# articles

feed_id: http://krebsonsecurity.com/?p=34566
title: All About Fraud: How Crooks Get the CVV
uri: All-About-Fraud-How-Crooks-Get-the-CVV
url: http://krebsonsecurity.com/2016/04/all-about-fraud-how-crooks-get-the-cvv/
content:
<p>A longtime reader recently asked: &#8220;How do online fraudsters get the 3-digit <a href="https://en.wikipedia.org/wiki/Card_security_code" target="_blank">card verification value</a> (CVV or CVV2) code printed on the back of customer cards if merchants are forbidden from storing this information? The answer: If not via phishing, probably by installing a Web-based keylogger at an online merchant so that all data that customers submit to the site is copied and sent to the attacker&#8217;s server.</p>
<p><b>Kenneth Labelle, </b>a regional director at insurer<b> Burns-Wilcox.com</b>, wrote:</p>
<blockquote><p>&#8220;So, I am trying to figure out how card not present transactions are possible after a breach due to the CVV. If the card information was stolen via the point-of-sale system then the hacker should not have access to the CVV because its not on the magnetic strip. So how in the world are they committing card not present fraud when they don’t have the CVV number? I don’t understand how that is possible with the CVV code being used in online transactions.&#8221;</p></blockquote>
<p>First off, &#8220;dumps&#8221; &#8212; or credit and debit card accounts that are stolen from hacked point of sale systems via skimmers or malware on cash register systems &#8212; retail for about $20 apiece on average in the cybercrime underground. Each dump can be used to fabricate a new physical clone of the original card, and thieves typically use these counterfeits to buy goods from big box retailers that they can easily resell, or to extract cash at ATMs.</p>
<p>However, when cyber crooks wish to defraud online stores, they don&#8217;t use dumps. That&#8217;s mainly because online merchants typically require the CVV, criminal dumps sellers don&#8217;t bundle CVVs with their dumps.</p>
<p>Instead, online fraudsters turn to &#8220;CVV shops,&#8221; shadowy cybercrime stores that sell packages of cardholder data, including customer name, full card number, expiration, CVV2 and ZIP code. These CVV bundles are far cheaper than dumps &#8212; typically between $2-$5 apiece &#8212; in part because the are useful mainly just for online transactions, but probably also because overall they more complicated to &#8220;cash out&#8221; or make money from them.</p>
<div align="center"><iframe src="http://www.youtube.com/embed/QG2YUlm92y4" width="520" height="415" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p><span id="more-34566"></span>The vast majority of the time, this CVV data has been stolen by Web-based keyloggers. This is a relatively uncomplicated program that behaves much like a banking Trojan does on an infected PC, except it’s designed to steal data from Web server applications.</p>
<p>PC Trojans like ZeuS, for example, siphon information using two major techniques: snarfing passwords stored in the browser, and conducting “form grabbing” — capturing any data entered into a form field in the browser before it can be encrypted in the Web session and sent to whatever site the victim is visiting.</p>
<p>Web-based keyloggers also can do form grabbing, ripping out form data submitted by visitors — including names, addresses, phone numbers, credit card numbers and card verification code — as customers are submitting the data during the online checkout process.</p>
<p>These attacks drive home one immutable point about malware’s role in subverting secure connections: Whether resident on a Web server or on an end-user computer, if either endpoint is compromised, it’s ‘game over’ for the security of that Web session. With PC banking trojans, it’s all about surveillance on the client side pre-encryption, whereas what the bad guys are doing with these Web site attacks involves sucking down customer data post- or pre-encryption (depending on whether the data was incoming or outgoing).</p>
<p>If you&#8217;re responsible for maintaining or securing Web sites, it might be a good idea to get involved in one or more local groups that seek to help administrators. Professional and semi-professionals are welcome at local chapter meetings of <a href="https://www.owasp.org/index.php/Main_Page" target="_blank">OWASP</a>, <a href="https://www.reddit.com/r/netsec/wiki/meetups/citysec" target="_blank">CitySec</a>, <a href="https://www.issa.org/" target="_blank">ISSA</a> or <a href="http://www.securitybsides.com/w/page/12194156/FrontPage" target="_blank">Security Bsides</a> meetups.</p>


feed_id: http://krebsonsecurity.com/?p=34598
title: Dental Assn Mails Malware to Members
uri: Dental-Assn-Mails-Malware-to-Members
url: http://krebsonsecurity.com/2016/04/dental-assn-mails-malware-to-members/
content:
<p>The <strong>American Dental Association</strong> (ADA) says it may have inadvertently mailed malware-laced USB thumb drives to thousands of dental offices nationwide.</p>
<p>The problem first came to light in <a href="http://www.dslreports.com/forum/r30717075-ADA-just-sent-me-a-surprise" target="_blank">a post</a> on the <strong>DSL Reports Security Forum. </strong>DSLR member &#8220;<a href="https://www.dslreports.com/useremail/u/203342" target="_blank">Mike</a>&#8221; from Pittsburgh got curious about the integrity of a USB drive that the ADA mailed to members to share updated &#8220;dental procedure codes&#8221; &#8212; codes that dental offices use to track procedures for billing and insurance purposes.</p>
<p>&#8220;Oh wow the usually inept ADA just sent me new codes,&#8221; Mike wrote. &#8220;I bet some marketing genius had this wonderful idea instead of making it downloadable. I can&#8217;t wait to plug an unknown USB into my computer that has <a href="http://www.hipaa.com/hipaa-protected-health-information-what-does-phi-include/" target="_blank">PHI/HIPAA</a> on it&#8230;&#8221; [link added].</p>
<div id="attachment_34607" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-34607" src="media/80eac83c.adadrives-580x572.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/adadrives-580x572.png" alt="The ADA says some flash drives mailed to members contained malware." width="580" height="572" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/04/adadrives-580x572.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/04/adadrives.png 593w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The ADA says some flash drives mailed to members contained malware. Image: Mike</p></div>
<p>Sure enough, Mike looked at the code inside one of the files on the flash drive and found it tries to open <a href="https://virustotal.com/en/url/ec913c03b058f62934ae06b69bd795ecd8367f213799df82a4653b1cd3fffcfd/analysis/1461375227/" target="_blank">a Web page</a> that has long been tied to malware distribution. The domain is used by crooks to infect visitors with malware that lets the attackers gain full control of the infected Windows computer.<span id="more-34598"></span></p>
<p>Reached by KrebsOnSecurity, the ADA said it send the following email to members who have shared their email address with the organization:</p>
<blockquote><p>&#8220;We have received a handful of reports that malware has been detected on some flash drives included with the 2016 CDT manual,&#8221; the ADA said. &#8220;The &#8216;flash drive&#8217; is the credit card sized USB storage device that contains an electronic copy of the CDT 2016 manual. It is located in a pocket on the inside back cover of the manual. Your anti-virus software should detect the malware if it is present. However, if you haven’t used your CDT 2016 flash drive, please throw it away.</p>
<p>To give you access to an electronic version of the 2016 CDT manual, we are offering you the ability to download the PDF version of the 2016 CDT manual that was included on the flash drive.</p>
<p>To download the PDF version of the CDT manual:</p>
<p>1. Click on the link »ebusiness.ada.org/login/ ··· ion.aspx<br />
2. Log in with your ADA.org user ID and password<br />
3. After you log in you will automatically be directed to a page showing CDT 2016 Digital Edition.<br />
4. Click on the “Download” button to save the file to your computer for use.</p>
<p>If you have difficulty accessing or downloading the file, please call 1.800.947.4746 and a Member Service Advisor will be happy to assist you.</p>
<p>Many of the flash drives do not contain the Malware. If you have already used your flash drive and it worked as expected (it displayed a menu linking to chapters of the 2016 CDT manual), you may continue using it.</p>
<p>We apologize if this issue has caused you any inconvenience and thank you for being a valued ADA customer.&#8221;</p></blockquote>
<p>This incident could give new meaning to the term &#8220;root canal.&#8221; It&#8217;s not clear how the ADA could make a statement that anti-virus should detect the malware, since presently only some of the many antivirus tools out there will flag the malware link as malicious.</p>
<p>In response to questions from this author, the ADA said the USB media was manufactured in China by a subcontractor of an ADA vendor, and that some 37,000 of the devices have been distributed. The not-for-profit ADA is the nation&#8217;s largest dental association, with more than 159,000 members.</p>
<p>&#8220;Upon investigation, the ADA concluded that only a small percentage of the manufactured USB devices were infected,&#8221; the organization wrote in an emailed statement. &#8220;Of note it is speculated that one of several duplicating machines in use at the manufacturer had become infected during a production run for another customer. That infected machine infected our clean image during one of our three production runs. Our random quality assurance testing did not catch any infected devices. Since this incident, the ADA has begun to review whether to continue to use physical media to distribute products.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=34596
title: A Dramatic Rise in ATM Skimming Attacks
uri: A-Dramatic-Rise-in-ATM-Skimming-Attacks
url: http://krebsonsecurity.com/2016/04/a-dramatic-rise-in-atm-skimming-attacks/
content:
<p>Skimming attacks on ATMs increased at an alarming rate last year for both American and European banks and their customers, according to recent stats collected by fraud trackers. The trend appears to be continuing into 2016, with outbreaks of skimming activity visiting a much broader swath of the United States than in years past.</p>
<div id="attachment_33806" style="width: 214px" class="wp-caption alignright"><a class="lightbox" href="media/a5b64ab0.networkskim2.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/02/networkskim2.png"><img class="wp-image-33806 size-full" src="media/a5b64ab0.networkskim2.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/02/networkskim2.png" alt="Two network cable card skimming devices, as found attached to this ATM." width="204" height="397" /></a><p class="wp-caption-text">Two network cable card skimming devices, as found attached to this ATM.</p></div>
<p>In a series of recent alerts, the <strong>FICO Card Alert Service</strong> warned of large and sudden spikes in ATM skimming attacks. On April 8, FICO <a href="http://www.fico.com/en/newsroom/atm-compromises-in-us-jumped-six-fold-in-2015-fico-reports-04-08-2016" target="_blank">noted</a> that its fraud-tracking service recorded <em>a 546 percent increase in ATM skimming attacks from 2014 to 2015</em>.</p>
<p>&#8220;The number of ATM compromises in 2015 was the highest ever recorded by the FICO Card Alert Service, which monitors hundreds of thousands of ATMs in the US,&#8221; the company said. &#8220;Criminal activity was highest at non-bank ATMs, such as those in convenience stores, where 10 times as many machines were compromised as in 2014.&#8221;</p>
<p>While 2014 saw skimming attacks targeting mainly banks in big cities on the east and west coasts of the United States, last year&#8217;s skimming attacks were far more spread out across the country, the FICO report noted.</p>
<p>Earlier this year, I published a post about skimming attacks targeting non-bank ATMs using hidden cameras and skimming <a href="http://krebsonsecurity.com/2016/02/skimmers-hijack-atm-network-cables/" target="_blank">devices plugged into the ATM network cables</a> to intercept customer card data. The skimmer pictured in that story was at a 7-Eleven convenience store.</p>
<p>Since that story ran I&#8217;ve heard from multiple banking industry sources who said they have seen a spike in ATM fraud targeting cash machines in 7-Elevens and other convenience stores, and that the commonality among the machines is that they are all operated by ATM giant <strong>Cardtronics</strong> (machines in 7-Eleven locations made up for 17.5 percent of Cardtronics&#8217; revenue last year, according to <a href="http://www.atmmarketplace.com/articles/7-eleven-cardtronics-to-part-ways-in-us/" target="_blank">this report</a> at ATM Marketplace).</p>
<p>Some financial institutions are taking dramatic steps to head off skimming activity. <strong>Trailhead Credit Union</strong> in Portland, Ore., for example, has posted a notice to customers atop its Web site, stating:</p>
<blockquote><p>&#8220;ALERT: Until further notice, we have turned off ATM capabilities at all 7-11 ATMs due to recent fraudulent activity. Please use our ATM locator for other locations. We are sorry for the inconvenience.&#8221;</p></blockquote>
<div id="attachment_34452" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/4b7595cf.trailheadCU.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/trailheadCU.png"><img class="wp-image-34452 size-medium" src="media/996adefc.trailheadCU-580x437.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/trailheadCU-580x437.png" alt="Trailhead Credit Union has stopped allowing members to withdraw cash from 7-11 ATMs." width="580" height="437" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/04/trailheadCU-580x437.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/04/trailheadCU-768x579.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/04/trailheadCU-940x708.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/04/trailheadCU.png 1181w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Trailhead Credit Union has stopped allowing members to withdraw cash from 7-11 ATMs.</p></div>
<p>7-Eleven did not respond to requests for comment. Cardtronics said it wasn&#8217;t aware of any banks blocking withdrawals across the board at 7-11 stores or at Cardtronics machines.</p>
<p>&#8220;While Cardtronics is aware that a single financial institution [Xceed Financial Credit Union] temporarily restricted ATM access late in 2015, it soon thereafter restored full ATM access to its account holders,&#8221; the company said in a statement. &#8220;As the largest ATM services provider, Cardtronics has a long history of executing a layered security strategy and implementing innovative security enhancements at our ATMs. As criminals modify their attack, Cardtronics always has and always will aggressively respond, reactively and proactively, with innovation to address these instances.&#8221;<span id="more-34596"></span></p>
<h4>DRAMA IN DC</h4>
<p>A bit closer to home for this author, on April 22 FICO pushed an alert to its customers and partners warning about &#8220;a recent and dramatic increase in skimming fraud perpetrated at a chain of discount supercenters point-of-sale (POS) terminals,&#8221; in an around the Washington, D.C. area, including Frederick, Ellicott City and Mt. Airy in Maryland, and in Fredricksburg, Va.</p>
<p><a class="lightbox" href="media/4544b103.ficoalertbulletin.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/ficoalertbulletin.png"><img class="aligncenter wp-image-34627 size-medium" src="media/c0789b8f.ficoalertbulletin-580x494.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/ficoalertbulletin-580x494.png" alt="ficoalertbulletin" width="580" height="494" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/04/ficoalertbulletin-580x494.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/04/ficoalertbulletin.png 723w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>&#8220;As this fraud activity has appeared and progressed suddenly, it is likely that sites in other cities and other geographic areas will be targeted by organized criminal groups,&#8221; the organization cautioned.</p>
<h4>EUROPE</h4>
<p>Banks in Europe also enjoyed an increase in skimming attacks of all kinds last year. According to statistics shared by the European ATM Security Team (EAST), during 2015 there were 18,738 skimming attacks reported against European ATMs. That&#8217;s a 19% increase from the previous year and equates to 51 attacks per 1000 ATMs over the period.</p>
<p>&#8220;During 2015 total losses of 327.48 million euros were reported,&#8221; EAST wrote. &#8220;This is a 17% increase when compared to the total losses of 279.86 million euros reported for 2014 and equates to losses of 884,069 euros per 1000 ATMs over the period.&#8221;</p>
<p>EAST&#8217;s report further breaks down the skimming activity by specialization. For example, there were at least 2,657 cases in which a thief tried to blow up or otherwise physically force his way into the cash machine. &#8220;This total also includes data from solid explosive and explosive gas attacks. This is a 34% increase from 2014 and equates to 7.2 attacks per 1000 ATMs over the period.&#8221;</p>
<p>EAST also tracked 15 malware incidents reported against European ATMs in 2015.  All of them were &#8216;cash out&#8217; or <a href="http://krebsonsecurity.com/2015/01/thieves-jackpot-atms-with-black-box-attack/" target="_blank">&#8216;jackpotting&#8217; attacks</a>. According to EAST, this is a 71% decrease from 2014.</p>
<div id="attachment_34636" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/7b99ca40.EAST4-16.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/EAST4-16.png"><img class="wp-image-34636 size-medium" src="media/cad11509.EAST4-16-580x291.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/EAST4-16-580x291.png" alt="Source: EAST" width="580" height="291" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/04/EAST4-16-580x291.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/04/EAST4-16-768x386.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/04/EAST4-16.png 886w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Source: EAST</p></div>
<h4>PROTECT YOURSELF</h4>
<p>As I&#8217;ve noted in countless skimmer stories here, the simplest way to protect yourself from ATM skimming is to <a href="http://krebsonsecurity.com/2012/09/a-handy-way-to-foil-atm-skimmer-scams/" target="_blank">cover your hand when entering your PIN</a>. That&#8217;s because most skimmers rely on hidden cameras to steal the victim&#8217;s PIN.</p>
<p>Interestingly, a stat in <strong>Verizon</strong>&#8216;s new <a href="http://www.verizonenterprise.com/verizon-insights-lab/dbir/" target="_blank">Data Breach Investigations Report</a> released this week bears this out: According to Verizon, in over 90 percent of the breaches in the report last year involving skimmers used a tiny hidden camera to steal the PIN.</p>
<p>The Verizon report also offers this advice about ATM safety: Trust your gut. &#8220;If you think that something looks odd or out of place, don’t use it. While it is increasingly difficult to find signs of tampering, it is not impossible. If you think a device may have been tampered with, move on to another location, after reporting to the merchant or bank staff.&#8221;</p>
<div style="text-align: center;"><iframe src="http://www.youtube.com/embed/JbDdsUh_sTg" width="420" height="315" frameborder="0"></iframe></div>
<p>For more on ATM skimmers and other skimming devices, check out my series <a href="http://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers</a>.</p>


