03/javamess.jpg"><img class="alignright size-medium wp-image-19243" src="media/5c15b877.javamess-285x226.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/03/javamess-285x226.jpg" alt="javamess" width="285" height="226" /></a>The latest version, <em>Java 8 Update 51</em>, is available from <a href="http://www.java.com/en/download/manual.jsp" target="_blank">Java.com</a>. But if you use Java, please take a moment to consider whether you still need this program on your computer. Java is yet another program that I have long urged users to do without, for most of the same reasons I&#8217;ve urged readers to ditch Flash and Shockwave: this widely installed and powerful program is riddled with security holes, and is a top target of malware writers and miscreants.</p>
<p>If you have an affirmative use or need for Java, there is a way to have this program installed while minimizing the chance that crooks will exploit unknown or unpatched flaws in the program: unplug it from the browser unless and until you’re at a site that requires it (or at least take advantage of <a title="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" href="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" target="_blank">click-to-play</a>, which can block Web sites from displaying both Java and Flash content by default).</p>
<p>The latest versions of Java let users <a title="http://www.java.com/en/download/help/disable_browser.xml" href="http://www.java.com/en/download/help/disable_browser.xml" target="_blank" rel="noreferrer">disable Java content in web browsers</a> through the <a title="http://www.java.com/en/download/help/javaconsole.xml" href="http://www.java.com/en/download/help/javaconsole.xml" target="_blank" rel="noreferrer">Java Control Panel</a>. Alternatively, consider a dual-browser approach, unplugging Java from the browser you use for everyday surfing, and leaving it plugged in to a second browser that you only use for sites that require Java.</p>
<p>Many people confuse Java with <strong> JavaScript</strong>, a powerful scripting language that helps make sites interactive. Unfortunately, a huge percentage of Web-based attacks use JavaScript tricks to foist malicious software and exploits onto site visitors. For more about ways to manage JavaScript in the browser, check out my tutorial <a title="http://krebsonsecurity.com/tools-for-a-safer-pc/" href="http://krebsonsecurity.com/tools-for-a-safer-pc/" target="_blank">Tools for a Safer PC</a>.</p>


feed_id: http://krebsonsecurity.com/?p=31575
title: ID Theft Service Proprietor Gets 13 Years
uri: ID-Theft-Service-Proprietor-Gets-13-Years
url: http://krebsonsecurity.com/2015/07/id-theft-service-proprietor-gets-13-years/
content:
<p>A Vietnamese man who ran an online identity theft service that sold access to Social Security numbers and other personal information on more than 200 million Americans has been sentenced to 13 years in a U.S. prison.</p>
<div id="attachment_23157" style="width: 295px" class="wp-caption alignright"><a class="lightbox" href="media/02f5c0ea.ngohalfpass.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/10/ngohalfpass.png"><img class="size-medium wp-image-23157" src="media/56adf7ce.ngohalfpass-285x146.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/10/ngohalfpass-285x146.png" alt="Vietnamese national Hieu Minh Ngo was sentenced to 13 years in prison for running an identity theft service." width="285" height="146" /></a><p class="wp-caption-text">Vietnamese national Hieu Minh Ngo was sentenced to 13 years in prison for running an identity theft service.</p></div>
<p><strong>Hieu Minh Ngo</strong>, 25, ran an ID theft service variously named <strong>Superget.info</strong> and <strong>findget.me</strong>. Ngo admitted hacking into or otherwise illegally gaining access to databases belonging to some of the world&#8217;s largest data brokers, including a <strong>Court Ventures</strong>, a subsidiary of the major consumer credit bureau <strong>Experian</strong>.</p>
<p>Ngo&#8217;s service sold access to &#8220;fullz,&#8221; the slang term for packages of consumer data that could be used to commit identity theft in victims&#8217; names. The government says Ngo made nearly $2 million from his scheme.</p>
<p>The totality of damage caused by his more than 1,300 customers is unknown, but it is clear that Ngo&#8217;s service was quite popular among ID thieves involved in filing fraudulent tax refund requests with the <strong>U.S. Internal Revenue Service</strong> (IRS). According to the <strong>Justice Department</strong>, the IRS has confirmed that 13,673 U.S. citizens, whose stolen PII was sold on Ngo’s websites, have been victimized through the filing of <em>$65 million in fraudulent individual income tax returns</em>.<span id="more-31575"></span></p>
<p>“From his home in Vietnam, Ngo used Internet marketplaces to offer for sale millions of stolen identities of U.S. citizens to more than a thousand cyber criminals scattered throughout the world,” said <strong>Assistant Attorney General Leslie R. Caldwell</strong>, in a press release.  “Criminals buy and sell stolen identity information because they see it as a low-risk, high-reward proposition.  Identifying and prosecuting cybercriminals like Ngo is one of the ways we&#8217;re working to change that cost-benefit analysis.”</p>
<p>Superget.info allowed users search for specific individuals by name, city, and state. Each “credit” cost USD$1, and a successful hit on a Social Security number or date of birth cost 3 credits each. The more credits you bought, the cheaper the searches were per credit: Six credits cost $4.99; 35 credits cost $20.99, and $100.99 bought you 230 credits. Customers with special needs could avail themselves of the “reseller plan,” which promised 1,500 credits for $500.99, and 3,500 credits for $1000.99.</p>
<div id="attachment_28760" style="width: 266px" class="wp-caption alignleft"><a class="lightbox" href="media/e03bc509.ealydope.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/ealydope.jpg"><img class=" wp-image-28760" src="media/f0e26199.ealydope-285x378.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/ealydope-285x378.jpg" alt="Lance Ealy, one of Ngo's customers, is now in prison for tax ID theft." width="256" height="340" /></a><p class="wp-caption-text">Lance Ealy, one of Ngo&#8217;s customers, is now in prison for tax ID theft.</p></div>
<p>Ngo was arrested in 2013, after he was lured to Guam with the offer of access to more consumer data by an undercover U.S. Secret Service agent. Ngo had been facing more than 24 years in federal prison, but his sentence was lightened because he cooperated with investigators to secure the arrest of at least a dozen of his U.S.-based customers. Among them was an Ohio man who led U.S. Marshals on <a href="http://krebsonsecurity.com/2015/03/convicted-tax-fraudster-fugitive-caught/" target="_blank">a multi-state pursuit</a> after his conviction on charges of filing phony tax refund requests with the IRS. Investigators close to the case say additional arrests of Ngo&#8217;s former customers are pending.</p>
<p>It remains unclear what, if any, consequences there may be going forward for Experian or its subsidiary, Court Ventures. Ngo gained access to the latter&#8217;s consumer database by posing as a private investigator based in the United States. In March 2012, Court Ventures was acquired by Experian, and for approximately ten months past that date, Ngo continued paying for his customers&#8217; data searches via cash wire transfers from a bank in Singapore.</p>
<p>In December 2013, an executive from big-three credit reporting bureau <strong>Experian</strong> <a title="http://krebsonsecurity.com/2014/03/experian-lapse-allowed-id-theft-service-to-access-200-million-consumer-records/" href="http://krebsonsecurity.com/2014/03/experian-lapse-allowed-id-theft-service-to-access-200-million-consumer-records/" target="_blank">told Congress</a> that the company was not aware of any consumers who had been harmed by an incident. Clearly, the facts unveiled in Ngo&#8217;s sentencing show otherwise.</p>
<p>I <a href="http://krebsonsecurity.com/2011/11/how-much-is-your-identity-worth/" target="_blank">first wrote</a> about Ngo&#8217;s service in November 2011. For more on the fallout from this investigation, see <a href="http://krebsonsecurity.com/?s=hieu&amp;x=0&amp;y=0" target="_blank">this series</a>.</p>


feed_id: http://krebsonsecurity.com/?p=31590
title: The Darkode Cybercrime Forum, Up Close
uri: The-Darkode-Cybercrime-Forum-Up-Close
url: http://krebsonsecurity.com/2015/07/the-darkode-cybercrime-forum-up-close/
content:
<p>By now, many of you loyal KrebsOnSecurity readers have seen stories in the mainstream press about <a href="http://www.justice.gov/opa/pr/major-computer-hacking-forum-dismantled" target="_blank">the coordinated global law enforcement takedown</a> of <strong>Darkode[dot]me</strong>, an English-language cybercrime forum that served as a breeding ground for botnets, malware and just about every other form of virtual badness. This post is an attempt to distill several years&#8217; worth of lurking on this forum into a narrative that hopefully sheds light on the individuals apprehended in this sting and the cybercrime forum scene in general.</p>
<p>To tell this tale completely would take a book the size of The Bible, but it&#8217;s useful to note that the history of Darkode &#8212; formerly darkode[dot]com &#8212; traces several distinct epochs that somewhat neatly track the rise and fall of the forum&#8217;s various leaders. What follows is a brief series of dossiers on those leaders, as well as a look at who these people are in real life.</p>
<p><span style="text-decoration: underline;">ISERDO</span></p>
<p>Darkode began almost eight years ago as a pet project of <strong>Matjaz Skorjanc</strong>, a now-36-year-old Slovenian hacker best known under the hacker alisas &#8220;Iserdo.&#8221; Skorjanc was one of several individuals named in the complaints published today by the U.S. Justice Department.</p>
<div id="attachment_12537" style="width: 254px" class="wp-caption alignright"><a class="lightbox" href="media/2f53bb8f.iserdoBFFsupportwhereareyou.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2011/11/iserdoBFFsupportwhereareyou.jpg"><img class=" wp-image-12537" src="media/4b69ffa9.iserdoBFFsupportwhereareyou-300x235.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2011/11/iserdoBFFsupportwhereareyou-300x235.jpg" alt="Butterfly Bot customers wonder why Iserdo isn't responding to support requests. He was arrested hours before." width="244" height="191" /></a><p class="wp-caption-text">Butterfly Bot customers wonder why Iserdo isn&#8217;t responding to support requests. He was arrested hours before.</p></div>
<p>Iserdo was best known as the author of the <a href="media/6ed919b1.Screen-shot-2010-03-03-at-7.08.09-PM.png" data-original-source="http://www.krebsonsecurity.com/wp-content/uploads/2010/03/Screen-shot-2010-03-03-at-7.08.09-PM.png" target="_blank">ButterFly Bot</a>, a plug-and-play malware strain that allowed even the most novice of would-be cybercriminals to set up a global cybercrime operation capable of harvesting data from thousands of infected PCs, and using the enslaved systems for crippling attacks on Web sites. Iserdo was <a href="http://www.msnbc.msn.com/id/38439213/ns/technology_and_science-security/t/fbi-says-mastermind-botnet-nabbed/" target="_blank">arrested by Slovenian authorities</a> in 2010. According to investigators, his ButterFly Bot kit sold for prices ranging from $500 to $2,000.</p>
<p>In May 2010, I wrote a story titled <a href="http://krebsonsecurity.com/2010/05/accused-mariposa-botnet-operators-sought-jobs-at-spanish-security-firm/" target="_blank">Accused Mariposa Botnet Operators Sought Jobs at Spanish Security Firm</a>, which detailed how several of Skorjanc&#8217;s alleged associates actually applied for jobs at <strong>Panda Security</strong>, an antivirus and security firm based in Spain. At the time, Skorjanc and his buddies were already under the watchful eye of the Spanish police.</p>
<p><span style="text-decoration: underline;">MAFI</span></p>
<p>Following Iserdo&#8217;s arrest, control of the forum fell to a hacker known variously as &#8220;Mafi,&#8221; &#8220;Crim&#8221; and &#8220;Synthet!c,&#8221; who according to the <strong>U.S. Justice Department</strong> is a 27-year-old Swedish man named <a href="https://www.facebook.com/mrjohan.johansson/friends" target="_blank">Johan Anders Gudmunds</a>. Mafi is accused of serving as the administrator of Darkode, and creating and selling malware that allowed hackers to build botnets. The Justice Department also alleges that Gudmunds operated his own botnet, &#8220;which at times consisted of more than 50,000 computers, and used his botnet to steal data from the users of those computers on approximately 200,000,000 occasions.&#8221;</p>
<p>Mafi was best known for creating the <a href="media/52635da5.crimpack-webstart2.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2010/08/crimpack-webstart2.png" target="_blank">Crimepack exploit kit</a>, a prepackaged bundle of commercial crimeware that attackers can use to booby-trap hacked Web sites with malicious software. Mafi&#8217;s stewardship over the forum coincided with the admittance of several high-profile Russian cybercriminals, including &#8220;<a href="http://krebsonsecurity.com/2013/12/meet-paunch-the-accused-author-of-the-blackhole-exploit-kit/" target="_blank">Paunch</a>,&#8221; an individual arrested in Russia in 2013 for selling a competing and far more popular exploit kit called <a href="http://krebsonsecurity.com/?s=blackhole&amp;x=0&amp;y=0" target="_blank">Blackhole</a>.</p>
<p>Paunch worked with another Darkode member named &#8220;J.P. Morgan,&#8221; who at one point maintained an <a href="media/3a7bac19.JPM450K.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/12/JPM450K.png" target="_blank">$800,000 budget for buying so-called &#8220;zero-day vulnerabilities,&#8221;</a> critical flaws in widely-used commercial software like <a href="http://krebsonsecurity.com/?s=flash+zero-day&amp;x=0&amp;y=0" target="_blank">Flash</a> and <a href="http://krebsonsecurity.com/?s=java+zero-day&amp;x=0&amp;y=0" target="_blank">Java</a> that could be used to deploy malicious software.</p>
<div id="attachment_19631" style="width: 295px" class="wp-caption alignleft"><a class="lightbox" href="media/1185d77c.mafionwatermarkingmath.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/04/mafionwatermarkingmath.png"><img class="size-medium wp-image-19631" src="media/09bc879e.mafionwatermarkingmath-285x283.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/04/mafionwatermarkingmath-285x283.png" alt="Darkode admin &quot;Mafi&quot; explains his watermarking system." width="285" height="283" /></a><p class="wp-caption-text">Darkode admin &#8220;Mafi&#8221; explains his watermarking system.</p></div>
<p>Perhaps unsurprisingly, Mafi&#8217;s reign as administrator of Darkode coincided with the massive infiltration of the forum by a number of undercover law enforcement investigators, as well as several freelance security researchers (including this author).</p>
<p>As a result, Mafi spent much of his time devising new ways to discover which user accounts on Darkode were those used by informants, feds and researchers, and which were &#8220;legitimate&#8221; cybercriminals looking to ply their wares.</p>
<p>For example, in mid-2013 Mafi and his associates cooked up a scheme to create a fake sales thread for a zero-day vulnerability &#8212; all in a bid to uncover which forum participants were researchers or feds who might be lurking on the forum.</p>
<p>That plan, which relied on <a href="http://krebsonsecurity.com/2013/04/fool-me-once/" target="_blank">a clever watermarking scheme</a> designed to &#8220;out&#8221; any forum members who posted screen shots of the forum online, worked well but also gave investigators key clues about the forum&#8217;s hierarchy and reporting structure.</p>
<p><a href="media/586b8b06.logsruhroh.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/logsruhroh.png"><img class="aligncenter size-medium wp-image-31605" src="media/b5469139.logsruhroh-580x192.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/logsruhroh-580x192.png" alt="logsruhroh" width="580" height="192" /></a></p>
<p>Mafi worked closely with another prominent Darkode member nicknamed &#8220;Fubar,&#8221; and together the two of them advertised sales of a botnet crimeware package called <a href="media/56267665.ngrbot.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/ngrbot.png" target="_blank">Ngrbot</a> (according to Mafi&#8217;s private messages on the forum, this was short for &#8220;Niggerbot.&#8221; The password databases from several of Mafi&#8217;s accounts on hacked cybercrime forums included variations on the word &#8220;nigger&#8221; in some form). Mafi also <a href="media/eb0f8cbf.mafisayshehasgrum.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/04/mafisayshehasgrum.png" target="_blank">advertised the sale of botnets </a>based on &#8220;Grum&#8221; a spam botnet whose source code was leaked in 2013.<span id="more-31590"></span></p>
<p><span style="text-decoration: underline;">SP3CIAL1ST</span></p>
<p>Conspicuously absent from the Justice Department&#8217;s press release on this takedown is any mention of Darkode&#8217;s most recent administrator &#8212; a hacker who goes by the handle &#8220;Sp3cial1st.&#8221;</p>
<p>Better known to Darkode members at &#8220;Sp3c,&#8221; this individual&#8217;s principal contribution to the forum seems to have revolved around a desire to massively expand the membership of the form, as well as an obsession with purging the community of anyone who even remotely might emit a whiff of being a fed or researcher.</p>
<div id="attachment_31602" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/1855c7d6.SP3C.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/SP3C.png"><img class="size-medium wp-image-31602" src="media/4dbe7f55.SP3C-580x126.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/SP3C-580x126.png" alt="The personal signature of Sp3cialist." width="580" height="126" /></a><p class="wp-caption-text">The personal signature of Sp3cial1st.</p></div>
<p>Sp3c is a well-known core member of the <a href="http://krebsonsecurity.com/?s=lizard+squad&amp;x=0&amp;y=0" target="_blank">Lizard Squad</a>, a group of mostly low-skilled miscreants who specialize in launching distributed denial-of-service attacks (DDoS) aimed at knocking Web sites offline.</p>
<p>In late 2014, the Lizard Squad took responsibility for launching a series of high-profile DDoS attacks that <a href="http://krebsonsecurity.com/2014/12/cowards-attack-sony-playstation-microsoft-xbox-networks/" target="_blank">knocked offline</a> the online gaming networks of Sony and Microsoft for the majority of Christmas Day.</p>
<p>In the first few days of 2015, KrebsOnSecurity was taken offline by a series of large and sustained denial-of-service attacks apparently orchestrated by the Lizard Squad. As I noted in <a title="http://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of-fail/" href="http://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of-fail/" target="_blank">a previous story</a>, the booter service — <strong>lizardstresser[dot]su</strong> — was hosted at an Internet provider in Bosnia that is home to a large number of malicious and hostile sites. As detailed in this story, the same botnet that took Sony and Microsoft offline was built using <a href="http://krebsonsecurity.com/2015/01/lizard-stresser-runs-on-hacked-home-routers/" target="_blank">a global network of hacked wireless routers.</a></p>
<p>That provider happens to be on the same “bulletproof” hosting network advertised by sp3cial1st. At the time, Darkode and LizardStresser shared the same Internet address.</p>
<p><span style="text-decoration: underline;">KMS</span></p>
<p>Another key individual named in the Justice Department&#8217;s complaint against Darkode is a hacker known in the underground as &#8220;<strong>KMS</strong>.&#8221; The government says KMS is a 28-year-old from Opelousas, Louisiana named <strong>Rory Stephen Guidry</strong>, who used the Jabber instant message address &#8220;<strong>k@exploit.im</strong>.&#8221; Having interacted with this individual on numerous occasions, I&#8217;d be remiss if I didn&#8217;t explain why this person is perhaps the least culpable and yet most interesting of the group named in the law enforcement purge.</p>
<p>For the past 12 months, KMS has been involved in an effort to expose the Lizard Squad members, to varying degrees of success. There are few individuals I would consider more skilled in tricking people into divulging information that is not in their best interests than this guy.</p>
<p>Near as I can tell, KMS has worked assiduously to expose the people behind the Lizard Squad and, by extension, the core members of Darkode. Unfortunately for KMS, his activities also appear to have ensnared him in this investigation.</p>
<p>To be clear, nobody is saying KMS is a saint. KMS&#8217;s best friend, a hacker from Kentucky named <strong>Ryan King</strong> (a.k.a. &#8220;Starfall&#8221; and a semi-frequent commenter on this blog), says KMS routinely had trouble seeing the lines between exposing others and involving himself in their activities. Here&#8217;s <a href="https://www.youtube.com/watch?v=O65y6ocniKs" target="_blank">one recording of him making a fake emergency call to the FBI</a>, disguising his voice as that of President Obama.</p>
<p>KMS is rumored to have played a part in exposing the <a href="http://krebsonsecurity.com/2015/02/webnic-registrar-blamed-for-hijack-of-lenovo-google-domains/" target="_blank">Lizard Squad&#8217;s February 2015 hijack of Google.com&#8217;s domain in Vietnam</a>. The message left behind in that crime suggested this author was somehow responsible, along with Sp3c and a <strong>Rory Andrew Godfrey, </strong>the only name that KMS was known under publicly until this week&#8217;s law enforcement action.</p>
<p>&#8220;As far as I know, I&#8217;m the only one who knew his real name,&#8221; King said. &#8220;The only botnets that he operated were those that he social engineered out of [less skilled hackers], but even those he was trying get shut down. All I know is that he and I were trying to get [root] access to Darkode and destroy it, and the feds beat us to it by about a week.&#8221;</p>
<p>The U.S. government sees things otherwise. Included in a <a href="media/5a83d415.gov.uscourts.lawd.147499.1.1.pdf" data-original-source="http://ia601506.us.archive.org/15/items/gov.uscourts.lawd.147499/gov.uscourts.lawd.147499.1.1.pdf" target="_blank">heavily-redacted affidavit</a> (PDF) related to Guidry&#8217;s case are details of a pricing structure that investigators say KMS used to sell access to hacked machines (see screenshot below)</p>
<p><a class="lightbox" href="media/678e0ec7.kmsbot.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/kmsbot.png"><img class="aligncenter size-full wp-image-31594" src="media/678e0ec7.kmsbot.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/kmsbot.png" alt="kmsbot" width="476" height="404" /></a></p>
<p>Many other individuals operating under a number of hacker names were called out in the Justice Department press release about this action. Perhaps some of them are mentioned in this subset of my personal archive of screen shots from Darkode, <a href="http://cdn.cdntest.org/" target="_blank">hosted here</a>. Happy hunting.</p>
<p>One final note: As happens with many of these takedowns, the bad guys don&#8217;t just go away: They go someplace else. In this case, that someplace else is most likely to be a <a href="http://www.brightplanet.com/2014/03/clearing-confusion-deep-web-vs-dark-web/" target="_blank">Deep Web or Dark Web</a> forum accessible only via Tor: According to chats observed from Sp3c&#8217;s public and private online accounts, the forum is getting ready to move much further underground.</p>
<p>The Justice Department press release on this action is <a href="http://www.justice.gov/opa/pr/major-computer-hacking-forum-dismantled" target="_blank">here</a>, which includes links to charging documents on most of the defendants.</p>
<p><strong>Update, 8:55 p.m. ET:</strong> Removed a sentence fragment that confused Iserdo with other individuals connected to his indictment.</p>
<p><a href="media/4978b98c.dkhome.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/dkhome.png"><img class="aligncenter size-medium wp-image-31625" src="media/d26d5420.dkhome-580x618.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/dkhome-580x618.png" alt="dkhome" width="580" height="618" /></a></p>