feed_id: http://krebsonsecurity.com/?p=34896
title: Skimmers Found at Walmart: A Closer Look
uri: Skimmers-Found-at-Walmart-A-Closer-Look
url: http://krebsonsecurity.com/2016/05/skimmers-found-at-walmart-a-closer-look/
content:
<p>Recent local news stories about credit card skimmers found in self-checkout lanes at some <strong>Walmart</strong> locations reminds me of a criminal sales pitch I saw recently for overlay skimmers made specifically for the very same card terminals.</p>
<p>Much like <a href="http://krebsonsecurity.com/2016/02/safeway-self-checkout-skimmer-close-up/" target="_blank">the skimmers found at some Safeway locations</a> earlier this year, the skimming device pictured below was designed to be installed in the blink of an eye at self-checkout lanes &#8212; as in recent incidents at Walmart stores in <a href="http://www.fredericksburg.com/news/crime_courts/police-walmart-shoppers-target-of-skimming-thieves/article_7b319a10-13d0-11e6-907e-37d918122bf0.html" target="_blank">Fredericksburg, Va</a>. and <a href="http://www.lex18.com/story/32028489/police-looking-for-men-who-installed-skimmer-at-walmart-self-checkout" target="_blank">Fort Wright, Ky</a>. In these attacks, the skimmers were made to piggyback on card readers sold by payment solutions company <strong>Ingenico</strong>.</p>
<div id="attachment_34900" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/bfab0366.ingenico.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/ingenico.jpg"><img class="wp-image-34900 size-medium" src="media/6cf8ef68.ingenico-580x348.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/ingenico-580x348.jpg" alt="A skimmer made to be fitted to an Ingenico credit card terminal of the kind used at Walmart stores across the country. Image: Hold Security." width="580" height="348" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/05/ingenico-580x348.jpg 580w, http://krebsonsecurity.com/wp-content/uploads/2016/05/ingenico-768x461.jpg 768w, http://krebsonsecurity.com/wp-content/uploads/2016/05/ingenico-940x564.jpg 940w, http://krebsonsecurity.com/wp-content/uploads/2016/05/ingenico.jpg 1280w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A skimmer made to be fitted to an Ingenico credit card terminal of the kind used at Walmart stores across the country. Image: Hold Security.</p></div>
<p>This Ingenico &#8220;overlay&#8221; skimmer has a PIN pad overlay to capture the user’s PIN, and a mechanism for recording the data stored on a card’s magnetic stripe when customers swipe their cards at self-checkout aisles. The wire pictured at the bottom is for offloading the data from the card skimmers once thieves have retrieved the devices from compromised checkout lanes.</p>
<p>This particular skimmer retails for between $200 to $300, but that price doesn&#8217;t include the electronics that power the device and store the stolen card data.</p>
<p>Here&#8217;s how this skimmer looks when it&#8217;s attached. Think you&#8217;d be able to spot it?</p>
<div id="attachment_34899" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/c7e13bdc.ingenico_inserted.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/ingenico_inserted.jpg"><img class="wp-image-34899 size-medium" src="media/8122626b.ingenico_inserted-580x773.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/ingenico_inserted-580x773.jpg" alt="ingenico_inserted" width="580" height="773" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/05/ingenico_inserted-580x773.jpg 580w, http://krebsonsecurity.com/wp-content/uploads/2016/05/ingenico_inserted-768x1024.jpg 768w, http://krebsonsecurity.com/wp-content/uploads/2016/05/ingenico_inserted-940x1253.jpg 940w, http://krebsonsecurity.com/wp-content/uploads/2016/05/ingenico_inserted.jpg 960w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Image credit: Hold Security.</p></div>
<p>Walmart last year began asking customers with more secure chip-enabled cards to dip the chip instead of swipe the stripe. Chip-based cards are more expensive and difficult for thieves to counterfeit, and they can help mitigate the threat from most modern card-skimming methods that read the cardholder data in plain text from the card’s magnetic stripe. Those include malicious software at the point-of-sale terminal, as well as physical skimmers placed over card readers at self-checkout lanes.<span id="more-34896"></span></p>
<p>In a recent column – <a href="http://krebsonsecurity.com/2016/02/the-great-emv-fake-out-no-chip-for-you/" target="_blank">The Great EMV Fake-Out: No Chip for You!</a> – I explored why so few retailers currently allow or require chip transactions, even though many of them already have all the hardware in place to accept chip transactions.</p>
<p>For its part, Walmart has deployed chip-enabled readers, and last year began requiring customers with chip cards to use them as such. Indeed, it&#8217;s interesting to note that the Ingenico overlay skimmer pictured above also includes the slot at the bottom center of the device where customers can insert a chip card, although in these recent skimming incidents at Walmart the thieves were no doubt hoping more customers would simply swipe.</p>
<p>The <strong>Mercator Advisory Group</strong> <a href="https://www.nerdwallet.com/blog/credit-cards/emv-shift-credit-cards-not-as-safe/" target="_blank">notes</a> that only 60 percent of all credit cards in the United States have been updated with chip cards, with debit cards lagging further behind. Even so, only 20 percent of card terminals in the U.S. have been activated for chip use as of April 2016, Mercator found.</p>
<p>The United States is the last of the G20 nations to move to chip-based cards &#8212; much to the delight of fraudsters and organized cybercrime gangs that have siphoned tens of millions of credit and debit cards in major data breaches at retailers these past few years. Financial industry consultant <strong>Aite Group </strong><a href="http://www.cnbc.com/2016/05/06/those-new-chip-cards-will-cause-14-billion-in-fraud-by-2020.html" target="_blank">predicts</a> that credit card fraud stemming from hacking will reach a record level in 2016 &#8212; $4 billion. Aite Group says fraudsters are busy milking this cash cow for all it&#8217;s worth as U.S. merchants start to pivot toward chip-card transactions.</p>
<div id="attachment_34907" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-34907" src="media/24fd23ca.walmartskim-580x351.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/walmartskim-580x351.png" alt="Footage of crooks installing the card skimmers at a Walmart self-checkout terminal. Source: WLWT." width="580" height="351" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/05/walmartskim-580x351.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/05/walmartskim-768x465.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/05/walmartskim-940x569.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/05/walmartskim.png 1095w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Footage of crooks installing the card skimmers at a Walmart self-checkout terminal in Kentucky this month. Source: WLWT.</p></div>
<p><strong>Update, 12:41 p.m. ET:</strong> Corrected location of Kentucky Walmart.</p>


feed_id: http://krebsonsecurity.com/?p=34851
title: Noodles & Company Probes Breach Claims
uri: Noodles-Company-Probes-Breach-Claims
url: http://krebsonsecurity.com/2016/05/noodles-company-probes-breach-claims/
content:
<p><strong>Noodles &amp; Company </strong><a href="http://www.nasdaq.com/symbol/ndls" target="_blank">[NASDAQ: NDLS]</a><strong>, </strong>a fast-casual restaurant chain with more than 500 stores in 35 U.S. states, says it has hired outside investigators to probe reports of a credit card breach at some locations.</p>
<p><img class="alignright wp-image-34855" src="media/92968eb1.noodles.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/noodles.png" alt="noodles" width="269" height="106" />Over the past weekend, KrebsOnSecurity began hearing from sources at multiple financial institutions who said they&#8217;d detected a pattern of fraudulent charges on customer cards that were used at various Noodles &amp; Company locations between January 2016 and the present.</p>
<p>Asked to comment on the reports, Broomfield, Colo.-based Noodles &amp; Company issued the following statement:</p>
<p>&#8220;We are currently investigating some unusual activity reported to us Tuesday, May 16, 2016 by our credit card processor. Once we received this report, we alerted law enforcement officials and we are working with third party forensic experts. Our investigation is ongoing and we will continue to share information.”</p>
<p>The investigation comes amid a fairly constant drip of card breaches at main street retailers, restaurant chains and hospitality firms. Wendy&#8217;s <a href="http://krebsonsecurity.com/2016/05/wendys-breach-affected-5-of-restaurants/" target="_blank">reported last week</a> that a credit card breach that began in the autumn of 2015 impacted 300 of its 5,500 locations.<span id="more-34851"></span></p>
<p>Cyber thieves responsible for these attacks use security weaknesses or social engineering to remotely install malicious software on retail point-of-sale systems. This allows the crooks to read account data off a credit or debit card&#8217;s magnetic stripe in real time as customers are swiping them at the register.</p>
<p>U.S. banks have been transitioning to providing customers more secure chip-based credit and debit cards, and a greater number of retailers are installing checkout systems that can read customer card data off the chip. The chip encrypts the card data and makes it much more difficult and expensive for thieves to counterfeit cards.</p>
<p>However, most of these chip cards will still hold customer data in plain text on the card’s magnetic stripe, and U.S. merchants that continue to allow customers to swipe the stripe or who do not have chip card readers in place face shouldering all of the liability for any transactions later determined to be fraudulent.</p>
<p>While a great many U.S. retail establishments have already deployed chip-card readers at their checkout lines, <a href="http://krebsonsecurity.com/2016/02/the-great-emv-fake-out-no-chip-for-you/" target="_blank">relatively few have enabled those readers</a>, and are still asking customers to swipe the stripe. For its part, Noodles &amp; Company says it&#8217;s in the process of testing and implementing chip-based readers.</p>
<p>&#8220;The ongoing program we have in place to aggressively test and implement chip-based systems across our network is moving forward,&#8221; the company said in a statement. &#8220;We are actively working with our key business partners to deploy this system as soon as they are ready.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=34864
title: As Scope of 2012 Breach Expands, LinkedIn to Again Reset Passwords for Some Users
uri: As-Scope-of-2012-Breach-Expands-LinkedIn-to-Again-Reset-Passwords-for
url:
http://krebsonsecurity.com/2016/05/as-scope-of-2012-breach-expands-linkedin-to-again-reset-passwords-for-some-users/

content:
<p>A 2012 data breach that was thought to have exposed 6.5 million hashed passwords for LinkedIn users instead likely impacted more than 117 million accounts, the company now says. In response, the business networking giant said today that it would once again force a password reset for individual users thought to be impacted in the expanded breach.</p>
<p><img class="alignright wp-image-34867" src="media/cd818411.leakedin.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/leakedin.png" alt="leakedin" width="267" height="91" />The 2012 breach was first exposed when a hacker posted a list of some 6.5 million unique passwords to a popular forum where members volunteer or can be hired to hack complex passwords. Forum members managed to crack some the passwords, and eventually noticed that an inordinate number of the passwords they were able to crack contained some variation of &#8220;linkedin&#8221; in them.</p>
<p>LinkedIn responded by forcing a password reset on all 6.5 million of the impacted accounts, but it stopped there. But earlier today, <a href="http://motherboard.vice.com/read/another-day-another-hack-117-million-linkedin-emails-and-password" target="_blank">reports surfaced</a> about a sales thread on an online cybercrime bazaar in which the seller offered to sell 117 million records stolen in the 2012 breach. In addition, the paid hacked data search engine <a href="https://www.google.com/url?q=https%3A%2F%2Fwww.leakedsource.com%2Fblog%2Flinkedin&amp;sa=D&amp;sntz=1&amp;usg=AFQjCNGBg2ekwBP9l-UsT57gBgP7kfUy0g" target="_blank">LeakedSource</a> claims to have a searchable copy of the 117 million record database (this service said it found my LinkedIn email address in the data cache, but it asked me to pay $4.00 for a one-day trial membership in order to view the data; I declined).</p>
<p><em>Inexplicably, LinkedIn&#8217;s response to the most recent breach is to repeat the mistake it made with original breach, by once again forcing a password reset for only a subset of its users</em>.</p>
<p>&#8220;Yesterday, we became aware of an additional set of data that had just been released that claims to be email and hashed password combinations of more than 100 million LinkedIn members from that same theft in 2012,&#8221; wrote <strong>Cory Scott</strong>, in <a href="https://blog.linkedin.com/2016/05/18/protecting-our-members" target="_blank">a post on the company&#8217;s blog</a>. &#8220;We are taking immediate steps to invalidate the passwords of the accounts impacted, and we will contact those members to reset their passwords. We have no indication that this is as a result of a new security breach.&#8221;</p>
<p>LinkedIn spokesman <strong>Hani Durzy</strong> said the company has obtained a copy of the 117 million record database, and that LinkedIn believes it to be real.</p>
<p>&#8220;We believe it is from the 2012 breach,&#8221; Durzy said in an email to KrebsOnSecurity. &#8220;How many of those 117m are active and current is still being investigated.&#8221;</p>
<p>Regarding the decision not to force a password reset across the board back in 2012, Durzy said &#8220;We did at the time what we thought was in the best interest of our member base as a whole, trying to balance security for those with passwords that were compromised while not disrupting the LinkedIn experience for those who didn&#8217;t appear impacted.&#8221;</p>
<p>The 117 million figure makes sense: LinkedIn <a href="http://blog.linkedin.com/2015/10/29/400-million-members/" target="_blank">says</a> it has more than 400 million users, but <a href="http://venturebeat.com/2015/10/29/linkedin-now-has-400m-users-but-only-25-of-them-use-it-monthly/" target="_blank">reports suggest</a> only about 25 percent of those accounts are used monthly.<span id="more-34864"></span></p>
<p><strong>Alex Holden</strong>, co-founder of security consultancy <a href="http://www.holdsecurity.com" target="_blank">Hold Security</a>, was among the first to discover the original cache of 6.5 million back in 2012 &#8212; shortly after it was posted to the password cracking forum <strong>InsidePro</strong>. Holden said the 6.5 million encrypted passwords were all unique, and did not include any passwords that were simple to crack with rudimentary tools or resources [full disclosure: Holden&#8217;s site lists this author as an adviser, however I receive no compensation for that role].</p>
<p>&#8220;These were just the ones that the guy who posted it couldn&#8217;t crack,&#8221; Holden said. &#8220;I always thought that the hacker simply didn&#8217;t post to the forum all of the easy passwords that he could crack himself.&#8221;</p>
<div id="attachment_34872" style="width: 236px" class="wp-caption alignleft"><img class=" wp-image-34872" src="media/0466b017.top20li.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/top20li.png" alt="The top 20 most commonly used LinkedIn account passwords, according to LeakedSource." width="226" height="437" /><p class="wp-caption-text">The top 20 most commonly used LinkedIn account passwords, according to LeakedSource.</p></div>
<p>According to LeakedSource, just 50 easily guessed passwords made up more than 2.2 million of the 117 million encrypted passwords exposed in the breach.</p>
<p>&#8220;Passwords were stored in SHA1 with no salting,&#8221; the password-selling site claims. &#8220;This is not what internet standards propose. Only 117m accounts have passwords and we suspect the remaining users registered using FaceBook or some similarity.&#8221;</p>
<p class="p1"><span class="s1">SHA1 is one of several different methods for &#8220;hashing&#8221; &#8212; that is, obfuscating and storing &#8212; plain text passwords. Passwords are “hashed” by taking the plain text password and running it against a theoretically one-way mathematical algorithm that turns the user’s password into a string of gibberish numbers and letters that is supposed to be challenging to reverse. </span></p>
<p class="p1"><span class="s1">The weakness of this approach is that hashes by themselves are static, meaning that the password “123456,” for example, will always compute to the same password hash. To make matters worse, there are plenty of tools capable of very rapidly mapping these hashes to common dictionary words, names and phrases, which essentially negates the effectiveness of hashing. These days, computer hardware has gotten so cheap that attackers can easily and very cheaply build machines capable of computing tens of millions of possible password hashes per second for each corresponding username or email address.</span></p>
<p class="p1">But by adding a unique element, or “salt,” to each user password, database administrators can massively complicate things for attackers who may have stolen the user database and rely upon automated tools to crack user passwords.</p>
<p>LinkedIn said it added salt to its password hashing function following the 2012 breach. But if you&#8217;re a LinkedIn user and haven&#8217;t changed your LinkedIn password since 2012, your password may not be protected with the added salting capabilities. At least, that&#8217;s my reading of the situation from <a href="https://blog.linkedin.com/2012/06/06/linkedin-member-passwords-compromised" target="_blank">LinkedIn&#8217;s 2012 post about the breach</a>.</p>
<p>If you haven&#8217;t changed your LinkedIn password in a while, that would probably be a good idea. Most importantly, if you use your LinkedIn password at other sites, change those passwords to unique passwords. As this breach reminds us, re-using passwords at multiple sites that hold personal and/or financial information about you is a less-than-stellar idea.</p>


feed_id: http://krebsonsecurity.com/?p=34843
title: Microsoft Disables Wi-Fi Sense on Windows 10
uri: Microsoft-Disables-Wi-Fi-Sense-on-Windows-10
url: http://krebsonsecurity.com/2016/05/microsoft-disables-wi-fi-sense-on-windows-10/
content:
<p><strong>Microsoft</strong> has disabled its controversial <a href="http://www.windowsphone.com/en-us/how-to/wp8/connectivity/use-wi-fi-sense-to-get-connected" target="_blank">Wi-Fi Sense</a> feature, a component embedded in <strong>Windows 10</strong> devices that shares access to WiFi networks to which you connect with any contacts you may have listed in <strong>Outlook</strong> and <strong>Skype</strong> &#8212; and, with an opt-in &#8212; your <strong>Facebook</strong> friends.</p>
<p><img class="alignright size-full wp-image-31729" src="media/9b456073.msoptout.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/07/msoptout.png" alt="msoptout" width="257" height="246" />Redmond made the announcement almost as a footnote in its Windows 10 Experience blog, but the feature caused quite a stir when the company&#8217;s flagship operating system first debuted last summer.</p>
<p>Microsoft didn&#8217;t mention the privacy and security concerns raised by Wi-Fi Sense, saying only that the feature was being removed because it was expensive to maintain and that few Windows 10 users were taking advantage of it.</p>
<p>&#8220;We have removed the Wi-Fi Sense feature that allows you to share Wi-Fi networks with your contacts and to be automatically connected to networks shared by your contacts,&#8221; <a href="https://blogs.windows.com/windowsexperience/2016/05/10/announcing-windows-10-insider-preview-build-14342/#FHz4SbouGJKcEhFS.99" target="_blank">wrote</a> <strong>Gabe Aul</strong>, corporate vice president of Microsoft&#8217;s engineering systems team. &#8220;The cost of updating the code to keep this feature working combined with low usage and low demand made this not worth further investment. Wi-Fi Sense, if enabled, will continue to get you connected to open Wi-Fi hotspots that it knows about through crowdsourcing.&#8221;</p>
<p>Wi-Fi Sense doesn&#8217;t share your WiFi network password per se — it shares an encrypted version of that password. But it does allow anyone in your Skype or Outlook or <strong>Hotmail</strong> contacts lists to waltz onto your Wi-Fi network — should they ever wander within range of it or visit your home (or hop onto it secretly from hundreds of yards away with a good ‘ole <a href="http://www.turnpoint.net/wireless/cantennahowto.html" target="_blank">cantenna</a>!).<span id="more-34843"></span></p>
<p>When the feature first launched, Microsoft sought to reassure would-be Windows 10 users that their Wi-Fi password would be sent encrypted and stored encrypted — on a Microsoft server. The company also pointed out that Windows 10 users had to initially agree to share their network during the Windows 10 installation process before the feature would be turned on.</p>
<p>But these assurances rang hollow for many Windows users already suspicious about a feature that could share access to a user&#8217;s wireless network even after that user changed their Wi-Fi network password.</p>
<p>&#8220;Annoyingly, because they didn’t have your actual password, just authorization to ask the Wi-Fi Sense service to supply it on their behalf, changing your password down the line wouldn’t keep them out – Wi-Fi Sense would learn the new password directly from you and supply it for them in future,&#8221; <strong>John Zorabedian</strong> <a href="https://nakedsecurity.sophos.com/2016/05/13/microsoft-is-going-to-stop-sharing-your-passwords-through-wi-fi-sense/" target="_blank">wrote</a> for security firm <strong>Sophos</strong>.</p>
<p>Microsoft’s <a href="http://www.windowsphone.com/en-us/how-to/wp8/connectivity/how-do-i-opt-my-network-out-of-wi-fi-sense" target="_blank">solution for those concerned</a> required users to change the name (a.k.a. “<a href="http://www.webopedia.com/TERM/S/SSID.html" target="_blank">SSID</a>“) of their Wi-Fi network to include the text “_optout” somewhere in the network name (for example, “oldnetworknamehere_optout”).</p>
<p>I commend Microsoft for taking this step, if albeit belatedly. Much security is undone by ill-advised features in software and hardware that are <a href="http://krebsonsecurity.com/?s=default&amp;x=0&amp;y=0" target="_blank">unnecessarily enabled by default</a>.</p>


feed_id: http://krebsonsecurity.com/?p=34594
title: Carding Sites Turn to the ‘Dark Cloud’
uri: Carding-Sites-Turn-to-the-Dark-Cloud
url: http://krebsonsecurity.com/2016/05/carding-sites-turn-to-the-dark-cloud/
content:
<p class="p1"><span class="s1">Crooks who peddle stolen credit cards on the Internet face a constant challenge: Keeping their shops online and reachable in the face of meddling from law enforcement officials, security firms, researchers and vigilantes. In this post, we’ll examine a large collection of hacked computers around the world that currently serves as a criminal cloud hosting environment for a variety of cybercrime operations, from sending spam to hosting malicious software and stolen credit card shops. </span></p>
<p class="p1"><span class="s1">I first became aware of this botnet, which I’ve been referring to as the “Dark Cloud” for want of a better term, after hearing from <strong>Noah Dunker</strong>, director of security labs at  Kansas City-based vendor <a href="http://www.riskanalytics.com" target="_blank">RiskAnalytics</a>. </span><span class="s1">Dunker reached out after watching <a href="https://www.youtube.com/watch?v=QG2YUlm92y4" target="_blank">a Youtube video</a> I posted that featured some existing and historic credit card fraud sites. He asked what I knew about one of the carding sites in the video: A fraud shop called “Uncle Sam,&#8221; whose home page pictures a pointing Uncle Sam saying “I want YOU to swipe.”</span></p>
<div id="attachment_34816" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/c5f484b2.unclesam-ws.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/unclesam-ws.png"><img class="wp-image-34816 size-medium" src="media/679cbc1c.unclesam-ws-580x432.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/unclesam-ws-580x432.png" alt="The &quot;Uncle Sam&quot; carding shop is one of a half-dozen that reside on a Dark Cloud criminal hosting environment." width="580" height="432" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/05/unclesam-ws-580x432.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/05/unclesam-ws-768x571.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/05/unclesam-ws-940x699.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/05/unclesam-ws.png 1059w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The &#8220;Uncle Sam&#8221; carding shop is one of a half-dozen that reside on a Dark Cloud criminal hosting environment.</p></div>
<p class="p1"><span class="s1">I confessed that I knew little of this shop other than its existence, and asked why he was so interested in this particular crime store. Dunker showed me how the Uncle Sam card shop and at least four others were hosted by the same Dark Cloud, and how the system changed the Internet address of each Web site roughly every three minutes. The entire robot network, or&#8221;botnet,&#8221; consisted of thousands of hacked home computers spread across virtually every time zone in the world, he said. </span></p>
<p class="p1">Dunker urged me not to take his word for it, but to check for myself the domain name server (DNS) settings of the Uncle Sam shop every few minutes. DNS acts as a kind of Internet white pages, by translating Web site names to numeric addresses that are easier for computers to navigate. The way this so-called &#8220;fast-flux&#8221; botnet works is that it automatically updates the DNS records of each site hosted in the Dark Cloud every few minutes, randomly shuffling the Internet address of every site on the network from one compromised machine to another in a bid to frustrate those who might try to take the sites offline.</p>
<p class="p1">Sure enough, <a href="http://krebsonsecurity.com/wp-content/uploads/2016/05/dnslookup.txt" target="_blank">a simple script</a> was all it took to find a few dozen Internet addresses assigned to the Uncle Sam shop over just 20 minutes of running the script. When I let the DNS lookup script run overnight, it came back with more than 1,000 unique addresses to which the site had been moved during the 12 or so hours I let it run. According to Dunker, the vast majority of those Internet addresses (&gt; 80 percent) tie back to home Internet connections in Ukraine, with the rest in Russia and Romania.</p>
<div id="attachment_34819" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/04a81079.mrbin.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/mrbin.png"><img class="wp-image-34819 size-medium" src="media/47e71ace.mrbin-580x410.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/mrbin-580x410.png" alt="'Mr. Bin,' another carding shop hosting on the dark cloud service. A 'bin' is the &quot;bank identification number&quot; or the first six digits on a card, and it's mainly how fraudsters search for stolen cards." width="580" height="410" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/05/mrbin-580x410.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/05/mrbin-768x543.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/05/mrbin-940x665.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/05/mrbin.png 1100w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">&#8216;Mr. Bin,&#8217; another carding shop hosting on the dark cloud service. A &#8216;bin&#8217; is the &#8220;bank identification number&#8221; or the first six digits on a card, and it&#8217;s mainly how fraudsters search for stolen cards.</p></div>
<p>&#8220;Right now there’s probably over 2,000 infected endpoints that are mostly broadband subscribers in Eastern Europe,&#8221; enslaved as part of this botnet, Dunker said. &#8220;It’s a highly functional network, and it feels kind of like a black market version of <a href="https://aws.amazon.com/" target="_blank">Amazon Web Services</a>. Some of the systems appear to be used for sending spam and some are for big dynamic scaled content delivery.&#8221;</p>
<p>Dunker said that historic DNS records indicate that this botnet has been in operation for at least the past year, but that there are signs it was up and running as early as Summer 2014.</p>
<p><strong>Wayne Crowder</strong>, director of threat intelligence for RiskAnalytics, said the botnet appears to be a network structure set up to push different crimeware, including ransomware, click fraud tools, banking Trojans and spam.<span id="more-34594"></span></p>
<p>Crowder said the Windows-based malware that powers the botnet assigns infected hosts different roles, depending on the victim machine&#8217;s strengths or weaknesses: More powerful systems might be used as DNS servers, while infected systems behind home routers may be infected with a &#8220;reverse proxy,&#8221; which lets the attackers control the system remotely.</p>
<p>&#8220;Once it’s infected, it phones home and gets a role assigned to it,&#8221; Crowder said. &#8220;That may be to continue sending spam, host a reverse proxy, or run a DNS server. It kind of depends on what capabilities it has.&#8221;</p>
<div id="attachment_34821" style="width: 590px" class="wp-caption aligncenter"><a class="ligthbox" href="media/c80452a1.popeyeds.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/popeyeds.png"><img class="wp-image-34821 size-medium" src="media/0d841ff7.popeyeds-580x381.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/popeyeds-580x381.png" alt="&quot;Popeye,&quot; another carding site hosted on the criminal cloud network." width="580" height="381" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/05/popeyeds-580x381.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/05/popeyeds-768x504.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/05/popeyeds-940x617.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/05/popeyeds.png 1186w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">&#8220;Popeye,&#8221; another carding site hosted on the criminal cloud network.</p></div>
<p>Indeed, this network does feel rather spammy. In my book <em><a href="http://www.amazon.com/Spam-Nation-Organized-Cybercrimefrom-Epidemic/dp/1501210432" target="_blank">Spam Nation</a></em>, I detailed how the largest spam affiliate program on the planet at the time used a similar fast-flux network of compromised systems to host its network of pill sites that were being promoted in the junk email. Many of the domains used in those spam campaigns were two- and three-word domains that appeared to be randomly created for use in malware and spam distribution.</p>
<p>&#8220;We&#8217;re seeing two English words separated by a dash,&#8221; Dunker said the hundreds of hostnames found on the dark cloud network that do not appear to be used for carding shops. &#8220;It&#8217;s a very spammy naming convention.&#8221;</p>
<p>It&#8217;s unclear whether this botnet is being used by more than one individual or group. The variety of crimeware campaigns that RiskAnalytics has tracked operated through the network suggests that it may be rented out to multiple different cybercrooks. Still, other clues suggests the whole thing may have been orchestrated by the same gang.</p>
<p>For example, nearly all of the carding sites hosted on the dark cloud network &#8212; including <strong>Uncle Sam</strong>, <strong>Scrooge McDuck</strong>, <strong>Mr. Bin</strong>, <strong>Try2Swipe</strong>, <strong>Popeye</strong>, and <strong>Royaldumps</strong> &#8212; share the same or very similar site designs. All of them say that customers can look up available cards for sale at the site, but that purchasing the cards requires first contacting the proprietor of the shops directly via instant message.</p>
<p>All six of these shops &#8212; and only these six &#8212; are advertised prominently on the cybercrime forum <strong>prvtzone[dot]su</strong>. It is unclear whether this forum is run or frequented by the people who run this botnet, but the forum does heavily steer members interested in carding toward these six carding services. It&#8217;s unclear why, but Prvtzone has a Google Analytics tracking ID (UA-65055767) embedded in the HTML source of its page that may hold clues about the proprietors of this crime forum.</p>
<div id="attachment_34822" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/ec01c42f.prvt.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/prvt.png"><img class="wp-image-34822 size-medium" src="media/c3b5fd97.prvt-580x281.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/prvt-580x281.png" alt="The &quot;dumps&quot; section of the cybercrime forum Prvtzone advertises all six of the carding domains found on the fast-flux network." width="580" height="281" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/05/prvt-580x281.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/05/prvt-768x372.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/05/prvt-940x456.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The &#8220;dumps&#8221; section of the cybercrime forum Prvtzone advertises all six of the carding domains found on the fast-flux network.</p></div>
<p>Dunker says he&#8217;s convinced it&#8217;s one group that occasionally rents out the infrastructure to other criminals.</p>
<p>&#8220;At this point, I’m positive that there’s one overarching organized crime operation driving this whole thing,&#8221; Dunker said. &#8220;But they do appear to be leasing parts of it out to others.&#8221;</p>
<p>Dunker and Crowder say they hope to release an initial report on their findings about the botnet sometime next week, but that for now the rabbit hole appears to go quite deep with this crime machine. For instance, there  are several sites hosted on the network that appear to be clones of real businesses selling expensive farm equipment in Europe, and multiple sites report that these are fake companies looking to scam the unwary.</p>
<p>&#8220;There are a lot of questions that this research poses that we&#8217;d like to be able to answer,&#8221; Crowder said.</p>
<p>For now, I&#8217;d invite anyone interested to feel free to contribute to the research. <a href="http://krebsonsecurity.com/wp-content/uploads/2016/05/cloudcrimips.txt" target="_blank">This text file</a> contains a historic record of domains I found that are or were at one time tied to the 40 or so Internet addresses I found in my initial, brief DNS scans of this network. <a href="http://krebsonsecurity.com/wp-content/uploads/2016/05/mcduckips5-11.txt" target="_blank">Here&#8217;s a larger list of some 1,024 addresses</a> that came up when I ran the scan for about 12 hours.</p>
<p>If you liked this story, check out <a href="http://krebsonsecurity.com/2016/03/carders-park-piles-of-cash-at-jokers-stash/" target="_blank">this piece</a> about another carding forum called Joker&#8217;s Stash, which also uses a unique communications system to keep itself online and reachable to all comers.</p>


feed_id: http://krebsonsecurity.com/?p=34757
title: Wendy’s: Breach Affected 5% of Restaurants
uri: Wendy-s-Breach-Affected-5-of-Restaurants
url: http://krebsonsecurity.com/2016/05/wendys-breach-affected-5-of-restaurants/
content:
<p><strong>Wendy&#8217;s</strong> said today that an investigation into a credit card breach at the nationwide fast-food chain uncovered malicious software on point-of-sale systems at fewer than 300 of the company&#8217;s 5,500 franchised stores. The company says the investigation into the breach is continuing, but that the malware has been removed from all affected locations.</p>
<p><img class="alignright wp-image-34063" src="media/3500af38.wendysky-580x392.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/wendysky-580x392.png" alt="wendysky" width="309" height="209" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/03/wendysky-580x392.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/03/wendysky-768x518.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/03/wendysky.png 868w" sizes="(max-width: 309px) 100vw, 309px" />&#8220;Based on the preliminary findings of the investigation and other information, the Company believes that malware, installed through the use of compromised third-party vendor credentials, affected one particular point of sale system at fewer than 300 of approximately 5,500 franchised North America Wendy’s restaurants, starting in the fall of 2015,&#8221; Wendy&#8217;s disclosed in their first quarter financial statement today. The statement continues:</p>
<blockquote><p>&#8220;These findings also indicate that the Aloha point of sale system has not been impacted by this activity. The Aloha system is already installed at all Company-operated restaurants and in a majority of franchise-operated restaurants, with implementation throughout the North America system targeted by year-end 2016. The Company expects that it will receive a final report from its investigator in the near future.&#8221;</p>
<p>&#8220;The Company has worked aggressively with its investigator to identify the source of the malware and quantify the extent of the malicious cyber-attacks, and has disabled and eradicated the malware in affected restaurants. The Company continues to work through a defined process with the payment card brands, its investigator and federal law enforcement authorities to complete the investigation.&#8221;</p>
<p>&#8220;Based upon the investigation to date, approximately 50 franchise restaurants are suspected of experiencing, or have been found to have, unrelated cybersecurity issues. The Company and affected franchisees are working to verify and resolve these issues.&#8221;</p></blockquote>
<p>The findings come as many banks and credit unions <a href="http://krebsonsecurity.com/2016/03/credit-unions-feeling-pinch-in-wendys-breach/" target="_blank">feeling card fraud pain because of the breach</a> have been grumbling about the extent and duration of the breach. Sources at multiple financial institutions say their data indicates that some of the breached Wendy&#8217;s locations were still leaking customer card data as late as the end of March 2016 and into early April. The breach was <a href="http://krebsonsecurity.com/2016/01/wendys-probes-reports-of-credit-card-breach/" target="_blank">first disclosed on this blog on January 27, 2016</a>.</p>
<p>&#8220;Our ongoing investigation into unusual payment card activity at some Wendy’s restaurants is being led by a third party PFI and is proceeding as expeditiously as possible,&#8221; Wendy&#8217;s spokesman <strong>Bob Bertini</strong> said in response to questions about the duration of the breach at some stores. &#8220;As you are aware, our investigator is required to follow certain protocols in this type of comprehensive investigation and this takes time. Adding to the complexity is the fact that most Wendy’s restaurants are owned and operated by independent franchisees.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=34791
title: Adobe, Microsoft Push Critical Updates
uri: 2016-05-25-Adobe-Microsoft-Push-Critical-Updates
url: http://krebsonsecurity.com/2016/05/adobe-microsoft-push-critical-updates-2/
content:
<p><strong>Adobe</strong> has issued security updates to fix weaknesses in its <strong>PDF Reader</strong> and <strong>Cold Fusion </strong>products, while pointing to an update to be released later this week for its ubiquitous <strong>Flash Player</strong> browser plugin. Microsoft meanwhile today released 16 update bundles to address dozens of security flaws in <strong>Windows</strong>, <strong>Internet Explorer</strong> and related software.</p>
<p>Microsoft&#8217;s <a href="https://technet.microsoft.com/en-us/library/security/ms16-May" target="_blank">patch batch</a> includes updates for &#8220;zero-day&#8221; vuln<img class="alignright size-full wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="229" height="240" />erabilities (flaws that attackers figure out how to exploit before before the software maker does) in Internet Explorer (IE) and in Windows. Half of the 16 patches that Redmond issued today earned its &#8220;critical&#8221; rating, meaning the vulnerabilities could be exploited remotely through no help from the user, save for perhaps clicking a link, opening a file or visiting a hacked or malicious Web site.</p>
<p>According to security firm <strong>Shavlik</strong>, two of the Microsoft patches tackle issues that were publicly disclosed prior to today&#8217;s updates, including bugs in IE and the <strong>Microsoft .NET Framework</strong>.</p>
<p>Anytime there&#8217;s a .NET Framework update available, I always uncheck those updates to install and then reboot and install the .NET updates; I&#8217;ve had too many .NET update failures muddy the process of figuring out which update borked a Windows machine after a batch of patches to do otherwise, but your mileage may vary.</p>
<p>On the Adobe side, the pending Flash update fixes <a href="https://helpx.adobe.com/security/products/flash-player/apsa16-02.html" target="_blank">a single vulnerability</a> that apparently is already being exploited in active attacks online. However, Shavlik says there appears to be some confusion about how many bugs are fixed in the Flash update.<span id="more-34791"></span></p>
<p>&#8220;If information gleaned from [Microsoft&#8217;s account of the Flash Player update] <a href="https://technet.microsoft.com/library/security/MS16-064" target="_blank">MS16-064</a> is accurate, this Zero Day will be accompanied by 23 additional CVEs, with the release expected on May 12th,&#8221; Shavlik wrote. &#8220;With this in mind, the recommendation is to roll this update out immediately.&#8221;</p>
<p><img class="alignleft size-full wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="211" height="180" /></p>
<p>Adobe says the vulnerability is included in Adobe Flash Player <em>21.0.0.226</em> and earlier versions for Windows, Macintosh, Linux, and Chrome OS, and that the flaw will be fixed in a version of Flash to be released May 12.</p>
<p>As far as Flash is concerned, the smartest option is probably best to hobble or ditch the program once and for all &#8212; and significantly increase the security of your system in the process. I’ve got more on that approach (as well as slightly less radical solutions ) in <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">A Month Without Adobe Flash Player</a>.</p>
<p>If you use Adobe Reader to display PDF documents, you&#8217;ll need to <a href="https://helpx.adobe.com/security/products/acrobat/apsb16-14.html" target="_blank">update that, too</a>. Alternatively, consider switching to another reader that is perhaps less targeted. Adobe Reader comes bundled with a number of third-party software products, but many Windows users may not realize there are alternatives, including some good free ones. For a time I used <strong>Foxit Reader</strong>, but that program seems to have grown more bloated with each release. My current preference is <a href="http://www.sumatrapdfreader.org/free-pdf-reader.html" target="_blank">Sumatra PDF</a>; it is lightweight (about 40 times smaller than Adobe Reader) and quite fast.</p>
<p>Finally, if you run a Web site that in any way relies on Adobe&#8217;s Cold Fusion technology, please update your software soon. Cold Fusion vulnerabilities have traditionally been <a href="http://krebsonsecurity.com/?s=cold+fusion&amp;x=0&amp;y=0" target="_blank">targeted by cyber thieves to compromise countless online shops</a>.</p>


feed_id: http://krebsonsecurity.com/?p=34764
title: Crooks Grab W-2s from Credit Bureau Equifax
uri: Crooks-Grab-W-2s-from-Credit-Bureau-Equifax
url: http://krebsonsecurity.com/2016/05/crooks-grab-w-2s-from-credit-bureau-equifax/
content:
<p>Identity thieves stole tax and salary data from big-three credit bureau <strong>Equifax Inc.</strong>, according to a letter that grocery giant <strong>Kroger</strong> sent to all current and some former employees on Thursday. The nation&#8217;s largest grocery chain by revenue appears to be one of several Equifax customers that were similarly victimized this year.</p>
<p>Atlanta-based Equifax&#8217;s W-2Express site makes electronic W-2 forms accessible for download for many companies, including <a href="https://en.wikipedia.org/wiki/Kroger" target="_blank">Kroger</a> &#8212; which employs more than 431,000 people. According to a letter Kroger sent to employees dated May 5, thieves were able to access W-2 data merely by entering at Equifax&#8217;s portal the employee&#8217;s default PIN code, which was nothing more than the last four digits of the employee&#8217;s Social Security number and their four-digit birth year.</p>
<p>&#8220;It appears that unknown individuals have accessed [Equifax&#8217;s] W2Express website using default log-in information based on Social Security numbers (SSN) and dates of birth, which we believe were obtained from some other source, such as a prior data breach at other institutions,&#8221; Kroger wrote in a FAQ about the incident that was included with the letter sent to employees. &#8220;We have no indication that Kroger’s systems have been compromised.&#8221;</p>
<p>The FAQ continued:</p>
<blockquote><p>&#8220;At this time, we have no indication that associates who had created a new password (did not use the default PIN) were affected, and we are still identifying which associates still using the default PIN may have been affected. We believe individuals gained access to some Kroger associates’ electronic W-2 forms and may have used the information to file tax returns in their names in an effort to claim a fraudulent refund.&#8221;</p>
<p>&#8220;Kroger is working with Equifax and the authorities to determine who is affected and restore secure access to W-2Express. At this time, we believe you are among our current and former Kroger associates using the default PIN in the W-2Express system. This does not necessarily mean your W-2 was accessed as part of this security incident. We are still working to identify which individuals’ information was accessed.&#8221;</p></blockquote>
<p>Kroger said it doesn&#8217;t yet know how many of its employees may have been affected.</p>
<p>The incident comes amid <a href="http://krebsonsecurity.com/2016/05/fraudsters-steal-tax-salary-data-from-adp/" target="_blank">news first reported</a> on this blog earlier this week that tax fraudsters similarly targeted employees of companies that used payroll giant ADP to give employees access to their W-2 data. ADP acknowledged that the incident affected employees at U.S. Bank and at least 11 other companies.</p>
<p>Equifax did not respond to requests for comment about how many other customer companies may have been affected by the same default (in)security. But Kroger spokesman <strong>Keith Dailey</strong> said other companies that relied on Equifax for W-2 data also relied on the last four of the SSN and 4-digit birth year as authenticators.</p>
<p>&#8220;As far as I know, it&#8217;s the standard Equifax setup,&#8221; Dailey said.</p>
<p>Last month, <strong>Stanford University</strong> <a href="http://www.stanforddaily.com/2016/04/12/university-employees-vulnerable-after-tax-data-breach/" target="_blank">alerted 600 current and former employees</a> that their data was similarly accessed by ID thieves via Equifax&#8217;s W-2Express portal. <strong>Northwestern University</strong> also <a href="http://www.northwestern.edu/newscenter/stories/2016/05/free-credit-monitoring,-id-theft-proection-offered-to-employees.html" target="_blank">just alerted 150 employees</a> that their salary and tax data was stolen via Equifax this year.</p>
<p>In a statement released to KrebsOnSecurity, Equifax spokeswoman <strong>Dianne Bernez</strong> confirmed that the company had been made aware of suspected fraudulent access to payroll information through its W-2Express service by Kroger.<span id="more-34764"></span></p>
<p>&#8220;The information in question was accessed by unauthorized individuals who were able to gain access by using users’ personally identifiable information,&#8221; the statement reads. &#8220;We have no reason to believe the personally identifiable information was attained through Equifax systems. Unfortunately, as individuals’ personally identifiable information has become more publicly available, these types of online fraud incidents have escalated. As a result, it is critical for consumers and businesses to take steps to protect consumers’ personally identifiable information including the use of strong passwords and PIN codes. We are working closely with Kroger to assess and monitor the situation.&#8221;</p>
<p>ID thieves go after W-2 data because it contains much of the information needed to fraudulently request a large tax refund from the IRS in someone else’s name. Kroger told employees they would know they were victims in this breach if they received a notice from the IRS about a fraudulent refund request filed in their name.</p>
<p>However, most victims first learn of the crime after having their returns rejected by the IRS because the scammers beat them to it. Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS.</p>
<p>Kroger said it would offer free credit monitoring services to employees affected by the breach. Kroger spokesman Dailey declined to say which company would be providing that monitoring, but he did confirm that it would not be Equifax.</p>
<p><strong>Update, May 7, 9:44 a.m.:</strong> Added mention of the Northerwestern University incident involving Equifax&#8217;s W-2 portal.</p>