feed_id: http://krebsonsecurity.com/?p=31629
title: CVS Probes Card Breach at Online Photo Unit
uri: CVS-Probes-Card-Breach-at-Online-Photo-Unit
url: http://krebsonsecurity.com/2015/07/cvs-probes-card-breach-at-online-photo-unit/
content:
<p>Nationwide pharmacy chain <strong>CVS</strong> has taken down its online photo center <strong>CVSphoto.com</strong>, replacing it with a message warning that customer credit card data may have been compromised. The incident comes just days after <strong>Walmart Canada</strong> said it was investigating a potential breach of customer card data at its online photo processing store.</p>
<p><a href="media/21f035fa.cvsphoto.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/cvsphoto.png"><img class="aligncenter size-medium wp-image-31630" src="media/dd95c5dd.cvsphoto-580x271.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/cvsphoto-580x271.png" alt="cvsphoto" width="580" height="271" /></a></p>
<p>&#8220;We have been made aware that customer credit card information collected by the independent vendor who manages and hosts CVSPhoto.com may have been compromised,&#8221; CVS said in a statement that replaced the photo Web site&#8217;s normal homepage content. &#8220;As a precaution, as our investigation is underway we are temporarily shutting down access to online and related mobile photo services. We apologize for the inconvenience. Customer registrations related to online photo processing and CVSPhoto.com are completely separate from CVS.com and our pharmacies. Financial transactions on CVS.com and in-store are not affected.&#8221;<span id="more-31629"></span></p>
<p>Last week, Walmart Canada warned it was investigating a similar breach of its online photo Web site, which the company said was operated by a third party.<em> The Globe and Mail</em> <a href="http://www.theglobeandmail.com/report-on-business/walmart-looks-into-possible-credit-card-data-breach/article25422632/" target="_blank">reported</a> that the third-party in the Walmart Canada breach is a company called <strong>PNI Digital Media. </strong></p>
<p>According to PNI&#8217;s <a href="http://www.pnimedia.com/pni-investor-relations/" target="_blank">investor relations page</a>, PNI provides a &#8220;<a href="http://www.pnimedia.com/products-and-services/online-photo-solutions/" target="_blank">provides a proprietary transactional software platform</a>&#8221; that is used by retailers such as <strong>Costco</strong>, <strong>Walmart Canada</strong>, and <strong>CVS/pharmacy</strong> to sell millions of personalized products every year.&#8221;</p>
<p>&#8220;Our digital logistics connect your website, in-store kiosks, and mobile presences with neighbourhood storefronts, maximizing style, price, and convenience. Last year the PNI Digital Media platform worked with over 19,000 retail locations and 8,000 kiosks to generate more than 18M transactions for personalized products.&#8221;</p>
<p><strong>Update: 11:35 a.m. ET:</strong> The above-cited text from PNI&#8217;s Investor Relations page was removed shortly after this story went live; A screenshot of it is available <a href="media/86d41336.PNIinvestorRelations.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/PNIinvestorRelations.png" target="_blank">here</a>). Someone also <a href="https://en.wikipedia.org/w/index.php?title=PNI_Digital_Media&amp;diff=prev&amp;oldid=671782651" target="_blank">edited PNI&#8217;s Wikipedia page</a> to remove client information.</p>
<p><em>Original story:</em> Neither CVS nor PNI could be immediately reached for comment. Costco&#8217;s online photo store &#8212; <a href="http://www.costcophotocenter.com/Home" target="_blank">costcophotocenter.com</a>, does not appear to include any messaging about a possible breach.</p>
<p>Interestingly, PNI Digital Media was acquired a year ago by office supply chain <strong>Staples</strong>. As <a href="http://krebsonsecurity.com/2014/10/banks-credit-card-breach-at-staples-stores/" target="_blank">first reported by this site in October 2014</a>, Staples suffered its own card breach, a six-month intrusion that allowed thieves to steal <a href="http://krebsonsecurity.com/2014/12/staples-6-month-breach-1-16-million-cards/" target="_blank">more than a million</a> customer card accounts.</p>
<p><strong>Update, 11:33 p.m. ET:</strong> According to a review of customer data previously listed by PNI, we could be seeing similar actions from <strong>Sams Club</strong>, <strong>Walgreens</strong>, <strong>Rite Aid</strong> and <strong>Tesco</strong>, to name a few.</p>
<p>Costo, which also was listed as a customer of PNI, just took its photo site offline as well, adding the following message:</p>
<p>&#8220;As a result of recent reports suggesting that there may have been a security compromise of the third party vendor who hosts Costcophotocenter.com we are temporarily suspending access to the site. This decision does not affect any other Costco website or our in-store operations, including in-store photo centers.&#8221;</p>
<p><a href="media/771a98fb.costcophoto.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/costcophoto.png"><img class="aligncenter size-medium wp-image-31642" src="media/46847460.costcophoto-580x384.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/costcophoto-580x384.png" alt="costcophoto" width="580" height="384" /></a></p>
<p>Tesco&#8217;s photo site &#8212; tescophoto.com &#8212; currently says it is &#8220;down for maintenance.&#8221; <a href="https://shop.riteaid.com/info/photo-info" target="_blank">Rite Aid&#8217;s photo site</a> also carries a notice saying it was notified by PNI Digital Media of a possible breach:</p>
<blockquote><p>&#8220;We recently were advised by PNI Digital Media, the third party that manages and hosts mywayphotos.riteaid.com, that it is investigating a possible compromise of certain online and mobile photo account customer data. The data that may have been affected is name, address, phone number, email address, photo account password and credit card information. Unlike for other PNI customers, PNI does not process credit card information on Rite Aid’s behalf and PNI has limited access to this information. At this time, we have no reports from our customers of their credit card or other information being affected by this issue. While we investigate this issue, as a precaution we have temporarily shut down access to online and mobile photo services.&#8221;</p>
<p>No other online or mobile transactions are affected. This issue is limited to online and mobile photo transactions involving PNI. RiteAid.com, Rite Aid Online Store, My Pharmacy, wellness+ with Plenti, and in-store systems are not affected.&#8221;</p></blockquote>
<p><a href="media/d20749cc.riteaidphoto.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/riteaidphoto.png"><img class="aligncenter size-medium wp-image-31644" src="media/e7a28175.riteaidphoto-580x293.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/riteaidphoto-580x293.png" alt="riteaidphoto" width="580" height="293" /></a></p>