feed_id: http://krebsonsecurity.com/?p=34738
title: Crooks Go Deep With ‘Deep Insert’ Skimmers
uri: Crooks-Go-Deep-With-Deep-Insert-Skimmers
url: http://krebsonsecurity.com/2016/05/crooks-go-deep-with-deep-insert-skimmers/
content:
<p>ATM maker <strong>NCR Corp.</strong> says it is seeing a rapid rise in reports of what it calls &#8220;deep insert skimmers,&#8221; wafer-thin fraud devices made to be hidden inside of the card acceptance slot on a cash machine.</p>
<p>KrebsOnSecurity&#8217;s <a href="http://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers series</a> has featured several stories about <a href="http://krebsonsecurity.com/?s=insert+skimmer&amp;x=0&amp;y=0" target="_blank">insert skimmers</a>. But the ATM manufacturer said deep insert skimmers are different from typical insert skimmers because they are placed in various positions within the card reader transport, behind the shutter of a motorized card reader and completely hidden from the consumer at the front of the ATM.</p>
<div id="attachment_34740" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/d980e703.deepinsert.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/deepinsert.png"><img class="wp-image-34740 size-medium" src="media/bbdb636a.deepinsert-580x114.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/deepinsert-580x114.png" alt="Deep insert skimmers removed from hacked ATMs." width="580" height="114" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/05/deepinsert-580x114.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/05/deepinsert-768x150.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/05/deepinsert-940x184.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/05/deepinsert.png 1072w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Deep insert skimmers removed from hacked ATMs.</p></div>
<p>NCR says these deep insert skimming devices &#8212; usually made of metal or PCB plastic &#8212; are unlikely to be affected by most active anti-skimming jamming solutions, and they are unlikely to be detected by most fraudulent device detection solutions.</p>
<p>&#8220;Neither NCR Skimming Protection Solution, nor other anti-skimming devices can prevent skimming with these deep insert skimmers,&#8221; NCR wrote in an alert sent to banks and other customers. &#8220;This is due to the fact the skimmer sits well inside the card reader, away from the detectors or jammers of [NCR&#8217;s skimming protection solution].</p>
<p>The company said it has received reports of these skimming devices on all ATM manufacturers in Greece, Ireland, Italy, Switzerland, Sweden, Bulgaria, Turkey, United Kingdom and the United States.</p>
<p>&#8220;This suggests that &#8216;deep insert skimming&#8217; is becoming more viable for criminals as a tactic to avoid bezel mounted anti-skimming devices,&#8221; NCR wrote. The company said it is currently testing a firmware update for NCR machines that should help detect the insertion of deep insert skimmers and send an alert.</p>
<p>A DEEP DIVE ON DEEP INSERT SKIMMERS</p>
<p><strong>Charlie Harrow</strong>, solutions manager for global security at NCR, said the early model insert skimmers used a rudimentary wireless transmitter to send card data. But those skimmers were all powered by tiny coin batteries like the kind found in watches, and that dramatically limits the amount of time that the skimmer can transmit card data.</p>
<p>Harrow said NCR suspects that the deep insert skimmer makers are using tiny pinhole cameras hidden above or beside the PIN pad to record customers entering their PINs, <em>and that the hidden camera doubles as a receiver for the stolen card data sent by the skimmer nestled inside the ATM&#8217;s card slot</em>. He suspects this because NCR has never actually found a hidden camera along with an insert skimmer. Also, a watch-battery run wireless transmitter wouldn&#8217;t last long if the signal had to travel very far.<span id="more-34738"></span></p>
<p>According to Harrow, the early model insert skimmers weren&#8217;t really made to be retrieved. Turns out, that may have something to do with the way card readers work on ATMs.</p>
<p>&#8220;Usually what happens is the insert skimmer causes a card jam,&#8221; at which point the thief calls it quits and retrieves his hidden camera &#8212; which has both the card data transmitted from the skimmer and video snippets of unwitting customers entering their PINs, he said. &#8220;These skimming devices can usually cope with most cards, but it&#8217;s just a matter of time before a customer sticks an ATM card in the machine that is in less-that-perfect condition.&#8221;</p>
<p>The latest model deep insert skimmers, Harrow said, include a tiny memory chip that can hold account data skimmed off the cards. Presumably this is preferable to sending the data wirelessly because writing the card data to a memory chip doesn&#8217;t drain as much power from the wimpy coin battery that powers the devices.</p>
<p>The deep insert skimmers also are designed to be retrievable:</p>
<p>&#8220;The ones I’ve seen will snap into some of the features inside the card reader, which has got various nooks and crannies,&#8221; Harrow said. &#8220;The latest ones also have magnets in them which are used to hold them down against the card reader.&#8221; Harrow says the magnets are on the opposite side of the device from the card reader, so the magnets don&#8217;t interfere with the skimmer&#8217;s job of reading the data off of the card&#8217;s magnetic stripe.</p>
<p>Many readers have asked why the fraudsters would bother skimming cards from ATMs in Europe, which long ago were equipped to read data off the chip embedded in the cards issued by European banks. The trouble is that virtually all chip cards still have the account data encoded in plain text on the magnetic stripe on the back of the card &#8212; mainly so that the cards can be used in ATM locations that cannot yet read chip-based cards (i.e., the United States).</p>
<p>When thieves skim data from ATMs in Europe, they generally sell the data to fraudsters who will encode the card data onto counterfeit cards and withdraw cash at ATMs in the United States or in other countries that haven&#8217;t yet fully moved to chip-based cards. In response, some European financial institutions have taken to enacting an anti-fraud mechanism called &#8220;geo-blocking,&#8221; which prevents the cards from being used in certain areas.</p>
<p>&#8220;Where geo-blocking has been widely or partially implemented, the international loss profile is very different, with minimal losses reported,&#8221; wrote the <strong>European ATM Security Team</strong> (EAST) in their latest roundup of ATM skimming attacks in 2015 (for more on that, <a href="http://krebsonsecurity.com/2016/04/a-dramatic-rise-in-atm-skimming-attacks/" target="_blank">see this story</a>). &#8220;From the perspective of European card issuers the USA and the Asia-Pacific region are where the majority of such losses are being reported.&#8221;</p>
<p><img class="aligncenter size-medium wp-image-34748" src="media/dcba7be3.east-lossesbycountry-580x322.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/east-lossesbycountry-580x322.png" alt="east-lossesbycountry" width="580" height="322" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/05/east-lossesbycountry-580x322.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/05/east-lossesbycountry.png 711w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>Even after most U.S. banks put in place chip-capable ATMs, the magnetic stripe will still be needed because it&#8217;s an integral part of the way ATMs work: Most ATMs in use today require a magnetic stripe for the card to be accepted into the machine. The principal reason for this is to ensure that customers are putting the card into the slot correctly, as embossed letters and numbers running across odd spots in the card reader can take their toll on the machines over time.</p>


feed_id: http://krebsonsecurity.com/?p=34704
title: Fraudsters Steal Tax, Salary Data From ADP
uri: Fraudsters-Steal-Tax-Salary-Data-From-ADP
url: http://krebsonsecurity.com/2016/05/fraudsters-steal-tax-salary-data-from-adp/
content:
<p>Identity thieves stole tax and salary data from payroll giant <strong>ADP</strong> by registering accounts in the names of employees at more than a dozen customer firms, KrebsOnSecurity has learned. ADP says the incidents occurred because the victim companies all mistakenly published sensitive ADP account information online that made those firms easy targets for tax fraudsters.</p>
<p><img class="alignright wp-image-34710" src="media/f4736424.adp.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/adp.png" alt="adp" width="263" height="120" />Patterson, N.J.-based ADP provides payroll, tax and benefits administration for more than 640,000 companies. Last week, <strong>U.S. Bancorp</strong> (U.S. Bank) &#8212; the nation&#8217;s fifth-largest commercial bank &#8212; warned some of its employees that their W-2 data had been stolen thanks to a weakness in ADP&#8217;s customer portal.</p>
<p>ID thieves are interested in W-2 data because it contains much of the information needed to fraudulently request a large tax refund from the <a href="https://en.wikipedia.org/wiki/Internal_Revenue_Service" target="_blank">U.S. Internal Revenue Service</a> (IRS) in someone else&#8217;s name. A reader who works at U.S. Bank shared a letter received from <strong>Jennie Carlson</strong>, the financial institution&#8217;s executive vice president of human resources.</p>
<p>&#8220;Since April 19, 2016, we have been actively investigating a security incident with our W-2 provider, ADP,&#8221; Carlson wrote. &#8220;During the course of that investigation we have learned that an external W-2 portal, maintained by ADP, may have been utilized by unauthorized individuals to access your W-2, which they may have used to file a fraudulent income tax return under your name.&#8221;</p>
<p>The letter continued:</p>
<blockquote><p>&#8220;The incident originated because ADP offered an external online portal that has been exploited. For individuals who had never used the external portal, a registration had never been established. Criminals were able to take advantage of that situation to use confidential personal information from other sources to establish a registration in your name at ADP. Once the fraudulent registration was established, they were able to view or download your W-2.&#8221;</p></blockquote>
<p>U.S. Bank spokesman <strong>Dana Ripley </strong>said the letter was sent to a &#8220;small population&#8221; of the bank&#8217;s more than 64,000 employees. Asked to comment on the letter from U.S. Bank, ADP confirmed that the fraud visited upon U.S. Bank also hit &#8220;a very small subset&#8221; of the ADP&#8217;s total customers this year.</p>
<p>ADP emphasized that the fraudsters needed to have the victim&#8217;s personal data &#8212; including name, date of birth and Social Security number &#8212; to successfully create an account in someone&#8217;s name. ADP also stressed that this personal data did not come from its systems, and that thieves appeared to already possess that data when they created the unauthorized accounts at ADP&#8217;s portal.</p>
<p>ADP Chief Security Officer <a href="https://www.linkedin.com/in/rolandcloutier" target="_blank">Roland Cloutier</a> said customers can choose to create an account at the ADP portal for each employee, or they can defer that process to a later date (but employers do have to chose one or the other, Cloutier said).</p>
<p>According to ADP, new users need to be in possession of two other things (in addition to the victim&#8217;s personal data) at a minimum in order to create an account: A custom, company-specific link provided by ADP, and a static code assigned to the customer by ADP.</p>
<p>The problem, Cloutier said, seems to stem from ADP customers that both deferred that signup process for some or all of their employees and at the same time inadvertently published online the link and the company code. As a result, for users who never registered, criminals were able to register as them with fairly basic personal info, and access W-2 data on those individuals.<span id="more-34704"></span></p>
<p>U.S. Bank&#8217;s Ripley acknowledged that the bank published the link and company code to an employee resource online, but said the institution never considered that the data itself was privileged.</p>
<p>&#8220;We viewed the code as an identification code, not as an authentication code, and we posted it to a Web site for the convenience of our employees so they could access their W-2 information,&#8221; Ripley said. &#8220;We have discontinued that practice.&#8221;</p>
<p>In the meantime, ADP says it has developed systems to monitor the Web for any other customers that may inadvertently publish their signup link and code.</p>
<p>&#8220;We&#8217;ve now aggressively put in some security intelligence by trying to look for that code and turn off self-service registration access if we find that code&#8221; published online, Cloutier said.</p>
<h4>ANALYSIS</h4>
<p>ADP&#8217;s portal, like so many other authentication systems, relies entirely on static data that is available on just about every American for less than $4 in the cybercrime underground (SSN/DOB, address, etc). It&#8217;s true that companies should know better than to publish such a crucial link online along with the company&#8217;s ADP code, but then again these are pretty weak authenticators.</p>
<p>Cloutier said ADP does offer an additional layer of authentication &#8212; a personal identification code (PIC) &#8212; basically another static code that can be assigned to each employee. He added that ADP is trialing a service that will ask anyone requesting a new account to successfully answer a series of questions based on information that only the real account holder is supposed to know.</p>
<p>Cloutier declined to say who was providing the verification service, but these so-called knowledge-based authentication (KBA) or “out-of-wallet” questions generally focus on things such as previous address, loan amounts and dates and can be successfully enumerated with random guessing. In many cases, the answers can be found by consulting free online services, such as Zillow and Facebook.</p>
<p>The IRS found this out the hard way, and over the past year has removed two separate authentication systems that placed too much reliance on KBA and static data to authenticate taxpayers. In May 2015, the IRS took down its &#8220;Get Transcript&#8221; service after tax refund fraudsters began using it to <a href="http://krebsonsecurity.com/2016/02/irs-390k-more-victims-of-irs-gov-weakness/" target="_blank">pull W-2 data on more than 724,000 taxpayers</a>. In those cases, the fraudsters also already had the victim&#8217;s SSN, DoB and other personal data. In March 2016, the IRS <a href="http://krebsonsecurity.com/2016/03/irs-suspends-insecure-get-ip-pin-feature/" target="_blank">suspended its &#8220;Get IP PIN&#8221; feature</a> for the same reason.</p>
<p>But somehow, KBA questions are an innovation that&#8217;s worth looking forward to at ADP.</p>
<p>&#8220;The IRS didn’t have a PIC code or client code,&#8221; Cloutier said when I brought up the IRS&#8217;s experience. &#8220;They didn’t have as many levels and individual authentication components that we provide our clients.&#8221;</p>
<p>Cloutier&#8217;s words recalled to mind a scene from the movie <a href="http://www.imdb.com/title/tt0151804/" target="_blank">Office Space</a>, in which Jennifer Aniston&#8217;s character is upbraided by her manager for <a href="https://www.youtube.com/watch?v=KJtrLKGZZFg" target="_blank">wearing too few &#8220;pieces of flair&#8221; on her &#8216;Chotchkie&#8217;s&#8217; uniform</a>. His comment also made me think about <a href="https://www.youtube.com/watch?v=KOO5S4vxi0o" target="_blank">one of the best scenes from the cult hit &#8220;This is Spinal Tap,&#8221;</a> in which the character <a href="https://en.wikipedia.org/wiki/Nigel_Tufnel" target="_blank">Nigel Tufnel</a> shows off how all the knobs on his amplifier go to &#8220;level 11,&#8221; while other amps only go to the more boring and standard level 10.</p>
<p>It&#8217;s truly a measure of the challenges ahead in improving online authentication that so many organizations are still looking backwards to obsolete and insecure approaches. ADP&#8217;s logo includes the clever slogan, &#8220;A more human resource.&#8221; It&#8217;s hard to think of a more apt mission statement for the company. After all, it&#8217;s high time we started moving away from asking people to robotically regurgitate the same static identifiers over and over, and shift to a more human approach that focuses on dynamic elements for authentication. But alas, that&#8217;s fodder for a future post.</p>
<p><strong>Update 1:59 p.m. ET:</strong> Clarified Spinal Tap reference.</p>
<p><strong>Update, 10:07 p.m. ET:</strong> It looks like ADP&#8217;s stock took a pretty big hit immediately after this story ran today.</p>
<p><img class="aligncenter size-full wp-image-34735" src="media/5bbe8f43.adp-twitter.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/adp-twitter.png" alt="adp-twitter" width="574" height="562" /></p>
<p>The stock later rebounded:</p>
<p><img class="aligncenter size-medium wp-image-34736" src="media/9b6de9f0.adp-stocknews-580x540.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/adp-stocknews-580x540.png" alt="adp-stocknews" width="580" height="540" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/05/adp-stocknews-580x540.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/05/adp-stocknews.png 595w" sizes="(max-width: 580px) 100vw, 580px" /></p>


feed_id: http://krebsonsecurity.com/?p=34924
title: Did the Clinton Email Server Have an Internet-Based Printer?
uri: Did-the-Clinton-Email-Server-Have-an-Internet-Based-Printer
url: http://krebsonsecurity.com/2016/05/did-the-clinton-email-server-have-an-internet-based-printer/
content:
<p><em>The Associated Press</em> today <a href="https://www.washingtonpost.com/business/technology/clinton-email-use-broke-federal-rules-inspectors-report/2016/05/25/8dbaec74-22dd-11e6-b944-52f7b1793dae_story.html" target="_blank">points</a> to a remarkable footnote in a recent State Department inspector general report on the Hillary Clinton email scandal: The mail was managed from the vanity domain &#8220;<strong>clintonemail.com</strong>.&#8221; But here&#8217;s a potentially more explosive finding: A review of the historic domain registration records for that domain indicates that whoever built the private email server for the Clintons also had the not-so-bright idea of connecting it to an Internet-based printer.</p>
<p>According to historic Internet address maps stored by San Mateo, Calif. based <a href="https://www.farsightsecurity.com/" target="_blank">Farsight Security</a>, among the handful of Internet addresses historically assigned to the domain &#8220;clintonemail.com&#8221; was the numeric address 24.187.234.188. The subdomain attached to that Internet address was&#8230;.wait for it&#8230;. &#8220;<strong>printer.clintonemail.com</strong>&#8220;.</p>
<p>Interestingly, that domain was first noticed by Farsight in March 2015, the same month the scandal broke that during her tenure as United States Secretary of State Mrs. Clinton exclusively used her family&#8217;s private email server for official communications.</p>
<div id="attachment_34925" style="width: 552px" class="wp-caption aligncenter"><img class="size-full wp-image-34925" src="media/732225e4.clintonprinter.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/05/clintonprinter.png" alt="Farsight's record for 24.187.234.188, the Internet address which once mapped to &quot;printer.clintonemail.com&quot;. " width="542" height="887" /><p class="wp-caption-text">Farsight&#8217;s record for 24.187.234.188, the Internet address which once mapped to &#8220;printer.clintonemail.com&#8221;.</p></div>
<p><em>I should emphasize here that it&#8217;s unclear whether an Internet-capable printer was ever connected to printer.clintonemail.com</em>. Nevertheless, it appears someone set it up to work that way.</p>
<p><strong>Ronald Guilmette</strong>, a private security researcher in California who prompted me to look up this information, said printing things to an Internet-based printer set up this way might have made the printer data vulnerable to eavesdropping.</p>
<p>&#8220;Whoever set up their home network like that was a security idiot, and it&#8217;s a dumb thing to do,&#8221; Guilmette said. &#8220;Not just because any idiot on the Internet can just waste all your toner. Some of these printers have simple vulnerabilities that leave them easy to be hacked into.&#8221;</p>
<p>More importantly, any emails or other documents that the Clintons decided to print would be sent out over the Internet &#8212; however briefly &#8212; before going back to the printer. And that data may have been sniffable by other customers of the same ISP, Guilmette said.<span id="more-34924"></span></p>
<p>&#8220;People are getting all upset saying hackers could have broken into her server, but what I&#8217;m saying is that people could have gotten confidential documents easily without breaking into anything,&#8221; Guilmette said. &#8220;So Mrs. Clinton is sitting there, tap-tap-tapping on her computer and decides to print something out. A clever Chinese hacker could have figured out, &#8216;Hey, I should get my own Internet address on the same block as the Clinton&#8217;s server and just sniff the local network traffic for printer files.'&#8221;</p>
<p>I should note that it&#8217;s possible the Clintons were encrypting all of their private mail communications with a &#8220;<a href="https://en.wikipedia.org/wiki/Virtual_private_network" target="_blank">virtual private network</a>&#8221; (VPN). Other historical &#8220;<a href="http://www.windowsnetworking.com/blogs/chetcuti/security/what-passive-dns.html" target="_blank">passive DNS</a>&#8221; records indicate there were additional, possibly interesting and related subdomains once directly adjacent to the aforementioned Internet address 24.187.234.188:</p>
<p>24.187.234.186 <a href="http://rosencrans.dyndns.ws/" target="_blank" rel="noreferrer" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=http://rosencrans.dyndns.ws&amp;source=gmail&amp;ust=1464383844784000&amp;usg=AFQjCNHK1SPCmV_kEc8msnK_lMvwc2-8sA">rosencrans.dyndns.ws</a><br />
24.187.234.187 <a href="http://wjcoffice.com/" target="_blank" rel="noreferrer" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=http://wjcoffice.com&amp;source=gmail&amp;ust=1464383844785000&amp;usg=AFQjCNHry9KEStRATgOiC0Zw5oMg0Dyhlw">wjcoffice.com</a><br />
24.187.234.187 <a href="http://mail.clintonemail.com/" target="_blank" rel="noreferrer" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=http://mail.clintonemail.com&amp;source=gmail&amp;ust=1464383844785000&amp;usg=AFQjCNGrETcGa7trJ9Ms0dX-YdsECvTGaw">mail.clintonemail.com</a><br />
24.187.234.187 <a href="http://mail.presidentclinton.com/" target="_blank" rel="noreferrer" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=http://mail.presidentclinton.com&amp;source=gmail&amp;ust=1464383844785000&amp;usg=AFQjCNExqkz9db_vlfbbnyTBctUfcf1hMQ">mail.presidentclinton.com</a><br />
24.187.234.188 <a href="http://printer.clintonemail.com/" target="_blank" rel="noreferrer" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=http://printer.clintonemail.com&amp;source=gmail&amp;ust=1464383844785000&amp;usg=AFQjCNFBCV8P_2Q73M3PmrOotR57MGDnGQ">printer.clintonemail.com</a><br />
24.187.234.188 <a href="http://printer.presidentclinton.com/" target="_blank" rel="noreferrer" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=http://printer.presidentclinton.com&amp;source=gmail&amp;ust=1464383844785000&amp;usg=AFQjCNH9Xo1k_aMxprevQoYNmfcuBC_3Ow">printer.presidentclinton.com</a><br />
24.187.234.190 <a href="http://sslvpn.clintonemail.com/" target="_blank" rel="noreferrer" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=http://sslvpn.clintonemail.com&amp;source=gmail&amp;ust=1464383844786000&amp;usg=AFQjCNFu8eiHz93reWynb_q-xnI_YFyaCw">sslvpn.clintonemail.com</a></p>


feed_id: http://krebsonsecurity.com/?p=35224
title: Citing Attack, GoToMyPC Resets All Passwords
uri: Citing-Attack-GoToMyPC-Resets-All-Passwords
url: http://krebsonsecurity.com/2016/06/citing-attack-gotomypc-resets-all-passwords/
content:
<p><strong>GoToMyPC</strong>, a service that helps people access and control their computers remotely over the Internet, is forcing all users to change their passwords, citing a spike in attacks that target people who re-use passwords across multiple sites.</p>
<p><img class="alignright wp-image-35234" src="media/6eb6f770.gtpc.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/gtpc.png" alt="gtpc" width="241" height="240" />Owned by Santa Clara, Calif. based networking giant <a href="https://www.citrix.com" target="_blank">Citrix</a>, GoToMyPC is a popular software-as-a-service product that lets users access and control their PC or Mac from anywhere in the world. On June 19, the company posted <a href="http://status.gotomypc.com/incidents/s2k8h1xhzn4k" target="_blank">a status update</a> and began notifying users that a system-wide password update was underway.</p>
<p>&#8220;Unfortunately, the GoToMYPC service has been targeted by a very sophisticated password attack,&#8221; reads the notice posted to status.gotomypc.com. &#8220;To protect you, the security team recommended that we reset all customer passwords immediately. Effective immediately, you will be required to reset your GoToMYPC password before you can login again. To reset your password please use your regular GoToMYPC login link.&#8221;</p>
<p><strong>John Bennett</strong>, product line director at Citrix, said once the company learned about the attack it took immediate action. But contrary to previous published reports, there is no indication Citrix or its platforms have been compromised, he said.</p>
<p>&#8220;Citrix can confirm the recent incident was a password re-use attack, where attackers used usernames and passwords leaked from other websites to access the accounts of GoToMyPC users,&#8221; Bennett wrote in an emailed statement. &#8220;At this time, the response includes a mandatory password reset for all GoToMyPC users. Citrix encourages customers to visit the  GoToMyPC status page to learn about <a href="https://support.citrixonline.com/en_US/GoToMyPC/help_files/GTC070021?title=2-Step+Verification" target="_blank">enabling two-step verification</a>, and to use strong passwords in order to keep accounts as safe as possible. &#8221;</p>
<p>Citrix&#8217;s GoTo division also operates <strong>GoToAssist</strong>, which is geared toward technical support specialists, and <strong>GoToMeeting</strong>, a product marketed at businesses. The company said it has no indication that user accounts at other GoTo services were compromised, but assuming that&#8217;s true it&#8217;s likely because the attackers haven&#8217;t gotten around to trying yet.</p>
<p>It&#8217;s a fair bet that whoever perpetrated this attack had help from<a href="http://krebsonsecurity.com/2016/06/dropbox-smeared-in-week-of-megabreaches/" target="_blank"> huge email and password lists recently leaked online</a> from older breaches at <strong>LinkedIn</strong>, <strong>MySpace</strong> and <strong>Tumblr</strong> to name a few. Re-using passwords at multiple sites is a bad idea to begin with, but re-using your GoToMyPC remote administrator password at other sites seems like an exceptionally lousy idea.</p>


feed_id: http://krebsonsecurity.com/?p=35216
title: Adobe Update Plugs Flash Player Zero-Day
uri: Adobe-Update-Plugs-Flash-Player-Zero-Day
url: http://krebsonsecurity.com/2016/06/adobe-update-plugs-flash-player-zero-day/
content:
<p><strong>Adobe</strong> on Thursday issued a critical update for its ubiquitous <strong>Flash Player</strong> software that fixes three dozen security holes in the widely-used browser plugin, including at least one vulnerability that is already being exploited for use in targeted attacks.</p>
<p><img class="alignright size-full wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="211" height="180" />The latest update brings Flash to <em>v. 22.0.0.192</em> for Windows and Mac users alike. If you have Flash installed, you should update, hobble or remove Flash as soon as possible.</p>
<p>The smartest option is probably to ditch the program once and for all and significantly increase the security of your system in the process. I’ve got more on that approach (as well as slightly less radical solutions ) in <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">A Month Without Adobe Flash Player</a>.</p>
<p>If you choose to update, please do it today. The most recent versions of Flash should be available from <a href="https://www.adobe.com/products/flashplayer/distribution3.html" target="_blank">this Flash distribution page</a> or the <a href="https://get.adobe.com/flashplayer/" target="_blank">Flash home page.</a> Windows users who browse the Web with anything other than <strong>Internet Explorer</strong> may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.). <strong>Chrome</strong> and IE should auto-install the latest Flash version on browser restart (I had to manually check for updates in Chrome an restart the browser to get the latest Flash version).<span id="more-35216"></span></p>
<p>For some reason that probably has nothing to do with security, Adobe has decided to stop distributing direct links to its Flash Player software. According to the company&#8217;s <a href="https://www.adobe.com/products/flashplayer/distribution3.html" target="_blank">Flash distribution page</a>, on June 30, 2016 Adobe will decommission direct links to various Flash Player downloads. This will essentially force Flash users to update the program using its built-in automatic updates feature (which sometimes takes days to notice a new security update is available), or to install the program from the company&#8217;s Flash Home page &#8212; a download that currently bundles <strong>McAfee Security Scan Plus</strong> and a product called <strong>True Key by Intel Security</strong>.</p>
<p>Anything that makes it less likely users will update Flash seems like a bad idea, especially when we&#8217;re talking about a program that often needs security fixes more than once a month.</p>


feed_id: http://krebsonsecurity.com/?p=35154
title: FBI Raids Spammer Outed by KrebsOnSecurity
uri: FBI-Raids-Spammer-Outed-by-KrebsOnSecurity
url: http://krebsonsecurity.com/2016/06/fbi-raids-spammer-outed-by-krebsonsecurity/
content:
<p><strong>Michael A. Persaud</strong>, a California man profiled in <a href="http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/" target="_blank">a Nov. 2014 KrebsOnSecurity story</a> about a junk email artist currently flagged by anti-spam activists as one of the world&#8217;s Top 10 Worst Spammers, was reportedly raided by the FBI in connection with a federal spam investigation.</p>
<p><img class="alignright wp-image-8495" src="media/f3c33868.atball-300x300.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2011/03/atball-300x300.jpg" alt="atball" width="260" height="260" srcset="http://krebsonsecurity.com/wp-content/uploads/2011/03/atball-150x150.jpg 150w, http://krebsonsecurity.com/wp-content/uploads/2011/03/atball-300x300.jpg 300w" sizes="(max-width: 260px) 100vw, 260px" />According to <a href="http://abcnews.go.com/Technology/fbi-targeting-worlds-worst-email-spammers/story?id=39681104" target="_blank">a June 9 story</a> at <strong>ABC News</strong>, on April 27, 2016 the <strong>FBI</strong> raided the San Diego home of Persaud, who reportedly has been under federal investigation since at least 2013. The story noted that on June 6, 2016, the FBI asked for and was granted a warrant to search Persaud&#8217;s iCloud account, which investigators believe contained &#8220;evidence of illegal spamming&#8217; and wire fraud to further [Persaud&#8217;s] spamming activities.&#8221;</p>
<p>Persaud doesn&#8217;t appear to have been charged with a crime in connection with this investigation. He maintains his email marketing business is legitimate and complies with the CAN-SPAM Act, the main anti-spam law in the United States which prohibits the sending of spam that spoofs that sender’s address or does not give recipients an easy way to opt out of receiving future such emails from that sender.</p>
<p>The affidavit that investigators with the FBI used to get a warrant for Persaud&#8217;s iCloud account is sealed, but a copy of it was obtained by KrebsOnSecurity. It shows that during the April 2016 FBI search of his home, Persaud told agents that he currently conducts internet marketing from his residence by sending a million emails in under 15 minutes from various domains and Internet addresses.</p>
<p>The affidavit indicates the FBI was very interested in the email address <strong>michaelp77x@gmail.com</strong>. In my 2014 piece <a href="http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/" target="_blank">Still Spamming After All These Years</a>, I called attention to this address as the one tied to Persaud&#8217;s <strong>Facebook</strong> account &#8212; and to 5,000 or so domains he was advertising in spam. The story was about how the junk email Persaud acknowledged sending was being relayed through broad swaths of Internet address space that had been hijacked from hosting firms and other companies.</p>
<p><img class="alignleft size-medium wp-image-28602" src="media/db4a6446.persaud-fb-285x120.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/persaud-fb-285x120.png" alt="persaud-fb" width="285" height="120" /><strong>FBI Special Agent Timothy J. Wilkins</strong> wrote that investigators also subpoenaed and got access to that michaelp77x@gmail.com account, and found emails between Persaud and at least four affiliate programs that hire spammers to send junk email campaigns.</p>
<p>A <a href="http://krebsonsecurity.com/?s=affiliate+program&amp;x=0&amp;y=0" target="_blank">spam affiliate program</a> is a type of business or online retailer &#8212; such as an Internet pharmacy &#8212; that pays a third party (known as affiliates or spammers) a percentage of any sales that they generate for the program (for a much deeper dive on how affiliate programs work, check out <a href="https://www.amazon.com/Spam-Nation-Organized-Cybercrimefrom-Epidemic/dp/1501210424" target="_blank">Spam Nation</a>).<span id="more-35154"></span></p>
<p>When I wrote about Persaud back in 2014, I noted that his spam generally advertised the types of businesses you might expect to see pimped in junk email: payday loans, debt consolidation services, and various &#8220;nutraceutical&#8221; products.</p>
<p>Persaud did not respond to requests for comment. But in an email he sent to KrebsOnSecurity in November 2014, he said:</p>
<blockquote><p>“I can tell you that my company deals with many different ISPs both in the US and overseas and I have seen a few instances where smaller ones will sell space that ends up being hijacked,” Persaud wrote in an email exchange with KrebsOnSecurity. “When purchasing IP space you assume it’s the ISP’s to sell and don’t really think that they are doing anything illegal to obtain it. If we find out IP space has been hijacked we will refuse to use it and demand a refund. As for this email address being listed with domain registrations, it is done so with accordance with the CAN-SPAM guidelines so that recipients may contact us to opt-out of any advertisements they receive.”</p></blockquote>
<p>Persaud is currently <a href="https://www.spamhaus.org/rokso/spammer/SPM1319/michael-persaud" target="_blank">listed as #10</a> on the <a href="https://www.spamhaus.org/statistics/spammers/" target="_blank">World&#8217;s 10 Worst Spammers</a> list maintained by <strong>Spamhaus</strong>, an anti-spam organization. In 1998, Persaud was <a title="http://articles.latimes.com/1998/dec/29/business/fi-58482" href="http://articles.latimes.com/1998/dec/29/business/fi-58482" target="_blank">sued by AOL</a>, which charged that he committed fraud by using various names to send millions of get-rich-quick spam messages to America Online customers. In 2001, the San Diego District Attorney’s office <a title="http://news.cnet.com/California-throws-the-book-at-spam/2100-1023_3-254262.html" href="http://news.cnet.com/California-throws-the-book-at-spam/2100-1023_3-254262.html" target="_blank">filed criminal charges</a> against Persaud, alleging that he and an accomplice crashed a company’s email server after routing their spam through the company’s servers.</p>


feed_id: http://krebsonsecurity.com/?p=35197
title: Microsoft Patches Dozens of Security Holes
uri: Microsoft-Patches-Dozens-of-Security-Holes
url: http://krebsonsecurity.com/2016/06/microsoft-patches-dozens-of-security-holes/
content:
<p><strong>Microsoft</strong> today released updates to address more than three dozen security holes in <strong>Windows</strong> and related software. Meanwhile, <strong>Adobe</strong> &#8212; which normally releases fixes for its ubiquitous <strong>Flash Player</strong> alongside Microsoft&#8217;s monthly Patch Tuesday cycle &#8212; said it&#8217;s putting off today&#8217;s expected Flash patch until the end of this week so it can address an unpatched Flash vulnerability that already is being exploited in active attacks.</p>
<p><img class="alignright size-full wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="229" height="240" />Yes, that&#8217;s right it&#8217;s once again Patch Tuesday, better known to mere mortals as the second Tuesday of each month. Microsoft isn&#8217;t kidding around this particular Tuesday &#8212; pushing out <a href="https://technet.microsoft.com/en-us/library/security/mt637763.aspx" target="_blank">16 patch bundles</a> to address at least 44 security flaws across Windows and related software.</p>
<p>The usual suspects earn &#8220;critical&#8221; ratings: <strong>Internet Explorer</strong> (IE), <strong>Edge</strong> (the new, improved IE), and <strong>Microsoft Office</strong>. Critical is Microsoft&#8217;s term for a flaw that allows the attacker to remotely take control over the victim&#8217;s machine without help from the victim, save for perhaps getting him to visit a booby-trapped Web site or load a poisoned ad in IE or Edge.</p>
<p>Windows home users aren&#8217;t the only ones who get to have all the fun: There&#8217;s plenty enough in today&#8217;s Microsoft patch batch to sow dread in any Windows system administrator, including patches that fix serious security holes in <strong>Windows SMB Server</strong>, <strong>Microsoft&#8217;s DNS Server,</strong> and <strong>Exchange Server</strong>.</p>
<p>I&#8217;ll put up a note later this week whenever Adobe releases the Flash update. For now, <strong>Kaspersky</strong> <a href="https://securelist.com/blog/research/75082/cve-2016-4171-adobe-flash-zero-day-used-in-targeted-attacks/" target="_blank">has more</a> on the Flash vulnerability and its apparent use in active espionage attacks. As ever, if you experience any issues after applying any of today&#8217;s updates, please drop a note about it in the comments below.</p>
<p>Other resources: Takes from the <a href="https://isc.sans.edu/mspatchdays.html?viewday=2016-06-14" target="_blank">SANS Internet Storm Center</a>, <a href="https://blog.qualys.com/laws-of-vulnerabilities/2016/06/14/patch-tuesday-june-2016" target="_blank">Qualys</a> and <a href="http://blog.shavlik.com/june-patch-tuesday/" target="_blank">Shavlik</a>.</p>