feed_id: http://krebsonsecurity.com/?p=31650
title: Online Cheating Site AshleyMadison Hacked
uri: Online-Cheating-Site-AshleyMadison-Hacked
url: http://krebsonsecurity.com/2015/07/online-cheating-site-ashleymadison-hacked/
content:
<p>Large caches of data stolen from online cheating site <strong>AshleyMadison.com</strong> have been posted online by an individual or group that claims to have completely compromised the company&#8217;s user databases, financial records and other proprietary information. The still-unfolding leak could be quite damaging to some 37 million users of the hookup service, whose slogan is &#8220;Life is short. Have an affair.&#8221;</p>
<p><a class="lightbox" href="media/40ac603d.ashleymadison.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/ashleymadison.png"><img class="aligncenter size-medium wp-image-31652" src="media/ed6fa023.ashleymadison-580x370.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/ashleymadison-580x370.png" alt="ashleymadison" width="580" height="370" /></a></p>
<p>The data released by the hacker or hackers &#8212; which self-identify as <strong>The Impact Team</strong> &#8212; includes sensitive internal data stolen from <a href="http://www.avidlifemedia.com/" target="_blank">Avid Life Media</a> (ALM), the Toronto-based firm that owns AshleyMadison as well as related hookup sites <strong>Cougar Life</strong> and <strong>Established Men</strong>.</p>
<p>Reached by KrebsOnSecurity late Sunday evening, <strong>ALM Chief Executive Noel Biderman</strong> confirmed the hack, and said the company was &#8220;working diligently and feverishly&#8221; to take down ALM&#8217;s intellectual property. Indeed, in the short span of 30 minutes between that brief interview and the publication of this story, several of the Impact Team&#8217;s Web links were no longer responding.</p>
<p>&#8220;We&#8217;re not denying this happened,&#8221; Biderman said. &#8220;Like us or not, this is still a criminal act.&#8221;</p>
<p>Besides snippets of account data apparently sampled at random from among some 40 million users across ALM&#8217;s trio of properties, the hackers leaked maps of internal company servers, employee network account information, company bank account data and salary information.</p>
<p>The compromise comes less than two months after intruders <a href="http://money.cnn.com/2015/05/22/technology/adult-friendfinder-hacked/" target="_blank">stole and leaked online user data</a> on millions of accounts from hookup site <strong>AdultFriendFinder</strong>.</p>
<p>In a long manifesto posted alongside the stolen ALM data, The Impact Team said it decided to publish the information in response to alleged lies ALM told its customers <a href="http://arstechnica.com/business/2014/08/cheaters-hook-up-site-ashley-madison-makes-account-deletion-confusing/" target="_blank">about a service that allows members to completely erase their profile information for a $19 fee</a>.</p>
<p>According to the hackers, although the &#8220;full delete&#8221; feature that Ashley Madison advertises promises &#8220;removal of site usage history and personally identifiable information from the site,&#8221; users&#8217; purchase details &#8212; including real name and address &#8212; aren&#8217;t actually scrubbed.<span id="more-31650"></span></p>
<p>&#8220;Full Delete netted ALM $1.7mm in revenue in 2014. It&#8217;s also a complete lie,&#8221; the hacking group wrote. &#8220;Users almost always pay with credit card; their purchase details are not removed as promised, and include real name and address, which is of course the most important information the users want removed.&#8221;</p>
<p>Their demands continue:</p>
<p>&#8220;Avid Life Media has been instructed to take Ashley Madison and Established Men offline permanently in all forms, or we will release all customer records, including profiles with all the customers&#8217; secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails. The other websites may stay online.&#8221;</p>
<div id="attachment_31653" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/424e0e04.impactteam.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/impactteam.png"><img class="size-medium wp-image-31653" src="media/f8e06603.impactteam-580x657.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/impactteam-580x657.png" alt="A snippet of the message left behind by the Impact Team." width="580" height="657" /></a><p class="wp-caption-text">A snippet of the message left behind by the Impact Team.</p></div>
<p>It&#8217;s unclear how much of the AshleyMadison user account data has been posted online. For now, it appears the hackers have published a relatively small percentage of AshleyMadison user account data and are planning to publish more for each day the company stays online.</p>
<p>&#8220;Too bad for those men, they&#8217;re cheating dirtbags and deserve no such discretion,&#8221; the hackers continued. &#8220;Too bad for ALM, you promised secrecy but didn&#8217;t deliver. We&#8217;ve got the complete set of profiles in our DB dumps, and we&#8217;ll release them soon if Ashley Madison stays online. And with over 37 million members, mostly from the US and Canada, a significant percentage of the population is about to have a very bad day, including many rich and powerful people.&#8221;</p>
<p>ALM CEO Biderman declined to discuss specifics of the company&#8217;s investigation, which he characterized as ongoing and fast-moving. But he did suggest that the incident may have been the work of someone who at least at one time had legitimate, inside access to the company&#8217;s networks &#8212; perhaps a former employee or contractor.</p>
<p>&#8220;We&#8217;re on the doorstep of [confirming] who we believe is the culprit, and unfortunately that may have triggered this mass publication,&#8221; Biderman said. &#8220;I&#8217;ve got their profile right in front of me, all their work credentials. It was definitely a person here that was not an employee but certainly had touched our technical services.&#8221;</p>
<p>As if to support this theory, the message left behind by the attackers gives something of a shout out to ALM&#8217;s director of security.</p>
<p>&#8220;Our one apology is to Mark Steele (Director of Security),&#8221; the manifesto reads. &#8220;You did everything you could, but nothing you could have done could have stopped this.&#8221;</p>
<p>Several of the leaked internal documents indicate ALM was hyper aware of the risks of a data breach. In a Microsoft Excel document that apparently served as a questionnaire for employees about challenges and risks facing the company, employees were asked &#8220;In what area would you hate to see something go wrong?&#8221;</p>
<p><strong>Trevor Stokes</strong>, ALM&#8217;s chief technology officer, put his worst fears on the table: &#8220;Security,&#8221; he wrote. &#8220;I would hate to see our systems hacked and/or the leak of personal information.&#8221;</p>
<p>In the wake of the AdultFriendFinder breach, many wondered whether AshleyMadison would be next. As the Wall Street Journal noted in a May 2015 brief titled &#8220;<a href="http://blogs.wsj.com/moneybeat/2015/05/22/risky-business-for-ashleymadison-com/" target="_blank">Risky Business for AshleyMadison.com</a>,&#8221; the company had voiced <a href="http://www.bloomberg.com/news/articles/2015-04-15/adultery-website-ashleymadison-seeks-ipo-as-demand-booms" rel="noreferrer">plans for an initial public offering</a> in London later this year with the hope of raising as much as $200 million.</p>
<p>&#8220;Given the breach at AdultFriendFinder, investors will have to think of hack attacks as a risk factor,&#8221; the WSJ wrote. &#8220;And given its business’s reliance on confidentiality, prospective AshleyMadison investors should hope it has sufficiently, er, girded its loins.&#8221;</p>
<p><strong>Update, 8:58 a.m. ET: </strong>ALM has released the following statement about this attack:</p>
<blockquote><p>&#8220;We were recently made aware of an attempt by an unauthorized party to gain access to our systems. We immediately launched a thorough investigation utilizing leading forensics experts and other security professionals to determine the origin, nature, and scope of this incident.&#8221;</p>
<p>&#8220;We apologize for this unprovoked and criminal intrusion into our customers’ information. The current business world has proven to be one in which no company’s online assets are safe from cyber-vandalism, with Avid Life Media being only the latest among many companies to have been attacked, despite investing in the latest privacy and security technologies.&#8221;</p>
<p>&#8220;We have always had the confidentiality of our customers’ information foremost in our minds, and have had stringent security measures in place, including working with leading IT vendors from around the world. As other companies have experienced, these security measures have unfortunately not prevented this attack to our system.&#8221;</p>
<p>&#8220;At this time, we have been able to secure our sites, and close the unauthorized access points. We are working with law enforcement agencies, which are investigating this criminal act. Any and all parties responsible for this act of cyber–terrorism will be held responsible.&#8221;</p>
<p>&#8220;Avid Life Media has the utmost confidence in its business, and with the support of leading experts in IT security, including Joel Eriksson, CTO, Cycura, we will continue to be a leader in the services we provide. “I have worked with leading companies around the world to secure their businesses. I have no doubt, based on the work I and my company are doing, Avid Life Media will continue to be a strong, secure business,” Eriksson said.&#8221;</p></blockquote>


feed_id: http://krebsonsecurity.com/?p=31682
title: Experian Hit With Class Action Over ID Theft Service
uri: Experian-Hit-With-Class-Action-Over-ID-Theft-Service
url: http://krebsonsecurity.com/2015/07/experian-hit-with-class-action-over-id-theft-service/
content:
<p>Big-three credit bureau <strong>Experian</strong> is the target of a class-action lawsuit just filed in California. The suit alleges that Experian negligently violated consumer protection laws when it failed to detect for nearly 10 months that a customer of its data broker subsidiary was a scammer who ran a criminal service that resold consumer data to identity thieves.</p>
<p><a href="media/7d001956.experian.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/experian.png"><img class="aligncenter size-medium wp-image-31685" src="media/d75634af.experian-580x384.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/experian-580x384.png" alt="experian" width="580" height="384" /></a>The lawsuit comes just days after a judge in New Hampshire <a href="http://krebsonsecurity.com/2015/07/id-theft-service-proprietor-gets-13-years/" target="_blank">handed down a 13-year jail sentence</a> against <strong>Hieu Minh Ngo</strong>, a 25-year-old Vietnamese man who ran <a href="http://krebsonsecurity.com/2011/11/how-much-is-your-identity-worth/" target="_blank">an ID theft service</a> variously named <strong>Superget.info </strong>and <strong>findget.me</strong>.</p>
<p>Ngo admitted hacking into or otherwise illegally gaining access to databases belonging to some of the world’s largest data brokers, including a <strong>Court Ventures </strong>&#8212; a company that Experian acquired in 2012. He got access to some 200 million consumer records by <a href="http://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/" target="_blank">posing as a private investigator</a> based in the United States, and for nearly ten months after Experian acquired Court Ventures, Ngo continued paying for his customers’ data searches <em>via cash wire transfers from a bank in Singapore</em>.</p>
<p>Ngo’s service sold access to “fullz,” the slang term for packages of consumer data that could be used to commit identity theft in victims’ names. The government says Ngo made nearly $2 million from his scheme. According to the <strong>Justice Department</strong>, the IRS has confirmed that 13,673 U.S. citizens, whose stolen personal information was sold on Ngo’s websites, have been victimized through the filing of <em>$65 million in fraudulent individual income tax returns.</em></p>
<p>The class action lawsuit, filed July 17, 2015 in the <strong>U.S. District Court for the Central District of California</strong>, seeks statutory damages for Experian&#8217;s alleged violations of, among other statutes, the <a href="https://en.wikipedia.org/wiki/Fair_Credit_Reporting_Act" target="_blank">Fair Credit Reporting Act</a> (FCRA). The plaintiffs also want the court to force Experian to notify all consumers affected by Ngo&#8217;s service; to provide them free credit monitoring services; to disgorge all profits made from Ngo&#8217;s service; and to establish a fund (in an amount to be determined) to which victims can apply for reimbursement of the time and out-of-pocket expenses they incurred to remediate the identity theft and fraud caused by customers of Ngo&#8217;s ID theft service.<span id="more-31682"></span></p>
<div id="attachment_25259" style="width: 295px" class="wp-caption alignleft"><a href="media/724b2e55.hadley.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/03/hadley.png"><img class="size-medium wp-image-25259" src="media/58ed82a4.hadley-285x247.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/03/hadley-285x247.png" alt="Experian's Tony Hadley, addressing the Senate Commerce Committee in Dec. 2013." width="285" height="247" /></a><p class="wp-caption-text">Experian&#8217;s Tony Hadley, addressing the Senate Commerce Committee in Dec. 2013.</p></div>
<p>&#8220;The Security Lapse notice, as well as the above referenced protections, also will fulfill the promise made to Congress by <strong>Tony Hadley</strong>, Experian’s Senior Vice President of Government Affairs and Public Policy, that &#8216;we know who they [the Security Lapse victims] are, and we’re going to make sure they’re protected&#8217;,&#8221; the complaint states. For more on Experian&#8217;s contradictory statements before Congress on this breach, see <a href="http://krebsonsecurity.com/2014/03/experian-lapse-allowed-id-theft-service-to-access-200-million-consumer-records/" target="_blank">this March 2014 story</a>.</p>
<p>Experian did not respond to requests for comment on the lawsuit, and it has yet to respond to the claims in court. A copy of the complaint is <a href="media/c3ac927e.Experian-Ngo-Complaint.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/Experian-Ngo-Complaint.pdf" target="_blank">here</a> (PDF). Incidentally, Experian and the former owner of Court Ventures <a href="http://www.databreaches.net/experian-sues-court-ventures-to-enforce-indemnification-in-wake-of-court-ventures-breach/" target="_blank">are currently suing each other</a> over which company is at fault for Ngo&#8217;s service.</p>
<p>For additional stories related to Ngo&#8217;s service and his hundreds of criminal customers, check out <a href="http://krebsonsecurity.com/?s=ngo+experian+customer&amp;x=0&amp;y=0" target="_blank">this series</a>. For more on what you can do to avoid becoming an identity theft victim, please see <a href="http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">this story</a>.</p>