feed_id: http://krebsonsecurity.com/?p=34891
title: ATM Insert Skimmers In Action
uri: ATM-Insert-Skimmers-In-Action
url: http://krebsonsecurity.com/2016/06/atm-insert-skimmers-in-action/
content:
<p>KrebsOnSecurity has featured several recent posts on &#8220;<a href="http://krebsonsecurity.com/?s=insert+skimmer&amp;x=0&amp;y=0" target="_blank">insert skimmers</a>,&#8221; ATM skimming devices made to fit snugly and invisibly inside a cash machine&#8217;s card acceptance slot. I&#8217;m revisiting the subject again because I&#8217;ve recently acquired how-to videos produced by two different insert skimmer peddlers, and these silent movies show a great deal more than words can tell about how insert skimmers do their dirty work.</p>
<p>Last month I wrote about <a href="http://krebsonsecurity.com/2016/05/crooks-go-deep-with-deep-insert-skimmers/" target="_blank">an alert</a> from ATM giant <strong>NCR Corp.</strong>, which said it was seeing an increase in cash machines compromised by what it called &#8220;deep insert&#8221; skimmers. These skimmers can hook into little nooks inside the mechanized card acceptance slot, which is a generally quite a bit wider than the width of an ATM card.</p>
<p>&#8220;The first ones were quite fat and were the same width of the card,&#8221; said <strong>Charlie Harrow</strong>, solutions manager for global security at NCR. &#8220;The newer ones are much thinner and sit right there where the magnetic stripe reader is.&#8221;</p>
<p>Operating the insert skimmer pictured in the video below requires two special tools that are sold with it: One to set the skimmer in place inside the ATM&#8217;s card acceptance slot, and another to retrieve it. NCR told me its technicians had never actually found any tools crooks use to install and retrieve the insert skimmers, but the following sales video produced by an insert skimmer vendor clearly shows a different tool is used for each job:</p>
<div align="center"><iframe src="https://www.youtube.com/embed/Nlx_GDeaEtI" width="520" height="415" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>&nbsp;</p>
<div>
<p>Same goes for a different video produced by yet another vendor of insert skimming devices:</p>
<div align="center"><iframe src="https://www.youtube.com/embed/Y0cfYcWpL70" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>&nbsp;</p>
<div>
<p><span id="more-34891"></span></p>
<p>Here&#8217;s a close-up of the insert skimmer pictured in the first sales video above:</p>
<div id="attachment_35160" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-35160" src="media/05048dba.20150930_134401-580x435.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/20150930_134401-580x435.jpg" alt="An insert skimmer. Credit: Hold Security. " width="580" height="435" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/20150930_134401-580x435.jpg 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/20150930_134401-768x576.jpg 768w, http://krebsonsecurity.com/wp-content/uploads/2016/06/20150930_134401-940x705.jpg 940w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">An insert skimmer. Credit: Hold Security.</p></div>
<p>This video from another insert skimmer seller shows some type of tool I can&#8217;t quite make out that is used to retrieve the skimmer. It&#8217;s unclear if this one requires a second tool to install the device.</p>
<div align="center"><iframe src="https://www.youtube.com/embed/EIblAoKVXKc" width="420" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<div>
<div>
<p>Skimmed card data lets you counterfeit new copies of the card, but to withdraw cash from ATMs using the counterfeit cards the crooks also need to somehow steal each customer&#8217;s PIN. That task usually falls to a false keypad or a hidden camera &#8212; the latter being far more common and cheaper. The seller of the insert skimmer pictured above also sells a hidden camera setup. Below is a false overhead panel, including a cannibalized vidocamera that peeps through a tiny hole down at the ATM keypad.</p>
<div>
<div>
<div id="attachment_35173" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-35173" src="media/9bea9ef9.skimandpanel-580x435.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/skimandpanel-580x435.jpg" alt="The insert skimmer, sold alongside a hidden camera embedded within a false overhead panel." width="580" height="435" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/skimandpanel-580x435.jpg 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/skimandpanel-768x576.jpg 768w, http://krebsonsecurity.com/wp-content/uploads/2016/06/skimandpanel-940x705.jpg 940w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The insert skimmer, sold alongside a hidden camera embedded within a false overhead panel.</p></div>
</div>
</div>
<p>Once you know about all the ways that skimmer thieves are coming up with to fleece the banks and consumers, it&#8217;s difficult not to go through life seeing every ATM as a potential zombie threat &#8212; banging and pulling on the poor machines and half expecting half hoping parts to come unglued. I&#8217;m always disappointed, but it hasn&#8217;t stopped me all the same.</p>
<p>Truthfully, you probably have a better chance of getting physically mugged after withdrawing cash than you do encountering a skimmer in real life. So keep your wits about you when you&#8217;re at the ATM, and avoid dodgy-looking and standalone cash machines in low-lit areas, if possible. Stick to ATMs that are physically installed in a bank. And be especially vigilant when withdrawing cash on the weekends; thieves tend to install skimming devices on a weekend &#8212; when they know the bank won&#8217;t be open again for more than 24 hours.</p>
<p>Lastly but most importantly, covering the PIN pad with your hand defeats the hidden camera from capturing your PIN &#8212; and hidden cameras are used on the vast majority of the more than three dozen ATM skimming incidents that I&#8217;ve covered here. Shockingly, few people bother to take this simple, effective step, as detailed in <a href="http://krebsonsecurity.com/2012/09/a-handy-way-to-foil-atm-skimmer-scams/" target="_blank">this skimmer tale from 2012</a>, wherein I obtained hours worth of video seized from two ATM skimming operations and saw customer after customer walk up, insert their cards and punch in their digits &#8212; all in the clear.</p>
<p>For more on how these insert skimmers work, check out <a href="http://krebsonsecurity.com/2016/05/crooks-go-deep-with-deep-insert-skimmers/" target="_blank">Crooks Go Deep With &#8216;Deep Insert&#8217; Skimmers</a>. If you&#8217;re here because you find skimmers of all kinds fascinating, please see my series <a href="http://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers</a>.</p>
</div>
</div>
</div>
</div>


feed_id: http://krebsonsecurity.com/?p=35044
title: IRS Re-Enables ‘Get Transcript’ Feature
uri: IRS-Re-Enables-Get-Transcript-Feature
url: http://krebsonsecurity.com/2016/06/irs-re-enables-get-transcript-feature/
content:
<p>The <strong>Internal Revenue Service</strong> has re-enabled a service on its Web site that allows taxpayers to get a copy of their previous year&#8217;s tax transcript. The renewed effort to beef up taxpayer authentication methods at <strong>irs.gov</strong> comes more than a year after the agency disabled the transcript service because tax refund fraudsters were using it to steal sensitive data on consumers.</p>
<p><img class="alignright wp-image-34053" src="media/c9553d7a.irsbldg-580x740.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/irsbldg-580x740.png" alt="irsbldg" width="269" height="343" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/03/irsbldg-580x740.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/03/irsbldg.png 666w" sizes="(max-width: 269px) 100vw, 269px" />During the height of tax-filing season in 2015, KrebsOnSecurity <a href="http://krebsonsecurity.com/2015/03/sign-up-at-irs-gov-before-crooks-do-it-for-you/" target="_blank">warned</a> that identity thieves involved in tax refund fraud with the IRS were using irs.gov&#8217;s &#8220;Get Transcript&#8221; feature to glean salary and personal information they didn&#8217;t already have on targeted taxpayers. In May 2015, the IRS <a href="http://krebsonsecurity.com/2015/05/irs-crooks-stole-data-on-100k-taxpayers-via-get-transcript-feature/" target="_blank">suspended the Get Transcript feature</a>, citing its abuse by fraudsters and noting that some 100,000 taxpayers may have been victimized as a result.</p>
<p>In August 2015, the agency <a href="http://krebsonsecurity.com/2015/08/irs-330k-taxpayers-hit-by-get-transcript-scam/" target="_blank">revised those estimates up to 330,000</a>, but in February 2016, the IRS again more than doubled its estimate, saying the actual number of victims was <a href="http://krebsonsecurity.com/2016/02/irs-390k-more-victims-of-irs-gov-weakness/" target="_blank">probably closer to 724,000</a>.</p>
<p>So exactly how does the <a href="https://www.irs.gov/individuals/get-transcript-beta" target="_blank">new-and-improved Get Transcript feature</a> validate that taxpayers who are requesting information aren&#8217;t cybercriminal imposters? According to the IRS&#8217;s <a href="https://www.irs.gov/individuals/get-transcript-faqs" target="_blank">Get Transcript FAQ</a>, the visitor needs to supply a Social Security number (SSN) and have the following:</p>
<ul>
<li dir="ltr">immediate access to your email account to receive a confirmation code;</li>
<li dir="ltr">name, birthdate, mailing address, and filing status from your most recent tax return;</li>
<li dir="ltr">an account number from either a credit card, auto loan, mortgage, home equity loan or home equity line of credit;</li>
<li dir="ltr">a mobile phone number with your name on the account.</li>
</ul>
<p dir="ltr">&#8220;If you previously registered to use IRS Get Transcript Online, Identity Protection PIN, Online Payment Agreement, or ePostcard online services, log in with the same username and password you chose before,&#8221; the IRS said. &#8220;You&#8217;ll need to provide a financial account number and mobile phone number if you haven&#8217;t already done so.&#8221;</p>
<p dir="ltr">The agency said it will then verify your financial account number and mobile phone number with big-three credit bureau <strong>Equifax</strong>. Readers who have <a href="http://krebsonsecurity.com/?s=security+freeze&amp;x=0&amp;y=0" target="_blank">taken my advice and placed a security freeze on their credit files</a> will need to request a temporary thaw in that freeze with Equifax before attempting to verify their identity with the IRS.<span id="more-35044"></span></p>
<p dir="ltr">According to <a href="https://fcw.com/articles/2016/05/17/irs-security-update.aspx" target="_blank">Federal Computer Week</a>, central to the new setup will be knowledge-based authentication that uses supposedly harder-to-answer questions than the tests that led to the compromise of Get Transcript.</p>
<p dir="ltr"><strong>Mike Kasper</strong>, the tax fraud victim whose story ultimately earned him a chance to <a href="http://www.hsgac.senate.gov/hearings/the-irs-data-breach-steps-to-protect-americans-personal-information" target="_blank">testify</a> about the experience before the <strong>U.S. Senate Committee on Homeland Security &amp; Governmental Affairs</strong>, called the new authentication methods a good step forward. But he worries that they will simply encourage tax refund thieves to commit more acts of identity theft in victim&#8217;s name.</p>
<p dir="ltr">&#8220;Looks like the investment for a $6,000 refund went from $10 to purchase credit data or now a card number for the victim, up to about $30 to buy a prepaid number although it&#8217;s probably even cheaper now,&#8221; Kasper said. &#8220;I think the ID thieves might simply open new cell phone or credit card accounts in the name of the victim or even keep changing the name on prepaid cell phone accounts acquired just for this purpose.&#8221;</p>
<p>Kasper notes that the same lame authentication methods that led to the Get Transcript debacle are still used by <a href="http://krebsonsecurity.com/2016/02/irs-390k-more-victims-of-irs-gov-weakness/" target="_blank">annualcreditreport.com</a>, a site mandated by Congress as the only site where consumers can get their by-rights guaranteed free copy of their credit report from each of the major bureaus. Credit reports contain quite a bit of information that may allow thieves to glean the mobile and credit card account numbers for the taxpayers they&#8217;re targeting.</p>
<p>Annualcreditreport.com asks consumers to provide a bunch of personal data that can be bought for about $3-$4 from cybercrime shops online &#8212; such as date of birth, Social Security number, address and previous addresses. The site also asks the visitor to answer a series of so-called knowledge-based authentication (KBA) questions supplied by the credit bureaus.</p>
<p>These KBA questions — which involve four multiple choice, “out of wallet” questions such as previous address, loan amounts and dates — can be successfully enumerated with random guessing.  In many cases, the answers can be found by consulting free online services, such as <strong>Zillow</strong> and <strong>Facebook</strong>.</p>
<p>Fraudsters also may opt to simply phish the phone and credit card information from victims, or turn to criminal data brokers in the underground that specialize in selling these dossiers on consumers, Kasper said.</p>
<p>&#8220;The real question is, when will more banks start to check that the incoming transfer from the IRS is for an account under the name of an actual customer,&#8221; Kasper said. &#8220;Most banks do not do this, but even if they did that is not a complete solution unless they also know their customer. There were probably thousands of fraudulent tax refunds last year where the [perpetrators] just opened up bank accounts in other peoples&#8217; names to receive a refund from the IRS. Because if you&#8217;re a thieve and you open an account in the victim’s name, it’s a little harder to trace.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=35117
title: There’s the Beef: Wendy’s Breach Numbers About to Get Much Meatier
uri: There-s-the-Beef-Wendy-s-Breach-Numbers-About-to-Get-Much-Meatier
url: http://krebsonsecurity.com/2016/06/theres-the-beef-wendys-breach-numbers-about-to-get-much-meatier/
content:
<p>When <a href="http://krebsonsecurity.com/2016/05/wendys-breach-affected-5-of-restaurants/" target="_blank">news broke last month</a> that the credit card breach at fast food chain <strong>Wendy&#8217;s</strong> impacted fewer than 300 out of the company&#8217;s 5,800 locations, the response from many readers was, &#8220;<a href="https://www.youtube.com/watch?v=Ug75diEyiA0" target="_blank">Where&#8217;s the Breach?</a>&#8221; Today, Wendy&#8217;s said the number of stores impacted by the breach is &#8220;significantly higher&#8221; and that the intrusion may not yet be contained.</p>
<p><img class="alignright wp-image-34063" src="media/3500af38.wendysky-580x392.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/wendysky-580x392.png" alt="wendysky" width="328" height="222" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/03/wendysky-580x392.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/03/wendysky.png 868w" sizes="(max-width: 328px) 100vw, 328px" />On January 27, 2016, this publication was the first <a href="http://krebsonsecurity.com/2016/01/wendys-probes-reports-of-credit-card-breach/" target="_blank">to report</a> that Wendy&#8217;s was investigating a card breach. In mid-May, the company announced in its first quarter financial statement that the fraud impacted <a href="http://krebsonsecurity.com/2016/05/wendys-breach-affected-5-of-restaurants/" target="_blank">just five percent of stores</a>.</p>
<p>But since that announcement last month, a number of sources in the fraud and banking community have complained to this author that there was no way the Wendy&#8217;s breach only affected five percent of stores &#8212; given the volume of fraud that the banks have traced back to Wendy&#8217;s customers.</p>
<p>What&#8217;s more, some of those same sources said they were certain the breach was still ongoing well after Wendy&#8217;s made the five percent claim in May. In my March 02 piece <a href="http://krebsonsecurity.com/2016/03/credit-unions-feeling-pinch-in-wendys-breach/" target="_blank">Credit Unions Feeling Pinch in Wendy&#8217;s Breach</a>, I quoted <strong>B. Dan Berger</strong>, CEO of the <strong>National Association of Federal Credit Unions</strong>, saying the he&#8217;d heard from three credit union CEOs who said the fraud they&#8217;ve experienced so far from the Wendy&#8217;s breach has eclipsed what they were hit with in the wake of the Home Depot and Target breaches.</p>
<p>Today, Wendy&#8217;s acknowledged in a statement that the breach is now expected to be &#8220;considerably higher than the 300 restaurants already implicated.&#8221; Company spokesman <strong>Bob Bertini</strong> declined to be more specific about the number of stores involved, citing an ongoing investigation. Bertini also declined to say whether the company is confident that the breach has been contained.</p>
<p>&#8220;Wherever we are finding it we’ve taken action,&#8221; he said. &#8220;But we can’t rule out that there aren’t others.&#8221;</p>
<p>Bertini said part of the problem was that the breach happened in two waves. He said the outside forensics investigators that were assigned to the case by the credit card associations initially found 300 locations that had malware on the point-of-sale devices, but that the company&#8217;s own investigators later discovered a different strain of the malware at some locations. Bertini declined to provide additional details about either of the malware strains found in the intrusions.</p>
<p>&#8220;In recent days, our investigator has identified this additional strain or mutation of the original malware,&#8221; he said. &#8220;It just so happens that this new strain targets a different point of sale system than the original one, and we just within the last few days discovered this.&#8221;<span id="more-35117"></span></p>
<p>The company also emphasized that all of the breached stores were franchised &#8212; not company-run &#8212; entities. Here is the statement that Wendy&#8217;s provided to KrebsOnSecurity, in its entirety:</p>
<blockquote><p>Based on the preliminary findings of the previously-disclosed investigation, the Company reported on May 11 that malware had been discovered on the point of sale (POS) system at fewer than 300 franchised North America Wendy’s restaurants. An additional 50 franchise restaurants were also suspected of experiencing, or had been found to have, other cybersecurity issues. As a result of these issues, the Company directed its investigator to continue to investigate.</p>
<p>In this continued investigation, the Company has recently discovered a variant of the malware, similar in nature to the original, but different in its execution. The attackers used a remote access tool to target a POS system that, as of the May 11 th announcement, the Company believed had not been affected. This malware has been discovered on some franchise restaurants’ POS systems, and the number of franchise restaurants impacted by these cybersecurity attacks is now expected to be considerably higher than the 300 restaurants already implicated. To date, there has been no indication in the ongoing investigation that any Company-operated restaurants were impacted by this activity.</p>
<p>Many franchisees and operators throughout the retail and restaurant industries contract with third-party service providers to maintain and support their POS systems. The Company believes this series of cybersecurity attacks resulted from certain service providers’ remote access credentials being compromised, allowing access to the POS system in certain franchise restaurants serviced by those providers.</p>
<p>The malware used by attackers is highly sophisticated in nature and extremely difficult to detect. Upon detecting the new variant of malware in recent days, the Company has already disabled it in all franchise restaurants where it has been discovered, and the Company continues to work aggressively with its experts and federal law enforcement to continue its investigation.</p>
<p>Customers may call a toll-free number (888-846- 9467) or email PaymentCardUpdate@wendys.com with specific questions.</p></blockquote>
<p>Wendy&#8217;s statement that the attackers got access by stealing credentials that allowed remote access to point-of-sale terminals should hardly be surprising: The vast majority of the breaches involving restaurant and hospitality chains over the past few years have been tied to hacked remote access accounts that POS service providers use to remotely manage the devices.</p>
<p>Wednesday&#8217;s story about a point-of-sale botnet that has <a href="http://krebsonsecurity.com/2016/06/slicing-into-a-point-of-sale-botnet/" target="_blank">stolen at least 1.2 million credit cards from more than 100 Cici&#8217;s Pizza locations</a> and other restaurants noted that Cici&#8217;s point-of-sale provider believes the attackers in this case used social engineering and remote access tools to compromise and maintain control over hacked cash registers.</p>
<p>Once the attackers have their malware loaded onto the point-of-sale devices, they can remotely capture data from each card swiped at that cash register. Thieves can then sell the data to crooks who specialize in encoding the stolen data onto any card with a magnetic stripe, and using the cards to buy gift cards and high-priced goods from big-box stores like Target and Best Buy.</p>
<p>Many retailers are now moving to install card readers that can handle transactions from more secure chip-based credit and debit cards, which are far more expensive for thieves to clone.</p>
<p><strong>Gavin Waugh</strong>, vice president and treasurer at The Wendy&#8217;s Company, declined to say whether Wendy&#8217;s has any timetable for deploying chip-based readers across it&#8217;s fleet of stores &#8212; the vast majority of which are franchise operations.</p>
<p><span class="il">&#8220;I don&#8217;t think that would have solved this problem, and it&#8217;s a bit of a misnomer,&#8221; Waugh said, in response to questions about plans for the deployment of chip-based readers across the company&#8217;s U.S. footprint. &#8220;I think it makes it harder [for the attackers], but I don&#8217;t think it makes it impossible.&#8221;</span></p>
<p><strong>Avivah Litan</strong>, a fraud analyst with <strong>Gartner Inc.</strong>, said chip readers at Wendy&#8217;s would help, but only if the company can turn them on to accept chip transactions. As <a href="http://krebsonsecurity.com/2016/02/the-great-emv-fake-out-no-chip-for-you/" target="_blank">I noted in February</a>, although a large number of merchants have chip card readers in place, many still  face delays in getting the systems up to snuff with the chip card standards.</p>
<p>Litan said the biggest bottleneck right now to more merchants accepting chip cards is first getting their new systems certified as compliant with the chip card standard (known as Europay, Mastercard and Visa or EMV). And the backlog among firms that certify retailers as EMV compliant is rapidly growing.</p>
<p>Litan said the reality is that chip cards will continue to have magnetic stripes on them for many years to come.</p>
<p>&#8220;Unless the mag stripe data is not transmitted anymore and you get rid of the mag stripe, there is always going to be card data compromised, stolen and counterfeited,&#8221; Litan said.</p>
<p><strong>Update June 13, 9:49 a.m. ET:</strong> Added referenced to interview with NAFCU CEO Berger.</p>