feed_id: http://krebsonsecurity.com/?p=31667
title: Spike in ATM Skimming in Mexico?
uri: Spike-in-ATM-Skimming-in-Mexico
url: http://krebsonsecurity.com/2015/07/spike-in-atm-skimming-in-mexico/
content:
<p>Several sources in the financial industry say they are seeing a spike in fraud on customer cards used at ATMs in Mexico. The reason behind that apparent increase hopefully will be fodder for another story. In this post, we&#8217;ll take a closer look at a pair of ATM skimming devices that were found this month attached to a cash machine in Puerto Vallarta &#8212; a popular tourist destination on Mexico&#8217;s Pacific coast.</p>
<p>On Saturday, July 18, 2015, municipal police in Puerto Vallara arrested a man who had just replaced the battery in a pair of skimming devices he or an associate had installed at an ATM in a busy spot of the town. This skimming kit targeted certain models of cash machines made by Korean ATM manufacturer <strong>Hyosung</strong>, and included a card skimming device as well as a hidden camera to record the victim&#8217;s ATM card PIN.</p>
<p>Here&#8217;s a look at the hidden camera installed over the compromised card reader. Would you have noticed anything amiss here?</p>
<p><a class="lightbox" href="media/96dadcd2.hyosung-frontatm.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/hyosung-frontatm.png"><img class="aligncenter size-medium wp-image-31679" src="media/24a5eb48.hyosung-frontatm-580x346.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/hyosung-frontatm-580x346.png" alt="hyosung-frontatm" width="580" height="346" /></a><a href="media/b8cf8066.hyosung-front.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/hyosung-front.png"><br />
</a>The tiny pinhole camera was hidden in a molded plastic fascia designed to fit over top of the area directly above the PIN pad. The only clue that something is wrong here is a gap of about one millimeter between the PIN capture device and the actual ATM. Check out the backside of the false front:</p>
<div id="attachment_31672" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/75e2471b.hyosung-cam-back-copy.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/hyosung-cam-back-copy.png"><img class="size-medium wp-image-31672" src="media/63c10c8e.hyosung-cam-back-copy-580x419.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/hyosung-cam-back-copy-580x419.png" alt="The backside of the false fascia shows the location of the hidden camera." width="580" height="419" /></a><p class="wp-caption-text">The backside of the false fascia shows the location of the hidden camera.</p></div>
<p>The left side of the false fascia (as seen from the front, installed) contains the battery units that power the video camera:</p>
<div id="attachment_31673" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/743d6db0.hyosung-cam-battery-copy.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/hyosung-cam-battery-copy.png"><img class="size-medium wp-image-31673" src="media/079e919e.hyosung-cam-battery-copy-580x276.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/hyosung-cam-battery-copy-580x276.png" alt="Swapping the batteries out got this skimmer scammer busted. No wonder they included so many!" width="580" height="276" /></a><p class="wp-caption-text">Swapping the batteries out got this skimmer scammer busted. No wonder they included so many!</p></div>
<p><span id="more-31667"></span>The device used to record data from the magnetic stripe as the customer inserts his ATM card into the machine is nothing special, but it does blend in pretty well as we can see here:</p>
<div id="attachment_31680" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/dc73c821.hyosung-cardskimmer-copy_edited-2.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/hyosung-cardskimmer-copy_edited-2.png"><img class="size-medium wp-image-31680" src="media/df8acaf7.hyosung-cardskimmer-copy_edited-2-580x356.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/hyosung-cardskimmer-copy_edited-2-580x356.png" alt="The card skimming device, as attached to a compromised ATM in Puerto Vallarta." width="580" height="356" /></a><p class="wp-caption-text">The card skimming device, as attached to a compromised ATM in Puerto Vallarta.</p></div>
<p>Have a gander at the electronics that power this badboy:</p>
<p><a class="lightbox" href="media/3b0624df.hyosung-cardskimmer-back-copy.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/hyosung-cardskimmer-back-copy.png"><img class="aligncenter size-medium wp-image-31675" src="media/5808561c.hyosung-cardskimmer-back-copy-580x479.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/hyosung-cardskimmer-back-copy-580x479.png" alt="hyosung-cardskimmer-back copy" width="580" height="479" /></a></p>
<p>According to a local news clipping about the skimming incident, the fraudster caught red-handed was found in possession of <a href="https://en.wikipedia.org/wiki/Carte_Vitale" target="_blank">a Carte Vitale card</a>, a health insurance card of the national health care system in France.</p>
<div id="attachment_31676" style="width: 587px" class="wp-caption aligncenter"><a class="lightbox" href="media/397bccb8.vitale.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/vitale.png"><img class="size-full wp-image-31676" src="media/397bccb8.vitale.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/vitale.png" alt="The man apprehended by Mexican police. Image: Noticiaspv.com" width="577" height="377" /></a><p class="wp-caption-text">The French health care card found on the man apprehended by Mexican police. Image: Noticiaspv.com</p></div>
<p>The man gave his name as <strong>Dominique Mardokh</strong>, the same name on the insurance card. Also, the picture on the insurance card matched his appearance in real life; <a href="media/eb10c37b.hyosung-skimmer-guy.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/hyosung-skimmer-guy.png" target="_blank">here&#8217;s a picture of Mardokh in the back of a police car</a>.</p>
<p>According to the news site <a href="http://www.noticiaspv.com/capturaron-a-clonador-de-tarjetas-bancarias/" target="_blank">Noticiaspv.com</a>, the suspect was apprehended by police as he fled the scene in a vehicle with license plates from <a href="https://en.wikipedia.org/wiki/Quintana_Roo" target="_blank">Quintana Roo</a>, a state nearly 2,500 km away on the Atlantic side of Mexico that is the home of another very popular tourist destination: <a href="https://en.wikipedia.org/wiki/Canc%C3%BAn" target="_blank">Cancún</a><b>.</b></p>
<p>Ironically, the healthcare card that identified this skimmer scammer is far more secure than the bank cards he was allegedly stealing with the help of the skimming devices. That&#8217;s because the healthcare card stores data about its owner on a small computer chip which makes the card difficult for thieves to duplicate.</p>
<p>Virtually all European banks and most non-US financial institutions issue chip-and-PIN cards (also called <strong>Europay, Mastercard and Visa</strong> or <a title="http://en.wikipedia.org/wiki/EMV" href="http://en.wikipedia.org/wiki/EMV" rel="noreferrer">EMV</a>), but unfortunately chip cards have been slow to catch on in the United States. Most US-based cards still store account data in plain text on a magnetic stripe, which can be easily copied by skimming devices and encoded onto new cards.</p>
<p>For reasons of backward compatibility with ATMs that aren’t yet in line with EMV, many EMV-compliant cards issued by European banks also include a plain old magnetic stripe. The weakness here, of course, is that thieves can still steal card data from Europeans using skimmers on European ATMs, but they need not fabricate chip-and-PIN cards to withdrawal cash from the stolen accounts: They simply send the card data to co-conspirators in the United States who use it to fabricate new cards and to pull cash out of ATMs here, where the EMV standard is not yet in force.</p>
<p>This skimmers found in Mexico (where most credit cards also are identified by microchip) abuse that same dynamic: Undoubtedly, the thieves in this scheme compromised ATMs at popular tourist destinations because they knew these places were overrun with American tourists.</p>
<p>In October 2015, U.S. merchants that have not yet installed card readers which accept more secure chip-based cards will <a href="http://blogs.wsj.com/corporate-intelligence/2014/02/06/october-2015-the-end-of-the-swipe-and-sign-credit-card/" target="_blank" rel="noreferrer">assume responsibility</a> for the cost of fraud from counterfeit cards. While most experts believe it may be years after that deadline before most merchants have switched entirely to chip-based card readers (and many U.S. banks are only now thinking about issuing chip-based cards to customers). Unfortunately, that liability shift doesn&#8217;t apply to ATMs in the U.S. until October 2017.</p>
<p>Whether or not your card has a chip in it, one way to defeat skimmers that rely on hidden cameras (and that&#8217;s most of them) is to simply cover the PIN pad with your hand when entering your PIN: That way, if even if the thieves somehow skim your card, there is less chance that they will be able to snag your PIN as well. <a title="http://krebsonsecurity.com/2012/09/a-handy-way-to-foil-atm-skimmer-scams/" href="http://krebsonsecurity.com/2012/09/a-handy-way-to-foil-atm-skimmer-scams/" target="_blank">You’d be amazed at how many people fail to take this basic precaution</a>. Yes, there is still a chance that thieves could use <a title="http://krebsonsecurity.com/wp-content/uploads/2010/08/skimgallery1.jpg" href="media/b2afe186.skimgallery1.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2010/08/skimgallery1.jpg" target="_blank">a PIN-pad overlay device</a> to capture your PIN, but in my experience these are far less common than hidden cameras (and quite a bit more costly for thieves who aren’t making their own skimmers).</p>
<p>Are you as fascinated by ATM skimmers as I am? Check out my series on this topic, <a title="http://krebsonsecurity.com/all-about-skimmers/" href="http://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers</a>.</p>


feed_id: http://krebsonsecurity.com/?p=33068
title: Hilton Acknowledges Credit Card Breach
uri: Hilton-Acknowledges-Credit-Card-Breach
url: http://krebsonsecurity.com/2015/11/hilton-acknowledges-credit-card-breach/
content:
<p>Two months after KrebsOnSecurity <a href="http://krebsonsecurity.com/2015/09/banks-card-breach-at-hilton-hotel-properties/" target="_blank">first reported</a> that multiple banks suspected a credit card breach at <strong>Hilton Hotel</strong> properties across the country, Hilton has acknowledged an intrusion involving malicious software found on some point-of-sale systems.</p>
<p><a href="media/c29b5b9e.hilton.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/09/hilton.png"><img class="alignright  wp-image-32429" src="media/c29b5b9e.hilton.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/09/hilton.png" alt="hilton" width="282" height="204" /></a>According to <a href="http://news.hiltonworldwide.com/index.cfm/news/hilton-worldwide-has-identified-and-taken-action-to-eradicate-malware" target="_blank">a statement</a> released after markets closed on Tuesday, the breach persisted over a 17-week period from Nov. 18, 2014 to Dec. 5, 2014, or April 21 to July 27, 2015.</p>
<p>&#8220;Hilton Worldwide (NYSE: HLT) has identified and taken action to eradicate unauthorized malware that targeted payment card information in some point-of-sale systems,&#8221; the company said. &#8220;Hilton immediately launched an investigation and has further strengthened its systems.&#8221;</p>
<p>Hilton said the data stolen includes cardholder names, payment card numbers, security codes and expiration dates, but no addresses or personal identification numbers (PINs).</p>
<p>The company did not say how many Hilton locations or brands were impacted, or whether the breach was limited to compromised point-of-sale devices inside of franchised restaurants, coffee bars and gift shops within Hilton properties &#8212; as previously reported here.</p>
<p>The announcement from Hilton comes just five days after Starwood Hotel &amp; Resorts Worldwide &#8212; including some 50 Sheraton and Westin locations &#8212; was hit by a similar breach that lasted nearly six months.</p>
<p>Starwood and Hilton join several other major hotel brands in announcing a malware-driven credit card data breach over the past year. In October 2015, <strong>The Trump Hotel Collection</strong> <a href="http://krebsonsecurity.com/2015/10/trump-hotel-collection-confirms-card-breach/" target="_blank">confirmed</a> a report first published by KrebsOnSecurity <a href="http://krebsonsecurity.com/2015/07/banks-card-breach-at-trump-hotel-properties/" target="_blank">in June</a> about a possible card breach at the luxury hotel chain.</p>
<p>In March, upscale hotel chain <strong>Mandarin Oriental</strong> <a href="http://krebsonsecurity.com/2015/03/credit-card-breach-at-mandarian-oriental/" target="_blank">acknowledged a similar breach</a>. The following month, hotel franchising firm <strong>White Lodging</strong> allowed that — <a href="http://krebsonsecurity.com/2015/04/white-lodging-confirms-second-breach/" target="_blank">for the second time in 12 months</a> — card processing systems at several of its locations were breached by hackers.</p>
<p>Readers should remember that they are not liable for unauthorized debit or credit card charges, but with one big caveat: the onus is on the cardholder to spot and report any unauthorized charges. Keep a close eye on your monthly statements and report any bogus activity immediately. Many card issuers now let customers receive text alerts for each card purchase and/or for any account changes. Take a moment to review the notification options available to you from your bank or card issuer.</p>


feed_id: http://krebsonsecurity.com/?p=33044
title: Security Bug in Dell PCs Shipped Since 8/15
uri: Security-Bug-in-Dell-PCs-Shipped-Since-8-15
url: http://krebsonsecurity.com/2015/11/security-bug-in-dell-pcs-shipped-since-815/
content:
<p>All new <strong>Dell</strong> laptops and desktops shipped since August 2015 contain a serious security vulnerability that exposes users to online eavesdropping and malware attacks. Dell says it is prepping a fix for the issue, but experts say the threat may ultimately need to be stomped out by the major Web browser makers.</p>
<p><a href="media/aa113e9f.d3ll.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/d3ll.png"><img class="alignright wp-image-33050" src="media/b347b1d8.d3ll-580x404.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/d3ll-580x404.png" alt="d3ll" width="296" height="206" /></a>At issue is a root certificate installed on newer Dell computers that also includes the private cryptographic key for that certificate. Clever attackers can use this key from Dell to sign phony browser security certificates for any HTTPS-protected site.</p>
<p>Translation: A malicious hacker could exploit this flaw on open, public networks (think WiFi hotspots, coffee shops, airports) to impersonate any Web site to a Dell user, and to quietly intercept, read and modify all of a vulnerable Dell system&#8217;s Web traffic.</p>
<p>According to <a href="http://joenord.blogspot.in/2015/11/new-dell-computer-comes-with-edellroot.html" target="_blank">Joe Nord</a>, the computer security researcher credited with discovering the problem, the trouble stems from a certificate Dell installed named &#8220;<strong>eDellRoot</strong>.&#8221;</p>
<p>Dell says the eDellRoot certificate was installed on all new desktop and laptops shipped from August 2015 to the present day. According to the company, the certificate was intended to make it easier for Dell customer support to assist customers in troubleshooting technical issues with their computers.</p>
<p>&#8220;We began loading the current version on our consumer and commercial devices in August to make servicing PC issues faster and easier for customers,&#8221; Dell spokesperson <strong>David Frink</strong> said. &#8220;When a PC engages with Dell online support, the certificate provides the system service tag allowing Dell online support to immediately identify the PC model, drivers, OS, hard drive, etc. making it easier and faster to service.&#8221;</p>
<p>&#8220;Unfortunately, the certificate introduced an unintended security vulnerability,&#8221; the company said in a written statement. &#8220;To address this, we are providing our customers with <a href="https://dellupdater.dell.com/Downloads/APP009/eDellRootCertRemovalInstructions.docx" target="_blank">instructions</a> to permanently remove the certificate from their systems via direct email, on our support site and Technical Support.&#8221;</p>
<p>In the meantime, Dell says it is removing the certificate from all Dell systems going forward.<span id="more-33044"></span></p>
<p>&#8220;Note, commercial customers who image their own systems will not be affected by this issue,&#8221; the company&#8217;s statement concluded. &#8220;Dell does not pre-install any adware or malware. The certificate will not reinstall itself once it is properly removed using the recommended Dell process.&#8221;</p>
<div id="attachment_33049" style="width: 291px" class="wp-caption alignleft"><a href="media/eabdaca0.dellcert.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/dellcert.png"><img class=" wp-image-33049" src="media/67850309.dellcert-580x739.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/dellcert-580x739.png" alt="The vulnerable certificate from Dell. Image: Joe Nord" width="281" height="358" /></a><p class="wp-caption-text">The vulnerable certificate from Dell. Image: Joe Nord</p></div>
<p>It&#8217;s unclear why nobody at Dell saw this as a potential problem, especially since Dell&#8217;s competitor <strong>Lenovo</strong> suffered a very similar security nightmare earlier this year when it shipped an online ad tracking component called <a href="http://www.theguardian.com/technology/2015/feb/26/how-can-i-find-and-remove-superfish-and-similar-malware" target="_blank">Superfish</a> with all new computers.</p>
<p>Researchers later discovered that Superfish exposed users to having their Web traffic intercepted by anyone else who happened to be on that user&#8217;s local network. Lenovo later issued a fix and said it would no longer ship computers with the vulnerable component.</p>
<p>Dell&#8217;s Frink said the company would not divulge how many computers it has shipped in the vulnerable state. But <a href="http://www.idc.com/getdoc.jsp?containerId=prUS25955515" target="_blank">according to industry watcher IDC</a>, the third-largest computer maker will ship a little more than 10 million computers worldwide in the third quarter of 2015.</p>
<p><strong>Zakir Durumeric</strong>, a Ph.D. student and research fellow in computer science and engineering at the <strong>University of Michigan</strong>, helped build a tool on his site &#8212; <a href="https://zmap.io/dell" target="_blank">https://zmap.io/dell</a> &#8212; which should tell Dell users if they&#8217;re running a vulnerable system.</p>
<p>Durumeric said the major browser makers will most likely address this flaw in future updates soon.</p>
<p>&#8220;My guess is this has to be addressed by the browser makers, and that we&#8217;ll seem them blocking&#8221; the eDellRoot certificate. &#8220;My advice to end users is to make sure their browsers are up-to-date.&#8221;</p>
<p>Further reading:</p>
<p>An <a href="https://www.reddit.com/r/technology/comments/3twmfv/dell_ships_laptops_with_rogue_root_ca_exactly/" target="_blank">in-depth discussion</a> of this issue on <strong>Reddit</strong>.</p>
<p><strong>Dan Goodin</strong>&#8216;s <a href="http://arstechnica.com/security/2015/11/dell-does-superfish-ships-pcs-with-self-signed-root-certificates/" target="_blank">coverage</a> over at <strong>Ars Technica</strong>.</p>
<p><a href="http://en.community.dell.com/dell-blogs/direct2dell/b/direct2dell/archive/2015/11/23/response-to-concerns-regarding-edellroot-certificate" target="_blank">Dell&#8217;s blog advisory</a>.</p>
<p><strong>Update, 1:15 a.m. ET:</strong> Added link to Dell&#8217;s instructions for removing the problem.</p>


feed_id: http://krebsonsecurity.com/?p=33033
title: How to Enable Multifactor Security on Amazon
uri: How-to-Enable-Multifactor-Security-on-Amazon
url: http://krebsonsecurity.com/2015/11/how-to-enable-multifactor-security-on-amazon/
content:
<p><strong>Amazon</strong> has added multi-factor authentication to help customers better secure their accounts from hackers. With this new feature enabled, thieves would have to know your username, password, and have access to your mobile device or impersonate you to your mobile provider in order to hijack your Amazon account. The security feature allows users to receive a one-time code via text message, automated phone call, or third-party app &#8212; such as <strong>Google Authenticator</strong>.</p>
<div id="attachment_33035" style="width: 590px" class="wp-caption aligncenter"><a href="media/507dea50.amazon2fa1.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/amazon2fa1.png"><img class="size-medium wp-image-33035" src="media/b9fb62e4.amazon2fa1-580x332.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/amazon2fa1-580x332.png" alt="Step one of enabling multi-factor identification on your Amazon account." width="580" height="332" /></a><p class="wp-caption-text">Step one of enabling multi-factor identification on your Amazon account.</p></div>
<p>Multi-factor authentication, also often called &#8220;two-step&#8221; or &#8220;two factor&#8221; authentication, is a great way to improve the security of your various online accounts (<a href="https://twofactorauth.org/" target="_blank">where available</a>). With multi-factor logins enabled, even if thieves somehow steal your account username and password they&#8217;ll still need access to the second factor &#8212; your mobile phone &#8212; to successfully hijack your account.</p>
<p>Users can instruct Amazon to &#8220;remember&#8221; each device, which disables future prompts for the second factor on that device going forward. If Amazon later detects a login attempt from a device it does not recognize as associated with that account, it will prompt for the code from the second factor &#8212; text message, voice call, or app (whichever you choose).<span id="more-33033"></span></p>
<p>I&#8217;m not sure I succeeded the first time I tried to set up multi-factor authentication on Amazon. I signed in, clicked &#8220;Your Account,&#8221; and then under &#8220;Account Settings&#8221; clicked &#8220;Change Account Settings.&#8221; That page allowed me to add a mobile number by typing in a code that was sent to my mobile. But when I hit &#8220;Done&#8221; and went back to Amazon&#8217;s home page, I decided to revisit the page only to discover that there are two more steps needed to finish setting up multi-factor authentication.</p>
<p>In step two, Amazon asks for a backup phone number where users can receive text messages or voice calls, in case you don&#8217;t have access to the mobile device added in Step 1. The backup method also can be <a href="https://support.google.com/accounts/answer/1066447?hl=en" target="_blank">Google&#8217;s Authenticator App</a>.</p>
<div id="attachment_33036" style="width: 590px" class="wp-caption aligncenter"><a href="media/7e03f7b6.amazon2fa-backup.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/amazon2fa-backup.png"><img class="size-medium wp-image-33036" src="media/6291a101.amazon2fa-backup-580x419.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/amazon2fa-backup-580x419.png" alt="Step two of three for enabling multi-factor authentication on Amazon." width="580" height="419" /></a><p class="wp-caption-text">Step two of three for enabling multi-factor authentication on Amazon.</p></div>
<p>Step three just explains how it all works and allows users to skip future one-time codes on personal devices.</p>
<div id="attachment_33037" style="width: 590px" class="wp-caption aligncenter"><a href="media/f24cb6a2.amazon2fa-3.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/amazon2fa-3.png"><img class="size-medium wp-image-33037" src="media/9fb6ed6f.amazon2fa-3-580x635.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/amazon2fa-3-580x635.png" alt="Step 3." width="580" height="635" /></a><p class="wp-caption-text">Step 3.</p></div>
<p>If you shop at Amazon, take a few minutes today to turn on multi-factor authentication for your account. While you&#8217;re at it, check out <a href="https://twofactorauth.org/" target="_blank">twofactorauth.org</a> to see if multi-factor is available for other any online services you may use. Also, consider whether you&#8217;re able to <a href="http://krebsonsecurity.com/2015/11/talktalk-script-kids-the-quest-for-og/" target="_blank">beef up the security of the backup email accounts you use for your recovery address</a>.</p>
<p>One final note: Receiving one-time codes by a third-party mobile app that does not require a working connection to the Internet &#8212; such as Google Authenticator &#8212; allows for fewer chances that your one-time codes could be diverted by attackers: Thieves can still <a href="http://krebsonsecurity.com/2012/06/attackers-target-weak-spots-in-2-factor-authentication/" target="_blank">call in to your Internet service provider or mobile provider</a>, pretend to be you, and have your calls and/or texts forwarded to another number that they control.</p>


feed_id: http://krebsonsecurity.com/?p=32963
title: ISIS Jihadi Helpdesk Customer Log, Nov. 20
uri: ISIS-Jihadi-Helpdesk-Customer-Log-Nov-20
url: http://krebsonsecurity.com/2015/11/isis-jihadi-helpdesk-customer-log-nov-20/
content:
<p>From <strong>NBC News</strong> come <a href="http://www.nbcnews.com/storyline/paris-terror-attacks/isis-has-help-desk-terrorists-staffed-around-clock-n464391" target="_blank">revelations</a> that ISIS <em>has its very own web-savvy, 24-hour Jihadi Help Desk</em> manned by a half-dozen senior operatives to assist foot soldiers in spreading their message far and wide. My first reaction to this story was disbelief, then envy (hey, where the heck is <em>my</em> 24/7 support?). But soon enough I forgot about all that, my mind racing with other possibilities.</p>
<p><a href="media/f2122051.jihadihelpdesk.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/jihadihelpdesk.png"><img class="alignright wp-image-33001" src="media/f2122051.jihadihelpdesk.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/jihadihelpdesk.png" alt="jihadihelpdesk" width="236" height="225" /></a>Imagine the epic <a href="https://en.wikipedia.org/wiki/Internet_troll" target="_blank">trolling</a> opportunities available to a bored or disgruntled Jihadi Help Desk operator. For this persona, we need to reach way back into the annals of Internet history to the <a href="http://bofh.ntk.net/BOFH/index.php" target="_blank">Bastard Operator from Hell</a> (BOFH) &#8212; a megalomaniacal system administrator who constantly toyed with the very co-workers he was paid to support. What might a conversation between a jihadi and the Bastard Jihadi Operator from Hell (BJOFH) sound like?</p>
<p>[RECORDED MESSAGE]: <em>Thank you for contacting the ISIS Jihadi Help Desk. We are currently experiencing higher than normal call volume. Please wait and your inquiry will be answered in the order that it was received. This call may be monitored for customer service and Jihadi training purposes.</em></p>
<p><strong>JIHADI:</strong> [audible sigh].</p>
<p>[MANY ISIS ANTHEMS RIFFING OFF OF BILLBOARD 100 HITS LATER&#8230;]</p>
<p><strong>BJOFH:</strong> ISIS Jihadi Helpdesk, Mohammed speaking, how may I help you?</p>
<p><strong>JIHADI:</strong> Finally! I thought someone would never answer! I&#8217;ve been sitting here sweating bullets and listening to the same infidel hold music over and over.</p>
<p><strong>BJOFH:</strong> My sincerest apologies, sir. Someone hit &#8220;reply-all&#8221; on an operational email, and that really lit up our switchboard this morning. Also, most of the encrypted email services we use are under attack by some other terrorist group and are offline at the moment.</p>
<p><strong>JIHADI:</strong> Too bad for them. Seriously, you guys call this 24/7 support?? I&#8217;ve been parked on this couch for hours waiting for some son-of-a-dog to answer!</p>
<p><strong>BJOFH: </strong>[Pause. Deep breath.]&#8230;Well, you&#8217;ve got me now, sir. What can I do to&#8230;er&#8230;for you?</p>
<p><strong>JIHADI:</strong> Right. So I&#8217;ve got a hardware problem. This itchy vest I have on..it keeps beeping, really loud. It&#8217;s getting super annoying, and I&#8217;ve got to have some quiet prayer&#8230;you know&#8230;.me-time&#8230;pretty soon now, understand?</p>
<p><strong>BJOFH:</strong> Yes, I see. Well, good news, brother! I think I can help you. Tell me&#8230;is there a mobile phone attached to the vest?<span id="more-32963"></span></p>
<p><strong>JIHADI:</strong> [inaudible&#8230;fumbling with receiver]&#8230;.uh..yeah there is..Huh&#8230;feels like there&#8217;s one sewn into the left inside pocket.</p>
<p><strong>BJOFH:</strong> So, I&#8217;m going to try something on my end. Sit tight, and I&#8217;ll  be right back.</p>
<p><strong>JIHADI:</strong> [pause] Uh&#8230;okay. But don&#8217;t be gone so long this time!</p>
<p><strong>BJOFH:</strong> [one minute later]&#8230;Thanks for holding. Yeah, looks like I&#8217;m going to have to go ahead and troubleshoot this issue a bit more. Can you do me a favor and call me from the vest phone?</p>
<p><strong>JIHADI:</strong> Uh..wait, through the jacket, you mean?</p>
<p><strong>BJOFH: </strong>Yes, sir. My desk line here is 1-866-GO-JIHAD.</p>
<p><strong>JIHADI:</strong> Okay. But it&#8217;s kinda hard to reach the keypad. So many wires&#8230;.</p>
<p><strong>BJOFH: </strong>Totally fine, sir. Take your time. You should still be able to feel the phone&#8217;s keypad through the pocket fabric.</p>
<p><strong>JIHADI:</strong> Okay yeah, I think I got it. So how do I send the call?</p>
<p><strong>BJOFH:  </strong>If your vest is the model I think it is, the &#8220;Send Message&#8221; button should be the big one in the middle above the keypad.</p>
<p><strong>JIHADI:</strong> [Fumbling with the phone] Okay, is it ringing?</p>
<p><strong>BJOFH:</strong> [Line rings in background] Yep, got it, thanks. Okay, now I&#8217;m going to call you back.</p>
<p><strong>JIHADI:</strong> Okay.</p>
<p><strong>BJOFH:</strong> Great. Do me a favor and just wait until the phone rings at least once before answering, okay?</p>
<p><strong>JIHADI:</strong> Fine, whatever. Just&#8230;today, maybe?</p>
<p><strong>BJOFH:</strong> You bet. Go JIHAD!</p>
<p><strong>JIHADI:</strong> Wait a second! how do I answer&#8230;[fumbling with the receiver]</p>
<p>[Vest phone rings. Line goes dead].</p>
<p>All satire aside, the jihadis take their security and privacy seriously, shouldn&#8217;t you? <strong>Wired.com</strong> has helpfully published a translated <a href="media/2d066d8b.ISIS-OPSEC-Guide.pdf" data-original-source="http://www.wired.com/wp-content/uploads/2015/11/ISIS-OPSEC-Guide.pdf" target="_blank">34-page Opsec Guide</a> (PDF), a document <a href="https://t.co/V7IzxbT0n5" target="_blank">originally printed in Arabic</a> and intended to introduce newbies to basic operational security measures, techniques and technologies. It&#8217;s not the easiest tutorial to read, but it does reference a great many resources worth investigating further.</p>
<p><strong>Update, 5:12 p.m. ET: </strong>An earlier version of this article incorrectly attributed the source of the Opsec article referenced in the last paragraph.</p>


feed_id: http://krebsonsecurity.com/?p=32974
title: Starwood Hotels Warns of Credit Card Breach
uri: Starwood-Hotels-Warns-of-Credit-Card-Breach
url: http://krebsonsecurity.com/2015/11/starwood-hotels-warns-of-credit-card-breach/
content:
<p><strong>Starwood Hotels &amp; Resorts Worldwide</strong> today warned that malware designed to help cyber thieves steal credit and debit card data was found on point-of-sale cash registers at some of the company&#8217;s hotels in North America. The disclosure makes Starwood just the latest in a recent string of hotel chains to acknowledge credit card breach investigations, and comes days after the company announced its <a href="http://news.marriott.com/2015/11/marriott-international-to-acquire-starwood-hotels-resorts-worldwide-creating-the-worlds-largest-hote.html" target="_blank">acquisition</a> by <strong>Marriott International</strong>.</p>
<p><a href="media/291864bd.starwood-home.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/starwood-home.png"><img class="aligncenter size-medium wp-image-32975" src="media/67050ad7.starwood-home-580x218.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/starwood-home-580x218.png" alt="starwood-home" width="580" height="218" /></a></p>
<p>Starwood published <a href="media/ac63a815.Hotel_List.pdf" data-original-source="http://www.starwoodhotels.com/Media/PDF/Corporate/Hotel_List.pdf" target="_blank">a list</a> (PDF) of more than 50 of its hotel properties &#8212; mostly <strong>Sheraton</strong> and <strong>Westin</strong> locations across the United States and Canada &#8212; that were impacted by the breach. According to that list, the breach started as early as November 2014 in some locations, ending sometime in April or May for all affected hotels.</p>
<p>As with other ongoing hotel breaches, the malware that hit Starwood properties affected certain restaurants, gift shops and other point of sale systems at the relevant Starwood properties.</p>
<p>&#8220;We have no indication at this time that our guest reservation or Starwood Preferred Guest membership systems were impacted,&#8221; Starwood President <strong>Sergio Rivera</strong> wrote in <a href="http://www.starwoodhotels.com/html/HTML_Blocks/Corporate/Confidential/Letter.htm?EM=VTY_CORP_PAYMENTCARDSECURITYNOTICE" target="_blank">a letter to affected customers</a>. &#8220;The malware was designed to collect certain payment card information, including cardholder name, payment card number, security code and expiration date. There is no evidence that other customer information, such as contact information, Social Security numbers or PINs, were affected by this issue.&#8221;<span id="more-32974"></span></p>
<p>Starwood joins several other major hotel brands in announcing a malware-driven credit card data breach. In October 2015, <strong>The Trump Hotel Collection</strong> <a href="http://krebsonsecurity.com/2015/10/trump-hotel-collection-confirms-card-breach/" target="_blank">confirmed</a> a report first published by KrebsOnSecurity <a href="http://krebsonsecurity.com/2015/07/banks-card-breach-at-trump-hotel-properties/" target="_blank">in June</a> about a possible card breach at the luxury hotel chain.</p>
<p>On Sept. 25, this author <a href="http://krebsonsecurity.com/2015/09/banks-card-breach-at-hilton-hotel-properties/" target="_blank">first reported</a> that the <strong>Hilton Hotel</strong> chain is investigating reports of a pattern of card fraud traced back to some of its properties. Bank sources said the fraud pattern they&#8217;re seeing all traces back to restaurants and gift shops at various Hilton locations. The company hasn&#8217;t commented further beyond its initial statement in September that it was looking into the matter.</p>
<p>In March, upscale hotel chain <strong>Mandarin Oriental</strong> <a href="http://krebsonsecurity.com/2015/03/credit-card-breach-at-mandarian-oriental/" target="_blank">acknowledged a similar breach</a>. The following month, hotel franchising firm <strong>White Lodging</strong> acknowledged that &#8212; <a href="http://krebsonsecurity.com/2015/04/white-lodging-confirms-second-breach/" target="_blank">for the second time in 12 months</a> &#8212; card processing systems at several of its locations were breached by hackers. Each time, the breach was traced back to point of sale systems at food and beverage outlets inside the White Lodging properties.</p>
<p>Readers should remember that they are not liable for unauthorized debit or credit card charges, but with one big caveat: the onus is on the cardholder to spot and report any unauthorized charges. Keep a close eye on your monthly statements and report any bogus activity immediately. Many card issuers now let customers receive text alerts for each card purchase and/or for any account changes. Take a moment to review the notification options available to you from your bank or card issuer.</p>