feed_id: http://krebsonsecurity.com/?p=35079
title: Slicing Into a Point-of-Sale Botnet
uri: Slicing-Into-a-Point-of-Sale-Botnet
url: http://krebsonsecurity.com/2016/06/slicing-into-a-point-of-sale-botnet/
content:
<p>Last week, KrebsOnSecurity broke the news of <a href="http://krebsonsecurity.com/2016/06/banks-credit-card-breach-at-cicis-pizza/" target="_blank">an ongoing credit card breach involving CiCi&#8217;s Pizza</a>, a restaurant chain in the United States with more than 500 locations. What follows is an exclusive look at a point-of-sale botnet that appears to have enslaved dozens of hacked payment terminals inside of CiCi&#8217;s locations that are being relieved of customer credit card data in real time.</p>
<p>Over the weekend, I heard from a source who said that since November 2015 he&#8217;s been tracking a collection of hacked cash registers. This point-of-sale botnet currently includes more than 100 infected systems, and according to the administrative panel for this crime machine at least half of the compromised systems are running a malicious Microsoft Windows process called cicipos.exe.</p>
<div id="attachment_35112" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/a2483fe5.botsmgr.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/botsmgr.png"><img class="wp-image-35112 size-medium" src="media/0283b0b5.botsmgr-580x298.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/botsmgr-580x298.png" alt="This admin panel shows the Internet address of a number of infected point-of-sale devices as of June 4, 2016. Many of these appear to be at Cici's Pizza locations." width="580" height="298" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/botsmgr-580x298.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/botsmgr-768x395.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/06/botsmgr-940x483.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">This admin panel shows the Internet address of a number of infected point-of-sale devices as of June 4, 2016. Many of these appear to be at Cici&#8217;s Pizza locations.</p></div>
<p>KrebsOnSecurity has not been able to conclusively tie the botnet to CiCi&#8217;s. Neither CiCi&#8217;s nor its outside public relations firm have responded to multiple requests for comment. However, the control panel for this botnet includes the full credit card number and name attached to the card, and several individuals whose names appeared in the botnet control panel confirmed having eaten at CiCi&#8217;s Pizza locations on the same date that their credit card data was siphoned by this botnet.</p>
<p class="p1">Among those was <strong>Richard Higgins</strong> of Prattville, Ala., whose card data was recorded in the botnet logs on June 4, 2016. Reached via phone, Higgins confirmed that he used his debit card to pay for a meal he and his family enjoyed at a CiCi&#8217;s location in Prattville on that same date.</p>
<p>An analysis of the botnet data reveals more than 100 distinct infected systems scattered across the country. However, the panel only displayed hacked systems that were presently reachable online, so the actual number of infected systems may be larger.</p>
<p>Most of the hacked cash registers map back to dynamic Internet addresses assigned by broadband Internet service providers, and those addresses provide little useful information about the owners of the infected systems &#8212; other than offering a general idea of the city and state tied to each address.</p>
<p>For example, the Internet address of the compromised point-of-sale system that stole Mr. Higgins&#8217; card data is 72.242.109.130, which maps back to an Earthlink system in a pool of IP addresses managed out of Montgomery, Ala.</p>
<p><a class="lightbox" href="media/91359f9f.higgins-cicis.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/higgins-cicis.png"><img class="aligncenter wp-image-35101 size-medium" src="media/67f38b11.higgins-cicis-580x269.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/higgins-cicis-580x269.png" alt="higgins-cicis" width="580" height="269" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/higgins-cicis-580x269.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/higgins-cicis-768x356.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/06/higgins-cicis-940x435.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>Many of the botnet logs include brief notes or messages apparently left by CiCi&#8217;s employees for other employees. Most of these messages concern banal details about an employee&#8217;s shift, or issues that need to be addressed when the next employee shift comes in to work.<span id="more-35079"></span></p>
<p>In total, there are more than 1.2 million unique credit and debit card numbers recorded in the botnet logs seen by this reporter. However, the total number of card accounts harvested by the cybercrooks in charge of this crime machine is probably far greater. That&#8217;s because the botnet logs go back to early April 2016, but it appears that someone reset and/or cleared those records prior to that date.</p>
<p>Only about half of the 1.2 million stolen accounts appear to have been taken from compromised CiCi&#8217;s locations. The majority of the other Internet addresses that appear in the bot logs could not be traced back to specific establishments. Others seem to be tied to individual businesses, including a cinema in Wallingford, Ct., a pizza establishment in Chicago (the famous <a href="http://www.loumalnatis.com/" target="_blank">Lou Malnatis</a>), a hotel in Pennsylvania, and a restaurant at a Holiday Inn hotel in Washington, D.C.</p>
<p>This particular point-of-sale botnet looks to be powered by <strong>Punkey</strong>, a POS malware strain <a href="https://www.trustwave.com/Resources/SpiderLabs-Blog/New-POS-Malware-Emerges---Punkey/" target="_blank">first detailed</a> last year by researchers at <strong>Trustwave Spiderlabs</strong>. According to Trustwave, <span class="il">Punkey</span> includes a component that records keystrokes on the infected device, which may explain why short notes left by CiCi&#8217;s employees show up frequently in the bot logs alongside credit card data.</p>
<p>Although CiCi&#8217;s has remained silent so far, the company&#8217;s main point-of-sale service provider &#8212; Clearwater, Fla.-based <strong>Datapoint POS</strong> &#8212; told KrebsOnSecurity last week that the hackers behind this botnet used social engineering to trick employees into installing the malware, and that the breach impacted multiple other point-of-sale providers.</p>
<p>&#8220;All of these attacks have been traced to social engineering/Team Viewer breaches because stores from SEVERAL POS vendors let supposed techs in to conduct ‘support,'&#8221; said <strong>Stephen P. Warne</strong>, vice president of service and support, in an email to this author. &#8220;Nothing to do with any of our support mechanisms which are highly restricted and well within PCI Compliance.&#8221;</p>
<p>Point-of-sale based malware has driven most of the credit card breaches over the past two years, including intrusions at Target and Home Depot, as well as breaches at a slew of point-of-sale vendors. The malware usually is installed via hacked remote administration tools. Once the attackers have their malware loaded onto the point-of-sale devices, they can remotely capture data from each card swiped at that cash register.</p>
<p>Thieves can then sell the data to crooks who specialize in encoding the stolen data onto any card with a magnetic stripe, and using the cards to buy gift cards and high-priced goods from big-box stores like Target and Best Buy.</p>
<p>Readers should remember that they’re not liable for fraudulent charges on their credit or debit cards, but they still have to report the phony transactions. There is no substitute for keeping a close eye on your card statements. Also, consider using credit cards instead of debit cards; having your checking account emptied of cash while your bank sorts out the situation can be a hassle and lead to secondary problems (bounced checks, for instance).</p>


feed_id: http://krebsonsecurity.com/?p=35072
title: Password Re-user? Get Ready to Get Busy
uri: Password-Re-user-Get-Ready-to-Get-Busy
url: http://krebsonsecurity.com/2016/06/password-re-user-get-to-get-busy/
content:
<p>In the wake of megabreaches at some of the Internet&#8217;s most-recognized destinations, don&#8217;t be surprised if you receive password reset requests from numerous companies that <em>didn&#8217;t</em> experience a breach: Some big name companies &#8212; including <strong>Facebook</strong> and <strong>Netflix</strong> &#8212; are in the habit of combing through huge data leak troves for credentials that match those of their customers and then forcing a password reset for those users.</p>
<div id="attachment_35075" style="width: 301px" class="wp-caption alignright"><img class=" wp-image-35075" src="media/29965941.netflixnotice-580x1031.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/netflixnotice-580x1031.png" alt="Netflix sent out notices to customers who re-used their Netflix password at other sites that were hacked." width="291" height="517" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/netflixnotice-580x1031.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/netflixnotice-768x1365.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/06/netflixnotice-940x1671.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/06/netflixnotice.png 1440w" sizes="(max-width: 291px) 100vw, 291px" /><p class="wp-caption-text">Netflix sent out notices to customers who re-used their Netflix password at other sites that were hacked. This notice was shared by a reader who had re-used his Netflix password at one of the breached companies.</p></div>
<p>Netflix.com, for example, sent out a notification late last week to users who made the mistake of re-using their Netflix password at <strong>Linkedin</strong>, <strong>Tumblr</strong> or <strong>MySpace</strong>. All of three of those breaches are years old, but the scope of the intrusions (more than a half billion usernames and passwords leaked in total) only became apparent recently when the credentials were posted online at various sites and services.</p>
<p>&#8220;We believe your Netflix account credentials may have been included in a recent release of email addresses and passwords from an older breach at another company,&#8221; the message from Neflix reads. &#8220;Just to be safe, we&#8217;ve reset your password as a precautionary measure.&#8221;</p>
<p>The missive goes on to urge recipients to visit Netflix.com and click the &#8220;forgot your email or password&#8221; link to reset their passwords.</p>
<p>Netflix is taking this step because it knows from experience that cybercriminals will be using the credentials leaked from Tumblr, MySpace and LinkedIn to see if they work on a variety of third-party sites (including Netflix).</p>
<p>As I wrote last year in <a href="http://krebsonsecurity.com/?s=ashley+madison&amp;x=0&amp;y=0" target="_blank">the aftermath of the AshleyMadison breach</a> that exposed tens of millions of user credentials, Netflix&#8217;s forensics team has been using a tool that the company <a href="http://techblog.netflix.com/2014/08/announcing-scumblr-and-sketchy-search.html" target="_blank" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=http://techblog.netflix.com/2014/08/announcing-scumblr-and-sketchy-search.html&amp;source=gmail&amp;ust=1465127745342000&amp;usg=AFQjCNGLvtRVfXnm3B7E6WzewHiRNq811w">released in 2014 called Scumblr</a>, which scours high-profile sites for specific terms and data.</p>
<div>&#8220;Some <span class="il">Netflix</span> members have received emails encouraging them to change their account passwords as a precautionary measure due to the recent disclosure of additional credentials from an older breach at another internet company,&#8221; Netflix said in a statement released to KrebsOnSecurity. &#8220;Note that we are always engaged in these types of proactive security measures (leveraging Scumblr in addition to other mechanisms and data sources), not just in the case of major security breaches such as this one.&#8221;</div>
<p><span id="more-35072"></span></p>
<p>Facebook also has been <a href="http://krebsonsecurity.com/2013/11/facebook-warns-users-after-adobe-breach/" target="_blank">known to mine data leaked in major external password breaches </a>for any signs that users are re-using their passwords at the hacked entity. After at <a href="http://krebsonsecurity.com/2013/10/adobe-breach-impacted-at-least-38-million-users/" target="_blank">a breach discovered at Adobe in 2013</a> exposed tens of millions Adobe customer credentials, Facebook scoured the leaked Adobe password data for credential recycling among its users.</p>
<p>The last time I wrote about this preemptive security measure, many readers seem to have hastily and erroneously concluded that whichever company is doing the alerting doesn’t properly secure its users passwords if it can simply compare them in plain text to leaked passwords that have already been worked out.</p>
<p>What&#8217;s going on here is that Facebook, Netflix, or any other company who wants to can take a corpus of leaked passwords that have already been guessed or cracked can simply hash those passwords with whatever one-way hashing mechanism(s) they use internally. After that, it’s just a matter of finding any overlapping email addresses that use the same password.</p>
<div id="attachment_23348" style="width: 610px" class="wp-caption aligncenter"><img class="size-large wp-image-23348" src="media/cd90bcbe.fb-message-600x238.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/11/fb-message-600x238.png" alt="Message that Facebook has used in the past to alert users who have re-used their Facebook passwords at other breached sites." width="600" height="238" srcset="http://krebsonsecurity.com/wp-content/uploads/2013/11/fb-message-285x113.png 285w, http://krebsonsecurity.com/wp-content/uploads/2013/11/fb-message-600x238.png 600w, http://krebsonsecurity.com/wp-content/uploads/2013/11/fb-message.png 630w" sizes="(max-width: 600px) 100vw, 600px" /><p class="wp-caption-text">Message that Facebook has used in the past to alert users who have re-used their Facebook passwords at other breached sites.</p></div>


feed_id: http://krebsonsecurity.com/?p=35047
title: Banks: Credit Card Breach at CiCi’s Pizza
uri: Banks-Credit-Card-Breach-at-CiCi-s-Pizza
url: http://krebsonsecurity.com/2016/06/banks-credit-card-breach-at-cicis-pizza/
content:
<p><a href="https://en.wikipedia.org/wiki/CiCi%27s_Pizza" target="_blank">CiCi&#8217;s Pizza</a>, an American fast food business based in Coppell, Texas with more than 500 stores in 35 states, appears to be the latest restaurant chain to struggle with a credit card breach. The data available so far suggests that hackers obtained access to card data at affected restaurants by posing as technical support specialists for the company&#8217;s point-of-sale provider, and that multiple other retailers have been targeted by this same cybercrime gang.</p>
<p><img class="alignright wp-image-35058" src="media/a3e215e9.cicis.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/cicis.png" alt="cicis" width="193" height="193" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/cicis-150x150.png 150w, http://krebsonsecurity.com/wp-content/uploads/2016/06/cicis.png 441w" sizes="(max-width: 193px) 100vw, 193px" />Over the past two months, KrebsOnSecurity has received inquiries from fraud fighters at more than a half-dozen financial institutions in the United States &#8212; all asking if I had any information about a possible credit card breach at CiCi&#8217;s. Every one of these banking industry sources said the same thing: They&#8217;d detected a pattern of fraud on cards that all had all been used in the last few months at various CiCi&#8217;s Pizza locations.</p>
<p>Earlier today, I finally got around to reaching out to the CiCi&#8217;s headquarters in Texas and was referred to a third-party restaurant management firm called <strong>Champion Management</strong>. When I called Champion and told them why I was inquiring, they said &#8220;the issue&#8221; was being handled by an outside public relations firm called <strong>SPM Communications</strong>.</p>
<p>I never did get a substantive response from SPM, which according to their email and phone messages closes at 1 pm on Fridays during the summer. So I decided to follow up on a tip I&#8217;d received from a fraud fighter at one affected bank who said they&#8217;d heard from the <strong>U.S. Secret Service</strong> that the fraud was related to a breach or security weakness at <strong>Datapoint</strong> (CiCi&#8217;s point-of-sale provider).</p>
<p>Incredibly, I went to look up the contact information for <strong>datapoint[dot]com</strong>, and found that <em>Google <a href="https://support.google.com/websearch/answer/190597?p=ws_hacked&amp;rd=1" target="_blank">was trying to prevent me from visiting this site</a>: According to the search engine giant, Datapoint&#8217;s Web site appears to be compromised! </em>It appears Google has listed the site as hacked and that it was once abused by spammers to promote knockoff male enhancement pills. <span id="more-35047"></span></p>
<div id="attachment_35057" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-35057" src="media/dbfc9fd5.datapoint-580x330.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/datapoint-580x330.png" alt="Google thinks Datapoint's Web site is trying to foist malicious software." width="580" height="330" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/datapoint-580x330.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/datapoint.png 699w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Google thinks Datapoint&#8217;s Web site is trying to foist malicious software.</p></div>
<p>A quick look at Datapoint&#8217;s site via a virtual machine-protected Linux browser indicates that CiCi&#8217;s Pizza is indeed one of the company&#8217;s largest clients. The Secret Service did not immediately respond to requests for comment.</p>
<p>Undeterred, I phoned and emailed Datapoint, and heard back via email from <strong>Stephen P. Warne</strong>, vice president of service and support for the company. Warne said I was jumping to conclusions and that my &#8220;sources&#8221; must have had a beef with the company. Here&#8217;s his email to me, verbatim:</p>
<blockquote><p>If you did indeed talk to the Secret Service you would know that the breaches they have investigated involved multiple POS vendors in one particular franchise, including Harbortouch and Granbury Restaurant Systems.</p>
<p>You would also know that not one Agent we spoke and cooperated with came to any conclusion of wrong doing on our part after scans months ago. The SS actually helped point out that these hackers used among Team Viewer, Screen Connect and some others they installed.</p>
<p>All of these attacks have been traced to social engineering/Team Viewer breaches because stores from SEVERAL POS vendors let supposed techs in to conduct ‘support’. Nothing to do with any of our support mechanisms which are highly restricted and well within PCI Compliance.</p>
<p>I won’t say much else on this as this is not a Datapoint breach. We just happened to have by far the most systems in that particular franchise overwhelmingly.</p></blockquote>
<p>Interestingly, this apparent breach comes to light amid a great deal of speculation on Reddit and other places online about <a href="http://krebsonsecurity.com/2016/06/dropbox-smeared-in-week-of-megabreaches/" target="_blank">a possible data breach at Teamviewer</a>. The idea that countless credit card terminals or cash registers at CiCi&#8217;s Pizza establishments and other businesses could have been compromised by cybercriminals who simply phoned up the establishments posing as tech support technicians for various point-of-sale vendors is remarkable (and frankly pretty ingenious).</p>
<p>I&#8217;ll no doubt have updates to this story as the weekend progresses. Stay tuned.</p>
<p><strong>Update, June 4, 5:01 p.m. ET:</strong> Edited the sentence about Google&#8217;s listing the site as hacked.</p>