feed_id: http://krebsonsecurity.com/?p=32948
title: Federal Legislation Targets “Swatting” Hoaxes
uri: Federal-Legislation-Targets-Swatting-Hoaxes
url: http://krebsonsecurity.com/2015/11/federal-legislation-targets-swatting-hoaxes/
content:
<p>A bill introduced in the U.S. House of Representatives on Wednesday targets &#8220;swatting,&#8221; an increasingly common and costly hoax in which perpetrators spoof a communication to authorities about a hostage situation or other violent crime in progress in the hopes of tricking police into responding at a particular address with deadly force.</p>
<p><a href="media/dc815e7b.swatnet1.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/swatnet1.png"><img class="aligncenter size-full wp-image-32951" src="media/dc815e7b.swatnet1.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/swatnet1.png" alt="swatnet1" width="486" height="331" /></a></p>
<p>The <a href="https://drive.google.com/file/d/0B-QkCUPMetwXemFNYlZvOW4zaVk/view?usp=sharing" target="_blank">Interstate Swatting Hoax Act of 2015</a>, introduced by <strong>Rep. Katherine Clark</strong> (D-Mass.) and <strong>Rep. Patrick Meehan</strong> (R-PA), targets what proponents call a loophole in current law. &#8220;While federal law prohibits using the telecommunications system to falsely report a bomb threat hoax or terrorist attack, falsely reporting other emergency situations is not currently prohibited,&#8221; reads <a href="http://katherineclark.house.gov/index.cfm/press-releases?ID=F71DAD9F-18E6-4B66-8B11-384911DE591B" target="_blank">a statement</a> by the House co-sponsors.</p>
<p>To address this shortcoming, the bill &#8220;would close this loophole by prohibiting the use of the internet telecommunications system to knowingly transmit false information with the intent to cause an emergency law enforcement response.&#8221;<span id="more-32948"></span></p>
<p>&#8220;In recent years, swatting has become a widely used tool for online harassers to attack journalists, academics, domestic violence survivors, and celebrities,&#8221; the lawmakers wrote. &#8220;Perpetrators locate victims’ private information online and use technology to conceal their identity as they contact emergency responders.&#8221;</p>
<div id="attachment_19446" style="width: 295px" class="wp-caption alignright"><a href="media/28a569a7.3-15-2013-11-54-50-AM.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/03/3-15-2013-11-54-50-AM.png"><img class="size-medium wp-image-19446" src="media/f9916235.3-15-2013-11-54-50-AM-285x307.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/03/3-15-2013-11-54-50-AM-285x307.png" alt="Fairfax County Police outside my home on 3/14/13" width="285" height="307" /></a><p class="wp-caption-text">Fairfax County Police outside my home on 3/14/13</p></div>
<p>As the <a href="http://krebsonsecurity.com/2014/05/teen-arrested-for-30-swattings-bomb-threats/" target="_blank">target</a> and <a href="http://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank">victim</a> of multiple swatting hoaxes, I support efforts to crack down on this dangerous crime, which wastes public resources, unnecessarily endangers lives, and diverts first responders away from real emergencies.</p>
<p>However, the bill doesn&#8217;t and can&#8217;t address a big part of the swatting problem: A huge percentage of those involved in swatting are under the age of 18, and the federal justice system simply isn&#8217;t built to handle juvenile offenders. As a result, most cases of youths detained for swatting are handled by state and local authorities. Thus, unless more states pass anti-swatting laws, many of these crimes likely will continue to go unpunished.</p>
<p>California, for example, <a href="http://www.nbcnews.com/news/other/california-governor-signs-bill-crack-down-celebrity-swatting-f8C11126441" target="_blank">has a law on the books</a> that requires convicted swatters to repay any costs associated with the incident, which can range as high as $10,000. Under the California law, which took effect Jan. 1, 2014, convicted swatters can face up to a year in jail.</p>


feed_id: http://krebsonsecurity.com/?p=32934
title: Report: Everyone Should Get a Security Freeze
uri: Report-Everyone-Should-Get-a-Security-Freeze
url: http://krebsonsecurity.com/2015/11/report-everyone-should-get-a-security-freeze/
content:
<p>This author has frequently urged readers to place a security freeze on their credit files as a means of proactively preventing identity theft. Now, a major consumer advocacy group is recommending the same: The <strong>U.S. Public Interest Research Group</strong> (US-PIRG) recently issued a call for all consumers to request credit file freezes <em>before</em> becoming victims of ID theft.</p>
<p><a href="media/6de6d799.everyonegetsafreeze.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/everyonegetsafreeze.png"><img class="aligncenter size-medium wp-image-32938" src="media/ef9b2e62.everyonegetsafreeze-580x415.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/everyonegetsafreeze-580x415.png" alt="everyonegetsafreeze" width="580" height="415" /></a></p>
<p>Each time news of a major data breach breaks, the hacked organization arranges free credit monitoring for all customers potentially at risk from the intrusion. But as I&#8217;ve echoed time and again, credit monitoring services do little if anything to stop thieves from stealing your identity. The best you can hope for from these services is that they will alert you when a thief opens or tries to open a new line of credit in your name.</p>
<p>But with a &#8220;security freeze&#8221; on your credit file at the four major credit bureaus, creditors won&#8217;t even be able to look at your file in order to grant that phony new line of credit to ID thieves.</p>
<p>Thankfully, US-PIRG &#8212; the federation of state public interest research groups &#8212; also is now recommending that consumers file proactive security freezes on their credit files.</p>
<p>&#8220;These constant breaches reveal what’s wrong with data security and data breach response. Agencies and companies hold too much information for too long and don&#8217;t protect it adequately,&#8221; the organization wrote in <a href="media/45a99fad.USPIRGFREEZE_0.pdf" data-original-source="http://uspirg.org/sites/pirg/files/reports/USPIRGFREEZE_0.pdf" target="_blank">a report</a> (PDF) issued late last month. &#8220;Then, they might wait months or even years before informing victims. Then, they make things worse by offering weak, short-term help such as credit monitoring services.&#8221;</p>
<p>The report continues: &#8220;Whether your personal information has been stolen or not, <strong>your best protection against someone opening new credit accounts in your name is the security freeze (also known as the credit freeze), not the often-offered, under-achieving credit monitoring. </strong>Paid credit monitoring services in particular are not necessary because federal law requires each of the three major credit bureaus to provide a free credit report every year to all customers who request one. You can use those free reports as a form of do-it-yourself credit monitoring.&#8221;</p>
<p>Check out the USPIRG&#8217;s full report, <a href="media/45a99fad.USPIRGFREEZE_0.pdf" data-original-source="http://uspirg.org/sites/pirg/files/reports/USPIRGFREEZE_0.pdf" target="_blank">Why You Should Get Security Freezes Before Your Information is Stolen</a> (PDF) for more good advice. In case anything in that report is unclear, in June I posted <a href="http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">a Q&amp;A on security freezes</a>, explaining how they work, how to place them and the benefits and potential drawbacks of placing a freeze.</p>
<p>Have you frozen your credit file? If so, sound off about the experience in the comments. If not, why not?</p>


feed_id: http://krebsonsecurity.com/?p=32911
title: Paris Terror Attacks Stoke Encryption Debate
uri: Paris-Terror-Attacks-Stoke-Encryption-Debate
url: http://krebsonsecurity.com/2015/11/paris-terror-attacks-stoke-encryption-debate/
content:
<p>U.S. state and federal law enforcement officials appear poised to tap into public concern over the terror attacks in France last week to garner support for proposals that would fundamentally weaken the security of encryption technology used by U.S. corporations and citizens. Here&#8217;s a closer look at what&#8217;s going on, and why readers should be tuned in and asking questions.</p>
<p><a href="media/3364f126.encryptedeye.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/encryptedeye.png"><img class="aligncenter size-medium wp-image-32918" src="media/39fea140.encryptedeye-580x386.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/encryptedeye-580x386.png" alt="encryptedeye" width="580" height="386" /></a>Despite early and widely repeated media reports that the terrorists who killed at least 128 people in Paris used strong encryption to disguise their communications, the evidence of this has failed to materialize. An initial <a href="http://www.forbes.com/sites/insertcoin/2015/11/14/why-the-paris-isis-terrorists-used-ps4-to-plan-attacks/" target="_blank">report</a> on Nov. 14 from <em>Forbes</em> titled &#8220;Why the Paris ISIS Terrorists Used PlayStation4 to Plan Attacks&#8221; was later backpedalled to &#8220;How Paris ISIS Terrorists May Have Used PlayStation 4 to Discuss and Plan.&#8221; Turns out there was actually nothing to indicate the attackers used gaming consoles to hide their communications; only that they could do that if they wanted to.</p>
<p><em>Politico</em> <a href="http://www.politico.eu/article/why-terrorists-love-playstation-4/" target="_blank">ran a piece on Sunday</a> that quoted a Belgian government official saying French authorities had confiscated at least one PlayStation 4 gaming console from one of the attacker&#8217;s belongings (hat tip to <a href="http://www.insidesources.com/new-york-times-article-blaming-encryption-paris-attacks/" target="_blank">Insidesources.com</a>).</p>
<p>“It’s unclear if the suspects in the attacks used PlayStation as a means of communication,” the Politico story explained. “But the sophistication of the attacks raises questions about the ability of law enforcement to detect plots as extremists use new and different forms of technology to elude investigators.”</p>
<p>Also on Sunday, <em>The New York Times</em> published a story that included this bit:</p>
<p>&#8220;The attackers are believed to have communicated using encryption technology, according to European officials who had been briefed on the investigation but were not authorized to speak publicly. It was not clear whether the encryption was part of widely used communications tools, like WhatsApp, which the authorities have a hard time monitoring, or something more elaborate. Intelligence officials have been pressing for more leeway to counter the growing use of encryption.&#8221;</p>
<p>After heavy criticism of the story on Twitter, The Times later removed the story from the site (it is archived <a href="https://archive.is/ffvka" target="_blank">here</a>). That paragraph was softened into the following text, which was included in a different Times story later in the day: &#8220;European officials said they believed the Paris attackers had used some kind of encrypted communication, but offered no evidence.&#8221; To its credit, the Times today published <a href="http://www.nytimes.com/2015/11/17/world/europe/encrypted-messaging-apps-face-new-scrutiny-over-possible-role-in-paris-attacks.html" target="_blank">a more detailed look</a> at the encryption debate.</p>
<p>The media may be unwittingly playing into the hands of folks that former NBC reporter <strong>Bob Sullivan</strong> lovingly calls the &#8220;<a href="https://bobsullivan.net/cybercrime/anti-encryption-opportunists-seize-on-paris-attacks-dont-be-fooled/" target="_blank">anti-encryption opportunists</a>,&#8221; i.e., those who support weakening data encryption standards to make it easier for law enforcement officials to lawfully monitor people suspected of terrorist activity.</p>
<p>The directors of the <strong>FBI</strong> , <strong>Central Intelligence Agency</strong> and <strong>National Security Agency</strong> have repeated warned Congress and the technology community that they&#8217;re facing a yawning intelligence gap from smart phone and internet communication technologies that use encryption which investigators cannot crack &#8212; even after being granted the authority to do so by the U.S. courts.</p>
<p>For its part, the Obama administration has reportedly backed down in its bitter dispute with Silicon Valley over the encryption of data on iPhones and other digital devices.</p>
<p>&#8220;While the administration said it would continue to try to persuade companies like Apple and Google to assist in criminal and national security investigations, it determined that the government should not force them to breach the security of their products,&#8221; <a href="http://www.nytimes.com/2015/10/11/us/politics/obama-wont-seek-access-to-encrypted-user-data.html" target="_blank">wrote</a> Nicole Perlroth and David Sanger for The New York Times in October. &#8220;In essence, investigators will have to hope they find other ways to get what they need, from data stored in the cloud in unencrypted form or transmitted over phone lines, which are covered by a law that affects telecommunications providers but not the technology giants.&#8221;</p>
<p>But this hasn&#8217;t stopped proponents of weakening encryption from identifying opportunities to advance their cause. In <a href="https://www.washingtonpost.com/world/national-security/tech-trade-agencies-push-to-disavow-law-requiring-decryption-of-phones/2015/09/16/1fca5f72-5adf-11e5-b38e-06883aacba64_story.html?postshare=9031442410909976" target="_blank">a memo</a> obtained in August by <em>The Washington Post</em>, <strong>Robert Litt</strong>, a lawyer in the Office of the Director of National Intelligence, wrote that the public support for weakening encryption “could turn in the event of a terrorist attack or criminal event where strong encryption can be shown to have hindered law enforcement.”</p>
<p>To that apparent end, law enforcement officials from Manhattan and the City of London are expected on Wednesday to release a &#8220;white paper on smartphone encryption,&#8221; during an annual financial crimes and cybersecurity symposium at <strong>The Federal Reserve Bank of New York</strong>. A <a href="media/ade7ad0e..17.15-Financial-Crimes-and-Cybersecurity-Symposium-Advisory.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/11.17.15-Financial-Crimes-and-Cybersecurity-Symposium-Advisory.pdf" target="_blank">media notice</a> (PDF) about the event was sent out by <strong>Manhattan District Attorney Cyrus R. Vance Jr</strong>., one of the speakers at the event and a vocal proponent of building special access for law enforcement into encrypted communications. Here&#8217;s Vance in <a href="http://www.nytimes.com/2015/08/12/opinion/apple-google-when-phone-encryption-blocks-justice.html" target="_blank">a recent New York Times op-ed</a> on the need for the expanded surveillance powers.</p>
<p><span id="more-32911"></span></p>
<p>Critics say any plans designed to build in secret &#8220;backdoors&#8221; that allow court-ordered access to encrypted communications ultimately would backfire once those backdoors were discovered by crooks and nation states. In her column titled &#8220;<a href="http://www.wired.com/2015/11/paris-attacks-cia-director-john-brennan-what-he-gets-wrong-about-encryption-backdoors/" target="_blank">After Paris Attacks, Here&#8217;s What the CIA Director Gets Wrong About Encryption</a>,&#8221; Wired.com&#8217;s <strong>Kim Zetter</strong> examines security holes in the arguments for weakening encryption.</p>
<p>The aforementioned Bob Sullivan reminds us that weakening domestic encryption laws would simply ensure that the criminals we wish to monitor use non-US encryption technology:</p>
<blockquote><p>&#8220;For starters, U.S. firms that sell products using encryption would create backdoors, if forced by law.  But products created outside the U.S.?  They’d create backdoors only if their governments required it.  You see where I’m going. There will be no global master key law that all corporations adhere to.  By now I’m sure you’ve realized that such laws would only work to the extent that they are obeyed.  Plenty of companies would create rogue encryption products, now that the market for them would explode.  And of course, terrorists are hard at work creating their own encryption schemes.&#8221;</p>
<p>&#8220;There’s also the problem of existing products, created before such a law. These have no backdoors and could still be used. You might think of this as the genie out of the bottle problem, which is real. It’s very,  very hard to undo a technological advance.&#8221;</p>
<p>&#8220;Meanwhile, creation of backdoors would make us all less safe.  Would you trust governments to store and protect such a master key?  Managing defense of such a universal secret-killer <a href="http://www.imdb.com/title/tt0105435/" rel="noreferrer">is the stuff of movie plots.  </a>No, the master key would most likely get out, or the backdoor would be hacked.  That would mean illegal actors would still have encryption that worked, but the rest of us would not. We would be fighting with one hand behind out backs.&#8221;</p>
<p>&#8220;In the end, it’s a familiar argument: disabling encryption would only stop people from using it legally. Criminals and terrorists would still use it illegally.&#8221;</p></blockquote>
<p>Where do you come down on this debate, dear readers? Are you taking advantage of the kinds of technologies and services &#8212; like <a href="https://whispersystems.org/#" target="_blank">Signal</a>, <a href="https://telegram.org/" target="_blank">Telegram</a> and <a href="https://www.wickr.com/" target="_blank">Wickr </a>&#8212; that use encryption the government says it can&#8217;t crack? Sound off in the comments below.</p>


feed_id: http://krebsonsecurity.com/?p=32882
title: Chipotle Serves Up Chips, Guac & HR Email
uri: Chipotle-Serves-Up-Chips-Guac-HR-Email
url: http://krebsonsecurity.com/2015/11/chipotle-serves-up-chips-guac-hr-email/
content:
<p>The restaurant chain <strong>Chipotle Mexican Grill</strong> seems pretty good at churning out huge numbers of huge burritos, but the company may need to revisit some basic corporate cybersecurity concepts. For starters, Chipotle&#8217;s human resources department has been replying to new job applicants using the domain &#8220;<strong>chipotlehr.com</strong>&#8221; &#8212; a Web site name that the company has never owned or controlled.</p>
<p><a href="media/171008bc.chipemail.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/chipemail.png"><img class="alignright wp-image-32889" src="media/171008bc.chipemail.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/chipemail.png" alt="chipemail" width="317" height="212" /></a>Translation: Until last week, anyone could have read email destined for the company&#8217;s HR department just by registering the domain &#8220;chipotlehr.com&#8221;. Worse, Chipotle itself has inadvertently been pointing this out for months in emails to everyone who&#8217;s applied for a job via the company&#8217;s Web site.</p>
<p>This security oversight by Chipotle was brought to light by KrebsOnSecurity.com reader <a href="https://www.linkedin.com/in/michaelkohlman" target="_blank">Michael Kohlman</a>, a professional IT expert who discovered the bug after applying for a job at the food retailer.</p>
<p>Kohlman, who&#8217;s between jobs at the moment, said he submitted his resume and application to Chipotle&#8217;s online HR department not necessarily because he wanted to be a restaurant employee, but more to satisfy the terms of his unemployment benefits (which require him to regularly show proof that he is actively looking for work).</p>
<p>Kohlman said after submitting his resume and application, he received an email from <strong>Chipotle Careers</strong> that bore the return address @chipotlehr.com. The Minnesota native said he became curious about the source of the Chipotle HR email when a reply sent to that address generated an error or &#8220;bounce&#8221; message saying his missive was undeliverable.</p>
<p>&#8220;The canned response was very odd,&#8221; Kohlman said. &#8220;Rather than indicating the email didn&#8217;t exist, [the bounced message] just came back and said it could not resolve the DNS settings.&#8221;</p>
<p>A quick search for ownership records on the domain showed that it had never before been registered. So, Kohlman said, on a whim he plunked down $30 to purchase it.</p>
<p>The welcome message that one receives upon successfully submitting an application for a job at Chipotle discourages users from replying to the message. But Kohlman said a brief look at the incoming email associated with that domain revealed a steady stream of wayward emails to chipotlehr.com &#8212; mainly from job seekers and people seeking password assistance to the Chipotle HR portal.</p>
<p><span id="more-32882"></span></p>
<div id="attachment_32897" style="width: 599px" class="wp-caption aligncenter"><a href="media/1ac3b664.chipoltehr.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/chipoltehr.png"><img class="size-full wp-image-32897" src="media/1ac3b664.chipoltehr.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/chipoltehr.png" alt="A confirmation letter from Chipotle Careers, which for at least several months used the reply address chipotlehr.com, a domain the company didn't own." width="589" height="688" /></a><p class="wp-caption-text">A confirmation letter I got from Chipotle Careers, which for at least several months used the reply address chipotlehr.com, a domain the company didn&#8217;t own.</p></div>
<p>&#8220;In nutshell, everything that goes in email to this HR system could be grabbed, so the potential for someone to abuse this is huge,&#8221; said Kohlman. &#8220;As someone who has made a big chunk of their career defending against cyber-attackers, I’d rather see Chipotle and others learn from their mistakes rather than cause any real damage.&#8221;</p>
<p>Kohlman has since offered to freely give over the domain to the restaurant chain. But Chipotle expressed zero interest in acquiring the free domain. In fact, Chipotle&#8217;s spokesman <strong>Chris Arnold</strong> says the company doesn&#8217;t see this as a big deal at all.</p>
<p>&#8220;The <a href="http://chipotlehr.com/" target="_blank" rel="noreferrer">chipotlehr.com</a> domain is not a functional address and never has been,&#8221; Arnold wrote in an emailed statement. &#8220;It never had any operational significance, and never served to solicit or accept any kind of response. So there has never been a security risk of any kind associated with this. That address is being changed to <a href="http://careers.chipotle.com/" target="_blank" rel="noreferrer">careers.chipotle.com</a> (a domain that we do own), but this has never been functional and is really a non-issue.&#8221;</p>
<p>I suppose that&#8217;s not really a shocking response from a $3.5 billion/year company that only <a href="http://ir.chipotle.com/phoenix.zhtml?c=194775&amp;p=irol-newsArticle&amp;ID=2096183" target="_blank">just last month hired</a> its first chief information officer. Chipotle still doesn&#8217;t have a job position that puts anyone in charge of computer security. One might say the company&#8217;s infosec <a href="http://krebsonsecurity.com/2015/04/whats-your-security-maturity-level/" target="_blank">security maturity level</a> leaves a bit to be desired.</p>
<p>This entire debacle reminds me of a story I wrote for <em>The Washington Post</em> in 2008 titled &#8220;<a href="http://voices.washingtonpost.com/securityfix/2008/03/they_told_you_not_to_reply.html" target="_blank">They Told You Not To Reply</a>&#8220;. That piece was about an adventuresome young man who gamely registered the domain &#8220;donotreply.com&#8221; &#8212; just to see how badly the domain was being abused. Little did he know what he was signing up for: a constant glut of email destined for companies that had dumped customers there for years &#8212; including banks, defense contractors and a whole mess of other organizations that should have known better. He ending up publishing the funniest emails on his blog, and would usually only remove the emails after the offending companies agreed to make a donation to any local animal shelter.</p>


feed_id: http://krebsonsecurity.com/?p=32855
title: JPMorgan Hackers Breached Anti-Fraud Vendor G2 Web Services
uri: JPMorgan-Hackers-Breached-Anti-Fraud-Vendor-G2-Web-Services
url: http://krebsonsecurity.com/2015/11/jpmorgan-hackers-breached-anti-fraud-vendor-g2-web-services/
content:
<p>Buried in the federal indictments <a href="http://krebsonsecurity.com/2015/11/arrests-in-jp-morgan-etrade-scottrade-hacks/" target="_blank">unsealed this week</a> against four men accused of stealing tens of millions of consumer records from <strong>JPMorgan Chase</strong> and other brokerage firms are other unnamed companies that were similarly victimized by the accused. One of them, identified in the indictments only as &#8220;Victim #12,&#8221; is an entity that helps banks block transactions for dodgy goods advertised in spam. Turns out, the hackers targeted this company so that they could more easily push through payments for spam-advertised prescription drugs and fake antivirus schemes.</p>
<p><a href="media/58ec5cb5.g2web.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/g2web.png"><img class="alignright size-full wp-image-32865" src="media/58ec5cb5.g2web.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/g2web.png" alt="g2web" width="252" height="67" /></a>According to multiple sources, Victim #12 is none other than Bellevue, Wash. based <strong>G2 Web Services LLC</strong>, a company that helps banks figure out if a website is fraudulent or is selling contraband. G2 Web Services has not responded to multiple requests for comment.</p>
<p>In the final chapters of my book, <em><a href="http://www.amazon.com/Spam-Nation-Organized-Cybercrime---Epidemic/dp/1402295618/ref=sr_1_1?ie=UTF8&amp;qid=1400765293&amp;sr=8-1&amp;keywords=spam+nation" target="_blank">Spam Nation: The Inside Story of Organized Cybercrime</a></em>, I detailed the work of <strong>The International AntiCounterfeiting Coalition</strong> (IACC), a non-profit organization dedicated to combating product counterfeiting and piracy.</p>
<p>In 2011, G2 Web Services landed <a href="http://www.g2webservices.com/blog/iacc/" target="_blank">a contract</a> to help the IACC conduct &#8220;test buys&#8221; at sites with products that were being advertised via spam. The company would identify which banks (mostly in Asia) were processing payments for these sites, and then <strong>Visa</strong> and <strong>MasterCard</strong> would rain down steep fines on the banks for violating their contracts with the credit card companies. The idea was to follow the money from schemes tied to cybercrime, deter banks from accepting funds from fraudulent transactions, and make it difficult for spammers to maintain stable credit card processing for those endeavors.</p>
<p>Prosecutors say the ringleader of the cybercrime gang accused of breaking into JPMC, <strong>Scottrade,</strong> <strong>E-Trade</strong> and others is 31-year-old <strong>Gery Shalon</strong>, a resident of Tel Aviv and Moscow. Investigators allege Shalon and his co-conspirators monitored credit card transactions processed through their payment processing business to attempt to discern which, if any, were undercover transactions made on behalf of credit card companies attempting to identify unlawful merchants. The government also charges that beginning in or about 2012, Shalon and his co-conspirators hacked into the computer networks of Victim-12 (G2 Web Services).</p>
<p>Shalon and his gang allegedly monitored Victim-12&#8217;s detection efforts, <em>including reading emails of Victim-12 employees so they could take steps to evade detection</em>.</p>
<p>&#8220;In particular, through their unlawful intrusion into Victim-12&#8217;s network, Shalon and his co-conspirators determined which credit and debit card numbers Victim-12 employees were using the make undercover purchases of illicit goods in the course of their effort to detect unlawful merchants,&#8221; Shalon&#8217;s indictment explains. &#8220;Upon identifying those credit and debit card numbers, Shalon and his co-conspirators blacklisted the numbers from their payment processing business, automatically declining any transaction for which payment was offered through one of those credit or debit card numbers.&#8221;<span id="more-32855"></span></p>
<p>According to the U.S. government, Shalon ran <strong>idpay.com</strong>, a dodgy credit card processor that worked with dozens of banks to push through sales for fake antivirus and pharma-spam sites. Interestingly, in 2011, I wrote about a source <a href="http://krebsonsecurity.com/2011/07/azeri-banks-corner-fake-av-pharma-market/" target="_blank">who&#8217;d stumbled upon a portion of the customer database for idpay.com</a><strong>. </strong>As I wrote then:</p>
<blockquote><p>&#8220;The idpay.com database indicates that a large number of fake AV Web sites were using idpay.com to process payments (a partial list is <a title="Win7Security sites processed by idpay.com" href="http://krebsonsecurity.com/wp-content/uploads/2011/07/Win7IDpay.txt" target="_blank">here</a>). The idpay.com database revealed even bigger fish: Among the companies it processed was <strong>rx-partners.com</strong>, a major rogue pharmacy affiliate program that pays hackers and spammers to promote its pharmacy sites.&#8221;</p>
<p>&#8220;Another interesting client that processes payments through idpay.com was <strong>HzMedia Limited</strong>. That entity is owned by<strong> <a href="http://krebsonsecurity.com/?s=igor+gusev&amp;x=0&amp;y=0" target="_blank">Igor Gusev</a></strong>, the founder of <a title="Spamit-GlavMed Pharmacy Networks Exposed" href="http://krebsonsecurity.com/2011/02/spamit-glavmed-pharmacy-networks-exposed/" target="_blank">GlavMed</a>, one of the world’s largest and spammiest rogue Internet pharmacy affiliate programs.&#8221;</p></blockquote>
<p><a href="media/21dc06f4.GusevErecting.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2011/09/GusevErecting.png" target="_blank">Gusev</a> would emerge as one of two major cybercrime kingpins I profiled in <em>Spam Nation</em>.</p>
<p>This story is interesting because it shows how money laundering is such a key component of cybercrime operations, and that anyone who has built such networks likely knows or works with a great many of the world&#8217;s top cybercrooks. It also illustrates the lengths to which organized cybercriminals will go to preserve their business models.</p>
<p>G2 was profiled in a <a href="http://bits.blogs.nytimes.com/2015/10/14/firms-pit-artificial-intelligence-against-hacking-threats/" target="_blank"><em>New York Times</em> story</a> last month on firms that pit artificial intelligence against hacking threats. That piece cited G2 Web&#8217;s ability to spot “transaction laundering,” in which an illegal business tries to appear legitimate by processing transactions through a legal site. The story didn&#8217;t mention a breach, but it quoted a G2 employee on the challenges associated with fighting crooks who possess the means and the motive for hacking those who stand in their way.</p>
<p class="story-body-text">&#8220;The guys who run these illicit sites are also into viruses and malware,&#8221; the Times quoted <strong>Alan Krumholz</strong>, principal data scientist at G2. “It’s a cat-and-mouse game. They go from one business into another.&#8221;</p>
<p class="story-body-text">The full indictment against Shalon is <a href="media/63e147c0.U.S.-v-Shalon-et-al-Indictment-S1.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/U.S.-v-Shalon-et-al-Indictment-S1.pdf" target="_blank">here</a> (PDF). The mention of Victim 12 (G2) is on page 23.</p>


feed_id: http://krebsonsecurity.com/?p=33029
title: Breach at IT Automation Firm LANDESK
uri: Breach-at-IT-Automation-Firm-LANDESK
url: http://krebsonsecurity.com/2015/11/breach-at-it-automation-firm-landesk/
content:
<p><strong>LANDESK</strong>, a company that sells software to help organizations securely and remotely manage their fleets of desktop computers, servers and mobile devices, alerted employees last week that a data breach may have exposed their personal information. But LANDESK employees contacted by this author say the breach may go far deeper for the company and its customers.</p>
<p><a class="lightbox" href="media/3057a7d3.landesk.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/landesk.png"><img class="aligncenter size-medium wp-image-33082" src="media/f60a14bd.landesk-580x431.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/landesk-580x431.png" alt="landesk" width="580" height="431" /></a>The South Jordan, Utah-based LANDESK makes and markets software that helps organizations manage all users, platforms and devices from a single digital dashboard. The company&#8217;s software specializes in automating and integrating IT systems management, endpoint security management, service management, IT asset management, and mobile device management.</p>
<p>On Nov. 18, 2015, LANDESK sent a letter to current and former employees warning of an intrusion, stating that &#8220;it is possible that, through this compromise, hackers obtained personal information, including names and Social Security numbers, of some LANDESK employees and former Wavelink employees.&#8221;</p>
<p>LANDESK declined to answer questions for this story. But the company did share a written statement that mirrors much of the text in the letter sent to affected employees:</p>
<blockquote><p>&#8220;We recently became aware of some unusual activity on our systems and immediately initiated safeguards as a precaution and began an investigation. As part of our ongoing investigation in partnership with a leading computer forensics firm, we recently learned that a small amount of personally identifiable information for a limited number of our employees may have been accessible during the breach. While no data compromises of personally identifiable information are confirmed at this point, we have reached out with information and security resources to individuals who may have been affected. The security of our networks is our top priority and we are acting accordingly.&#8221;</p>
<p>&#8220;The few employees who may have been affected were notified promptly, and at this point the impact appears to be quite small.&#8221;</p></blockquote>
<p>According to a LANDESK employee who spoke on condition of anonymity, the breach was discovered quite recently, but system logs show the attackers <em>first broke into LANDESK&#8217;s network 17 months ago, in June 2014</em>.</p>
<p>The employee, we&#8217;ll call him &#8220;John,&#8221; said the company only noticed the intrusion when several co-workers started complaining of slow Internet speeds. A LANDESK software developer later found that someone in the IT department had been logging into his build server, so he asked them about it. The IT department said it knew nothing of the issue.<span id="more-33029"></span></p>
<p>John said further investigation showed that the attackers were able to compromise the passwords of the global IT director in Utah and another domain administrator from China.</p>
<p>&#8220;LANDESK has found remnants of text files with lists of source code and build servers that the attackers compiled,&#8221; John said. &#8220;They know for a fact that the attackers have been slowly [archiving] data from the build and source code servers, uploading it to LANDESK&#8217;s web servers, and downloading it.&#8221;</p>
<p>The implications are potentially far reaching. This breach happened more than a year and a half ago, during which time several versions and fixes of LANDESK software have been released. LANDESK has thousands of customers in all areas of commerce. By compromising LANDESK and embedding a back door directly in their source code, the attackers could have access to large number of computers and servers worldwide.</p>
<p>The wholesale theft of LANDESK source code also could make it easier for malware and exploit developers to find security vulnerabilities in the company&#8217;s software.</p>
<p>A LANDESK spokesperson would neither confirm nor deny the date of the breach or the source code theft, saying only that the investigation into the breach is ongoing and that the company &#8220;won&#8217;t comment on speculation.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=32878
title: Gas Theft Gangs Fuel Pump Skimming Scams
uri: Gas-Theft-Gangs-Fuel-Pump-Skimming-Scams
url: http://krebsonsecurity.com/2015/11/gas-theft-gangs-fuel-pump-skimming-scams/
content:
<p>Few schemes for monetizing stolen credit cards are as bold as the fuel theft scam: Crooks embed skimming devices inside fuel station pumps to steal credit card data from customers. Thieves then clone the cards and use them to steal hundreds of gallons of gas at multiple filling stations. The gas is pumped into hollowed-out trucks and vans, which ferry the fuel to a giant tanker truck. The criminals then sell and deliver the gas at cut rate prices to shady and complicit fuel station owners.</p>
<p><strong>Agent Steve Scarince</strong> of the <strong>U.S. Secret Service</strong> heads up a task force in Los Angeles that since 2009 has been combating fuel theft and fuel pump skimming rings. Scarince said the crooks who plant the skimmers and steal the cards from fuel stations usually are separate criminal groups from those who use the cards to steal and resell gas.</p>
<div id="attachment_33103" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/db36fb93.externalcardskim.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/externalcardskim.png"><img class="size-medium wp-image-33103" src="media/117ef836.externalcardskim-580x483.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/externalcardskim-580x483.png" alt="External pump skimmers retrieved from LA fuel stations." width="580" height="483" /></a><p class="wp-caption-text">An external pump skimmer is attached to the end of this compromised fuel dispenser in Los Angeles (right).</p></div>
<p>&#8220;Generally the way it works is the skimmer will sell the cards to a fuel theft cell or ring,&#8221; he said. &#8220;The head of the ring or the number two guy will go purchase the credit cards and bring them back to the drivers. More often than not, the drivers don’t know a whole lot about the business. They just show up for work, the boss hands them 25 cards and says, &#8216;Make the most of it, and bring me back the cards that don&#8217;t work.&#8217; And the leader of the ring will go back to the card skimmer and say, &#8216;Okay out of 100 of those you sold me, 50 of them didn’t work.'&#8221;</p>
<p>Scarince said the skimmer gangs will gain access to the inside of the fuel pumps either secretly or by bribing station attendants. Once inside the pumps, the thieves hook up their skimmer to the gas pump&#8217;s card reader and PIN pad. The devices also are connected to the pump&#8217;s electric power &#8212; so they don&#8217;t need batteries and can operate indefinitely.</p>
<div id="attachment_33104" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/a5e0c8fe.internalskim1.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/internalskim1.png"><img class="size-medium wp-image-33104" src="media/4f779e92.internalskim1-580x308.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/internalskim1-580x308.png" alt="Internal pump skimming device seized from a Los Angeles fuel station." width="580" height="308" /></a><p class="wp-caption-text">Internal pump skimming device seized from a Los Angeles fuel station.</p></div>
<p>Most internal, modern pump skimmers are built to record the card data on a storage device that can transmit the data wirelessly via Bluetooth technology. This way, thieves can drive up with a laptop and fill their tank in the time it takes to suck down the card data that&#8217;s been freshly stolen since their last visit.</p>
<p>The Secret Service task force in Los Angels has even found pump skimming devices that send the stolen card data via SMS/text message to the thieves, meaning the crooks don&#8217;t ever have to return to the scene of the crime and can receive the stolen cards and PINs anywhere in the world that has mobile phone service.</p>
<p><span style="text-decoration: underline;">MOBILE BOMBS</span></p>
<p>Scarince said the fuel theft gangs use vans and trucks crudely modified and retrofitted with huge metal and/or plastic &#8220;bladders&#8221; capable of holding between 250 and 500 gallons of fuel.</p>
<p>&#8220;The fuel theft groups will drive a bladder truck from gas station to gas station, using counterfeit cards to fill up the bladder,&#8221; he said. &#8220;Then they&#8217;ll drive back to their compound and pump the fuel into a 4,000 or 5,000 [gallon] container truck.&#8221;</p>
<div id="attachment_33105" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/3311413a.bladdertruck1.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/bladdertruck1.png"><img class="size-medium wp-image-33105" src="media/24a506a5.bladdertruck1-580x323.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/bladdertruck1-580x323.png" alt="A bladder made to look like it's hauling used tires." width="580" height="323" /></a><p class="wp-caption-text">A bladder truck made to look like it&#8217;s hauling used tires. The wooden panel that was hiding the metal tank exposed here has ben removed in this picture.</p></div>
<p>The fuel will be delivered to gas station owners with whom the fuel theft ring has previously brokered with on the price per gallon. And it&#8217;s always a cash transaction.</p>
<p>&#8220;The stations know they&#8217;re buying stolen gas,&#8221; Scarince said. &#8220;They&#8217;re fully aware the fuel is not coming from a legitimate source. There&#8217;s never any paperwork with the fuel driver, and these transactions are missing all the elements of a normal, legitimate transaction between what would be a refinery and a gas station.&#8221;</p>
<div id="attachment_33106" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/00a5c522.bladdertruck2.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/bladdertruck2.png"><img class="size-medium wp-image-33106" src="media/904ff493.bladdertruck2-580x316.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/bladdertruck2-580x316.png" alt="Fuel theft gangs converted this van into a bladder truck. Image: Secret Service." width="580" height="316" /></a><p class="wp-caption-text">Fuel theft gangs converted this van into a bladder truck. Image: Secret Service.</p></div>
<p>Needless to say, the bladder trucks aren&#8217;t exactly road-worthy when they&#8217;re filled to the brim with stolen and highly flammable fuel. From time to time, one of the dimmer bladder truck drivers will temporarily forget his cargo and light up a smoke.</p>
<p>&#8220;Two or three summers ago we had this one guy who I guess was just jonesing for a cigarette,&#8221; Scarince said. &#8220;He lit up and that was the last thing he did.&#8221;</p>
<div id="attachment_33107" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/9e78ae8e.crispycritters.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/crispycritters.png"><img class="size-medium wp-image-33107" src="media/d265c593.crispycritters-580x216.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/crispycritters-580x216.png" alt="This bladder truck went up in smoke (literally)." width="580" height="216" /></a><p class="wp-caption-text">This bladder truck went up in (a) smoke.</p></div>
<p><span id="more-32878"></span>Other bladder trucks have spontaneously burst into flames at filling stations while thieves pumped stolen gas.</p>
<p>&#8220;There have been other fires that took place during the transfer of fuel, where some static sparked and the whole place caught on fire,&#8221; Scarince said. &#8220;These vehicles are not road-worthy by any means. Some of the bladder tanks are poorly made, they leak. The trucks are often overweight and can&#8217;t handle the load. We see things like transmissions giving out, chassis going out. These things are real hazards just waiting to happen.&#8221;</p>
<p>How big are the fuel theft operations in and around Los Angeles? <span class="pullquote pqright"><em>Scarince estimates that at any given time there are 20 to 30 of these deadly bladder trucks trundling down L.A. freeways and side streets.</em></span></p>
<p>&#8220;And that&#8217;s a very conservative guess, just based on what the credit card companies report,&#8221; he said.</p>
<p><strong>Aaron Turner</strong>, vice president of identity service products at <strong>Verifone</strong> &#8212; a major manufacturer of credit card terminals &#8212; leads a team that has been studying many of the skimming devices that the Secret Service has retrieved from compromised filling stations. Turner says there is<span class="s1"> a huge potential for safety-related issues when it comes to skimmers in a gas-pump environment.<span class="Apple-converted-space">  </span></span></p>
<p><span class="s1">&#8220;Every piece of equipment that is installed by gas station owners in the pump area is approved by reviewed and approved according to industry standards, but these skimmers&#8230;not so much,&#8221; Turner said.<span class="Apple-converted-space"> &#8220;</span>One of the skimmers that we retrieved was sparking and arcing when we powered it up in our lab. I think it&#8217;s safe to say that skimmer manufacturers are not getting <a href="https://en.wikipedia.org/wiki/UL_(safety_organization)" target="_blank">UL certifications</a> for their gear.&#8221;</span></p>
<p class="p1"><span style="text-decoration: underline;">COUNTERING FUEL FRAUD</span></p>
<p class="p1">With some fuel theft gangs stealing more than $10 million per year, Scarince said financial institutions and credit card issuers have responded with a range of tactics to detect and stop suspicious fuel station transactions.</p>
<p class="p1">&#8220;A lot more card issuers and merchant processors are really pushing hard on velocity checks,&#8221; Scarince said, referring to a fraud detection technique that reviews transactions for repeating patterns within a brief period. &#8220;If you buy gas in Washington, D.C. and then 30 minutes gas later gas is being purchased on opposite side of the city in a short period of time. Those are things that are going to start triggering questions about the card. So, more checks like that are being tested and deployed, and banks are getting better at detecting this activity.&#8221;</p>
<p>Card issuers also can impose their own artificial spending limits on fuel purchases. <strong>Visa</strong>, for example, caps fuel purchases at $125.  But thieves often learn to work just under those limits.</p>
<p>&#8220;The more intelligent crooks will use only a few cards per station, which keeps them a lower profile,&#8221; Scarince said. &#8220;They&#8217;ll come in a swipe two to three cards and fill up 40-80 gallons and move on down the road to another station. They definitely also have what we determine to be routes. Monday they&#8217;ll drive one direction, and Tuesday they&#8217;ll go the other way, just to make sure they don’t hit the same stations one day after another.&#8221;</p>
<p class="p1">Newer credit and debit cards with embedded chip technology should make the cards more costly and difficult to counterfeit. However, the chip cards still have the card data encoded in plain text on the card&#8217;s magnetic strip, and most fuel stations won&#8217;t have chip-enabled readers for several years to come.</p>
<p class="p1">On Oct. 1, 2015, Visa and MasterCard put in force new rules that can penalize merchants who do not yet have chip-enabled terminals. Under the new rules, merchants that don&#8217;t have the technology to accept chip cards will assume full liability for the cost of fraud from purchases in which the customer presented a chip-enabled card.</p>
<p class="p1">But those rules don&#8217;t apply to fuel stations in the United States until October 2017, and a great many stations won&#8217;t meet that deadline, said Verifone&#8217;s Turner.</p>
<p class="p1">&#8220;The petroleum stations and the trade organizations that represent them have been fairly public in their statements that they don&#8217;t feel they&#8217;re going to hit the 2017 dates,&#8221; Turner said. &#8220;If you look at the cost of replacing these dispensers and the number of systems that have been touched by qualified, licensed technicians&#8230;most of the stations are saying that even if they start this process now they&#8217;re going to struggle to meet that October 2017 date.&#8221;</p>
<p>Turner said that as chip card readers take hold in more retail establishments, card thieves will begin targeting fuel stations more intensively and systematically.</p>
<p>&#8220;We’re moving into this really interesting point of time when I think the criminals are going to focus on the approaches that offer them the greatest return on their investment,&#8221; Turner said. &#8220;<span class="s1">In the future, I think there will be a liability shift specifically for petroleum stations [because] the amount of mag-stripe-facilitated fraud that will happen in that market is going to increase significantly along with chip card deployment.&#8221;</span></p>
<p>Part of the reason Los Angeles is such a hotbed of skimming activity may be related to ethnic <a href="http://www.laweekly.com/news/taking-down-armenian-power-californias-modern-mafia-4824242" target="_blank">Armenian </a><a href="http://gangstersinc.ning.com/profiles/blogs/profile-armenian-power-leader-mher-darbinyan" target="_blank">organized crime</a> members that have invested heavily in fuel theft schemes. Last month, the Justice Department <a href="http://www.justice.gov/usao-cdca/pr/8-charged-federal-court-relation-skimmers-installed-gas-pumps-collect-credit-card-and" target="_blank">announced charges</a> against eight such men accused of planting skimmers in pumps throughout Southern California and Nevada.</p>
<p>Scarince and Turner say there is a great deal of room for the geographic spread of fuel theft scams. Although the bulk of fuel theft activity in the United States is centered around Los Angeles, the organized nature of the crime is slowly spreading to other cities.</p>
<p>&#8220;We are seeing pump skimming now shoot across the country,&#8221; Scarince said. &#8220;Los Angeles is still definitely ground zero, but Florida is now getting hit hard, as are Houston and parts of the midwest. Technology we first saw a couple of years ago in LA we&#8217;re now seeing show up in other locations across the country. They&#8217;re starting to pick on markets that are probably less aware of what’s going on as far as skimming goes and don’t secure their pumps as well as most stations do here.&#8221;</p>
<p><span style="text-decoration: underline;">WHAT CAN  YOU DO?</span></p>
<p>Avoid sketchy-looking stations and those that haven&#8217;t started using tamper-evident seals on their pumps.</p>
<p>&#8220;The fuel theft gangs certainly scout out the stations beforehand, looking for stations that haven&#8217;t upgraded their pump locks and haven&#8217;t started <a href="http://krebsonsecurity.com/2015/02/fuel-station-skimmers-primed-at-the-pump/" target="_blank">using tamper seals</a>,&#8221; Scarince said. &#8220;If some franchised station decided not to spend the money to upgrade their systems with these security precautions, they&#8217;re going to be targeted.&#8221;</p>
<p>Scarince says he also tends to use pumps that are closest to the attendants.</p>
<p>&#8220;Those are less likely to have skimmers in or on them than street-side pumps,&#8221; he said.</p>
<p>Consumers should remember that they&#8217;re not liable for fraudulent charges on their credit or debit cards, but they still have to report the phony transactions. There is no substitute for keeping a close eye on your card statements. Also, use credit cards instead of debit cards at the pump; having your checking account emptied of cash while your bank sorts out the situation can be a huge hassle and create secondary problems (bounced checks, for instance).</p>