feed_id: http://krebsonsecurity.com/?p=35140
title: Rise of Darknet Stokes Fear of The Insider
uri: Rise-of-Darknet-Stokes-Fear-of-The-Insider
url: http://krebsonsecurity.com/2016/06/rise-of-darknet-stokes-fear-of-the-insider/
content:
<p>With the proliferation of shadowy black markets on the so-called &#8220;darknet&#8221; &#8212; hidden crime bazaars that can only be accessed through special software that obscures one&#8217;s true location online &#8212; it has never been easier for disgruntled employees to harm their current or former employer. At least, this is the fear driving a growing stable of companies seeking technical solutions to detect would-be insiders.</p>
<p><strong>Avivah Litan</strong>, a fraud analyst with <strong>Gartner Inc.</strong>, says she&#8217;s been inundated recently with calls from organizations asking what they can do to counter the following scenario: A disaffected or disgruntled employee creates a persona on a darknet market and offers to sell his company&#8217;s intellectual property or access to his employer&#8217;s network.</p>
<div id="attachment_35247" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/bf042999.guitarcenter.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/guitarcenter.png"><img class="wp-image-35247 size-medium" src="media/27257b4f.guitarcenter-580x128.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/guitarcenter-580x128.png" alt="A darknet forum discussion generated by a claimed insider at music retailer Guitar Center." width="580" height="128" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/guitarcenter-580x128.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/guitarcenter-768x169.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/06/guitarcenter-940x207.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/06/guitarcenter.png 1233w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A darknet forum discussion generated by a claimed insider at music retailer Guitar Center.</p></div>
<p>Litan said a year ago she might have received one such inquiry a month; now Litan says she&#8217;s getting multiple calls a week, often from companies that are in a panic.</p>
<p>&#8220;I&#8217;m getting calls from lots of big companies, including manufacturers, banks, pharmaceutical firms and retailers,&#8221; she said. &#8220;A year ago, no one wanted to say whether they had or were seriously worried about insiders, but that&#8217;s changing.&#8221;</p>
<div id="attachment_35250" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/57cad285.bankinsider.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/bankinsider.png"><img class="wp-image-35250 size-medium" src="media/990c2f5f.bankinsider-580x208.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/bankinsider-580x208.png" alt="Insiders don't have to be smart or sophisticated to be dangerous." width="580" height="208" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/bankinsider-580x208.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/bankinsider-768x276.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/06/bankinsider-940x337.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/06/bankinsider.png 1245w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Insiders don&#8217;t have to be smart or sophisticated to be dangerous, as this darknet forum discussion thread illustrates.</p></div>
<p>Some companies with tremendous investments in intellectual property &#8212; particularly pharmaceutical and healthcare firms &#8212; are working with law enforcement or paying security firms to monitor and track actors on the darknet that promise access to specific data or organizations, Litan said.<span id="more-35140"></span></p>
<p>&#8220;One pharma guy I talked to recently said he meets with [federal agents] once a week to see if his employees are active on the darknet,&#8221; she said. <span class="pullquote pqright">&#8220;Turns out there are a lot of disgruntled employees who want to harm their employers. Before, it wasn&#8217;t always clear how to go about doing that, but now they just need to create a free account on some darknet site.&#8221;</span></p>
<p>Statistics and figures only go so far in illustrating the size of the problem. A <a href="http://www.infosecurity-magazine.com/news/insider-threats-reponsible-for-43/" target="_blank">Sept. 2015 report</a> from <strong>Intel</strong> found that internal actors were responsible for 43 percent of data loss &#8212; but only about half of that was intended to harm the employer.</p>
<p>Likewise, the <a href="http://www.verizonenterprise.com/verizon-insights-lab/dbir/2016/" target="_blank">2016 Data Breach Investigation Report</a> (DBIR), an annual survey of data breaches from <strong>Verizon Enterprise</strong>, found insiders and/or the misuse of employee privileges were present in a majority of incident. Yet it also concluded that much of this was not malicious but instead appeared related to employees mailing sensitive information or loading it to a file-sharing service online.</p>
<p>Perhaps one reason insiders are so feared is that the malicious ones very often can operate for years undetected, doing major damage to employers in the process. Indeed, Verizon&#8217;s DBIR found that insider breaches usually takes months or years to discover.</p>
<p><strong>Noam Jolles</strong>, a senior intelligence expert at <strong>Diskin Advanced Technologies</strong>, studies darknet communities. I interviewed her last year in &#8220;<a href="http://krebsonsecurity.com/2015/09/bidding-for-breaches-redefining-targeted-attacks/" target="_blank">Bidding for Breaches</a>,&#8221; a story about a secretive darknet forum called Enigma where members could be hired to launch targeted phishing attacks at companies. Some Enigma members routinely solicited bids regarding names of people at targeted corporations that could serve as insiders, as well as lists of people who might be susceptible to being recruited or extorted.</p>
<p>Jolles said the proliferation of darkweb communities has lowered the barriers to entry for insiders, and provided even the least sophisticated would-be insiders with ample opportunities to betray their employer&#8217;s trust.</p>
<p>&#8220;I&#8217;m not sure everyone is aware of how simple and practical this phenomena looks from adversary eyes and how far it is from the notion of an insider as a sophisticated disgruntled employee,&#8221; Jolles said. <span class="pullquote pqleft">&#8220;The damage from the insider is not necessarily due to his position, but rather to the sophistication of the threat actors that put their hands on him.&#8221;</span></p>
<p>Who is the typical insider? According to Verizon&#8217;s DBIR, almost one third of insiders at breaches in 2015 were found to be end users who had access to sensitive data as a requirement to do their jobs.</p>
<p>&#8220;Only a small percentage (14%) are in leadership roles (executive or other management), or in roles with elevated access privilege jobs such as system administrators or developers (14%),&#8221; Verizon wrote, noting that insiders were most commonly found in administrative, healthcare and public sector jobs. &#8220;The moral of this story is to worry less about job titles and more about the level of access that every Joe or Jane has (and your ability to monitor them). At the end of the day, keep up a healthy level of suspicion toward all employees.&#8221;</p>
<p>If tech industry analysts like Litan are getting pinged left and right about the insider threat these days, it might have something to do with how easy it is to find company proprietary information or access on offer in darknet forums &#8212; many of which allow virtually anyone to register and join.</p>
<div id="attachment_35249" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/c2bd7078.vodaphony.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/vodaphony.png"><img class="wp-image-35249 size-medium" src="media/28f822bf.vodaphony-580x137.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/vodaphony-580x137.png" alt="A darknet forum discussion about possible insiders at Vodafone." width="580" height="137" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/vodaphony-580x137.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/vodaphony-768x181.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/06/vodaphony-940x222.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/06/vodaphony.png 1113w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A darknet forum discussion about possible insiders at Vodafone.</p></div>
<p>The other reason may be that there are a lot more companies looking for this information and actively notifying affected organizations. These notifications invariably become sales pitches for &#8220;dark web monitoring&#8221; or &#8220;threat intelligence services,&#8221; and a lot of companies probably aren&#8217;t sure what to make of this still-nascent industry.</p>
<p>How can organizations better detect insiders before the damage is done? Gartner&#8217;s Litan emphasized continuous monitoring and screening for trusted insiders with high privileges. Beyond that, Litan says there are a wide range of data-driven insider threat technology solutions. On the one end of the spectrum are companies that conduct targeted keyword searches on behalf of clients on social media networks and darknet destinations. More serious and expensive offerings apply machine learning to internal human resources (HR) records, and work to discover and infiltrate online crime rings.</p>
<p>What&#8217;s Verizon&#8217;s answer to the insider threat? &#8220;Love your employees, bond at the company retreat, bring in bagels on Friday, but monitor the heck out of their authorized daily activity, especially ones with access to monetizable data (financial account information, personally identifiable information (PII), payment cards, medical records).&#8221;</p>
<p><a class="lightbox" href="media/81877e56.ladbrokes.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/ladbrokes.png"><img class="aligncenter wp-image-35251 size-medium" src="media/94ff03b2.ladbrokes-580x140.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/ladbrokes-580x140.png" alt="ladbrokes" width="580" height="140" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/ladbrokes-580x140.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/ladbrokes-768x185.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/06/ladbrokes-940x226.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/06/ladbrokes.png 992w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>Additional reading: <a href="http://blogs.gartner.com/avivah-litan/2016/06/21/insider-threats-escalate-and-thrive-in-the-dark-web/" target="_blank">Insider Threats Escalate and Thrive in the Dark Web</a>.</p>


feed_id: http://krebsonsecurity.com/?p=35114
title: How to Spot Ingenico Self-Checkout Skimmers
uri: How-to-Spot-Ingenico-Self-Checkout-Skimmers
url: http://krebsonsecurity.com/2016/06/how-to-spot-ingenico-self-checkout-skimmers/
content:
<p>A KrebsOnSecurity <a href="http://krebsonsecurity.com/2016/05/skimmers-found-at-walmart-a-closer-look/" target="_blank">story</a> last month about credit card skimmers found in self-checkout lanes at some <strong>Walmart</strong> locations got picked up by quite a few publications. Since then I&#8217;ve heard from several readers who work at retailers that use hundreds of thousands of these <strong>Ingenico</strong> credit card terminals across their stores, and all wanted to know the same thing: How could they tell if their self-checkout lanes were compromised? This post provides a few pointers.</p>
<p>Happily, just days before my story point-of-sale vendor Ingenico produced a tutorial on how to spot a skimmer on self checkout lanes powered by Ingenico iSC250 card terminals. Unfortunately, it doesn&#8217;t appear that this report was widely disseminated, because I&#8217;m still getting questions from readers at retailers that use these devices.</p>
<div id="attachment_35287" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/845bfc14.redcalipers.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/redcalipers.png"><img class="wp-image-35287 size-medium" src="media/ba0deede.redcalipers-580x326.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/redcalipers-580x326.png" alt="The red calipers in the image above show the size differences in various noticeable areas of the case overlay on the left compared to the actual ISC250 on the right. Source: Ingenico." width="580" height="326" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/redcalipers-580x326.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/redcalipers-768x431.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/06/redcalipers-940x528.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/06/redcalipers.png 1318w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The red calipers in the image above show the size differences in various noticeable areas of the case overlay on the left compared to the actual iSC250 on the right. Source: Ingenico.</p></div>
<p>&#8220;In order for the overlay to fit atop the POS [point-of-sale] terminal, it must be longer and wider than the target device,&#8221; reads a May 16, 2016 security bulletin obtained by KrebsOnSecurity. &#8220;For this reason, the case overlay will appear noticeably larger than the actual POS terminal. This is the primary identifying characteristic of the skimming device. A skimmer overlay of the iSC250 is over 6 inches wide and 7 inches tall while the iSC250 itself is 5 9/16 inch wide and 6 1⁄2 inches tall.&#8221;</p>
<p>In addition, the skimming device that thieves can attach in the blink of an eye on top of the Ingenico self-checkout card reader blocks the backlight from coming through the fake PIN pad overlay.</p>
<div id="attachment_35286" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/8a17fc46.ingenicobacklight.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/ingenicobacklight.png"><img class="wp-image-35286 size-medium" src="media/37f32b39.ingenicobacklight-580x219.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/ingenicobacklight-580x219.png" alt="The backlight can be best seen while shading the keypad from room lights. The image on the left is a powered-on legitimate ISC250 viewed with the keypad shaded. The backlight can be seen in comparison to a powered-off ISC250 in the right image. Source: Ingenico." width="580" height="219" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/ingenicobacklight-580x219.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/ingenicobacklight-768x290.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/06/ingenicobacklight-940x355.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/06/ingenicobacklight.png 1314w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The backlight can be best seen while shading the keypad from room lights. The image on the left is a powered-on legitimate iSC250 viewed with the keypad shaded. The backlight can be seen in comparison to a powered-off iSC250 in the right image. Source: Ingenico.</p></div>
<p><span id="more-35114"></span></p>
<p>What&#8217;s more, the skimming overlay devices currently block the green LED light that is illuminated during contactless card reads like Apple Pay.</p>
<div id="attachment_35285" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/09a5aab8.ingenicogreenlight.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/ingenicogreenlight.png"><img class="wp-image-35285 size-medium" src="media/9f9b8e46.ingenicogreenlight-580x137.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/ingenicogreenlight-580x137.png" alt="The green LED light that is lit up during contactless payments is obscured by the overlay skimmer. Source: Ingenico." width="580" height="137" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/ingenicogreenlight-580x137.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/ingenicogreenlight-768x182.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/06/ingenicogreenlight-940x223.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/06/ingenicogreenlight.png 1318w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The green LED light that is lit up during contactless payments is obscured by the overlay skimmer. Source: Ingenico.</p></div>
<p>The overlay skimming devices pictured here include their own tiny magnetic read heads to snarf card data from the magnetic stripe when customers swipe their cards. Consequently, those tiny readers often interfere with the legitimate magnetic card reader on the underlying device, meaning compromised self-checkout lines may move a bit slower than others.</p>
<p>&#8220;The overlay design appears to occasionally interfere with the magnetic stripe reads, leading to greater numbers of read failures,&#8221; Ingenico wrote.</p>
<p>Finally, all checkout terminals include a tethered stylus that customers use to sign their names after swiping their cards. According to Ingenico, the skimmers made to fit the iSC250 appear to prevent the ordinary placement of the stylus due to the obtrusive overhang of the skimmer overlay.</p>
<div id="attachment_35288" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/753c148e.isc250overhang.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/isc250overhang.png"><img class="wp-image-35288 size-medium" src="media/c98d8acb.isc250overhang-580x263.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/isc250overhang-580x263.png" alt="The overlay skimmer on the left blocks the stylus tray. The picture on the right is a device that's not been attacked." width="580" height="263" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/isc250overhang-580x263.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/isc250overhang-768x348.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/06/isc250overhang-940x426.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/06/isc250overhang.png 1302w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The overlay skimmer on the left blocks the stylus tray. The picture on the right is a device that&#8217;s not been attacked.</p></div>
<p>It&#8217;s probably true that posting information like this online gives skimmer scammers an opportunity to improve their product and to make the telltale giveaways less noticeable. However, this only goes so far without significantly driving up the cost of these overlay skimmers. Each iSC250 skimmer already retails for a few hundred bucks apiece &#8212; <em>and that&#8217;s without the electronics needed to gather and store card data</em>. The up-front cost of these fraud devices is important because the fraudsters have no guarantee they will be able to recover their skimmers before the devices are discovered.</p>
<p>On the other hand, as I mentioned earlier there are countless nationwide retailers that have hundreds of thousands of these Ingenico devices installed in self-checkout lanes, and that in turn means millions of employees and customers who are the first lines of defense against skimmers. The more people know about what to look for in these fraud devices, the more likely the fraudsters will lose their up-front investments &#8212; and maybe even get busted trying to retrieve them.</p>


feed_id: http://krebsonsecurity.com/?p=35273
title: Scientology Seeks Captive Converts Via Google Maps, Drug Rehab Centers
uri: Scientology-Seeks-Captive-Converts-Via-Google-Maps-Drug-Rehab-Centers
url:
http://krebsonsecurity.com/2016/06/scientology-seeks-captive-converts-via-google-maps-drug-rehab-centers/

content:
<p>Fake online reviews generated by unscrupulous marketers blanket the Internet these days. Although online review pollution isn&#8217;t exactly a hot-button consumer issue, there are plenty of cases in which phony reviews may endanger one&#8217;s life or well-being. This is the story about how searching for drug abuse treatment services online could cause concerned loved ones to send their addicted, vulnerable friends or family members straight into the arms of the <strong>Church of Scientology</strong>.</p>
<p>As explained in last year&#8217;s piece, <a href="http://krebsonsecurity.com/2015/10/dont-be-fooled-by-fake-online-reviews-part-ii/" target="_blank">Don&#8217;t Be Fooled by Fake Online Reviews Part II</a>, there are countless real-world services that are primed for exploitation online by marketers engaged in false and misleading &#8220;search engine optimization&#8221; (SEO) techniques. These shady actors specialize in creating hundreds or thousands of phantom companies online, each with different generic-sounding business names, addresses and phone numbers. The phantom firms often cluster around fake listings created in Google Maps &#8212; complete with numerous five-star reviews, pictures, phone numbers and Web site links.</p>
<p>The problem is that calls to any of these phony companies are routed back to the same crooked SEO entity that created them. That marketer in turn sells the customer lead to one of several companies that have agreed in advance to buy such business leads. As a result, many consumers think they are dealing with one company when they call, yet end up being serviced by a completely unrelated firm that may not have to worry about maintaining a reputation for quality and fair customer service.</p>
<p>Experts say fake online reviews are most prevalent in labor-intensive services that do not require the customer to come into the company’s offices but instead come to the consumer. These services include but are not limited to locksmiths, windshield replacement services, garage door repair and replacement technicians, carpet cleaning and other services that consumers very often call for immediate service.</p>
<p>As it happens, the problem is widespread in the drug rehabilitation industry as well. That became apparent after I spent just a few hours with <strong>Bryan Seely</strong>, the guy who literally <a href="https://www.amazon.com/gp/product/1533156778/ref=as_li_tl?ie=UTF8&amp;tag=seelysecurity-20&amp;camp=1789&amp;creative=9325&amp;linkCode=as2&amp;creativeASIN=1533156778&amp;linkId=bb0aa50317eb9ed82a7919a56a7155b1" target="_blank">wrote the definitive book on fake Internet reviews</a>.</p>
<p>Perhaps best known for a stunt in which he used fake Google Maps listings to <a href="https://www.youtube.com/watch?v=5c6AADI7Pb4" target="_blank">intercept calls destined for the FBI and U.S. Secret Service</a>, Seely knows a thing or two about this industry: Until 2011, he worked for an SEO firm that helped to develop and spread some of the same fake online reviews that he is now helping to clean up.</p>
<p>More recently, Seely has been tracking a network of hundreds of phony listings and reviews that lead inquiring customers to fewer than a half dozen drug rehab centers, including <strong><a href="https://en.wikipedia.org/wiki/Narconon" target="_blank">Narconon International</a> </strong>&#8212; an organization that promotes the theories of <a title="Scientology" href="https://en.wikipedia.org/wiki/Scientology" data-ss1467034033="1">Scientology</a> founder <a title="L. Ron Hubbard" href="https://en.wikipedia.org/wiki/L._Ron_Hubbard" data-ss1467034033="1">L. Ron Hubbard</a> regarding substance abuse treatment and addiction.</p>
<p>As described in <a href="https://en.wikipedia.org/wiki/Narconon" target="_blank">Narconon&#8217;s Wikipedia entry</a>, Narconon facilities are known not only for attempting to win over new converts, but also for treating all drug addictions with a rather bizarre cocktail consisting mainly of vitamins and long hours in extremely hot saunas. The Wiki entry documents multiple cases of accidental deaths at Narconon facilities, where some addicts reportedly died from overdoses of vitamins or neglect:</p>
<p>&#8220;Narconon has faced considerable controversy over the safety and effectiveness of its rehabilitation methods,&#8221; the Wiki entry reads. &#8220;Narconon teaches that drugs reside in body fat, and remain there indefinitely, and that to recover from drug abuse, addicts can remove the drugs from their fat through saunas and use of vitamins. Medical experts disagree with this basic understanding of physiology, saying that no significant amount of drugs are stored in fat, and that drugs can&#8217;t be &#8216;sweated out&#8217; as Narconon claims.&#8221;</p>
<div id="attachment_35338" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/e3281003.whatshappening.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/whatshappening.png"><img class="wp-image-35338 size-medium" src="media/1a11233f.whatshappening-580x315.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/whatshappening-580x315.png" alt="whatshappening" width="580" height="315" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/whatshappening-580x315.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/whatshappening-768x418.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/06/whatshappening-940x511.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/06/whatshappening.png 1177w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Source: Seely Security.</p></div>
<h4>FOLLOW THE BOUNCING BALL</h4>
<p>Seely said he learned that the drug rehab industry was overrun with SEO firms when he began researching rehab centers in Seattle for a family friend who was struggling with substance abuse and addiction issues. A simple search on Google for &#8220;drug rehab Seattle&#8221; turned up multiple local search results that looked promising.</p>
<p>One of the top three results was for a business calling itself &#8220;Drug Rehab Seattle,&#8221; and while it lists a toll-free phone number, it does not list a physical address (NB: this is not always the case with fake listings, which just as often claim the street address of another legitimate business). A click on the organization&#8217;s listing claims the Web site <strong>rehabs.com </strong>&#8211; a legitimate drug rehab search service. However, the owners of rehabs.com say this listing is unauthorized and unaffiliated with rehabs.com.</p>
<p>As documented in <a href="https://youtu.be/NcQ7OT0Ythg" target="_blank">this Youtube video</a>, Seely called the toll-free number in the Drug Rehab Seattle listing, and was transferred to a hotline that took down his name, number and insurance information and promised an immediate call back. Within minutes, Seely said, he received a call from a woman who said she represented a Seattle treatment center but was vague about the background of the organization itself. A little digging showed that the treatment center was run by Narconon.<span id="more-35273"></span></p>
<p>&#8220;You&#8217;re supposed to be getting a local drug rehab in Seattle, but instead you get taken to a call center, which can be owned by any number of rehab facilities around the country that pay legitimate vendors for calls,&#8221; Seely said. &#8220;If you run a rehab facility, you have to get people in the doors to make money. The guy who created these fake listings figured out you can use Google Maps to generate leads, and it&#8217;s free.&#8221;</p>
<div id="attachment_35330" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/2748c063.seattledrugresults.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/seattledrugresults.png"><img class="wp-image-35330 size-medium" src="media/93b97285.seattledrugresults-580x614.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/seattledrugresults-580x614.png" alt="TopSeek Inc.'s client list includes Narconon, a Scientology front group that recruits through a network of unorthodox addiction treatment centers." width="580" height="614" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/seattledrugresults-580x614.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/seattledrugresults.png 685w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The phony rehab establishment listed here is the third listing, which includes no physical address and routes the caller to a referral network that sells leads to Narconon, among others.</p></div>
<p>Here&#8217;s the crux of the problem: When you&#8217;re at Google.com and you search for something that Google believes to be a local search, Google adds local business results on top of the organic search results &#8212; complete with listings and reviews associated with Google Maps. Consumers might not even read them, but reviews left for businesses in this listings heavily influence their search rankings. The more reviews a business has, Seely said, the closer it gets to the coveted Number One spot in the search rankings.</p>
<p>That #1 rank attracts the most calls by a huge margin, and it can mean huge profits: Many rehab facilities will pay hundreds of dollars for leads that may ultimately lead to a new patient. After all, some facilities can then turn around and bill insurance providers for tens of thousands of dollars per patient.</p>
<h4>WHO IS JOHN HARVEY?</h4>
<p>Curious if he could track down the company or individual behind the phony review that prompted a call from Narconon, Seely began taking a closer look at the reviews for the facility he called. One reviewer in particular stood out &#8212; one &#8220;John Harvey,&#8221; a Google user who clearly has a great deal of experience with rehab centers.</p>
<p>A click on John Harvey&#8217;s Google Plus profile showed he reviewed <em>no fewer than 82 phantom drug treatment centers around the country, offering very positive 5-star reviews on all of them</em>. A brief search for John Harvey online shows that the person behind the account is indeed <a href="https://www.linkedin.com/in/john-harvey-15a20223" target="_blank">a guy named John Harvey from Sacramento</a> who runs an SEO company in Kuilua, Hawaii called <strong>TopSeek Inc., </strong>which bills itself as a collection of &#8220;local marketing experts.&#8221;</p>
<p>A visit to the company&#8217;s <a href="http://topseekinc.net/#" target="_blank">Web site</a> shows that Narconon is among four of TopSeek&#8217;s listed clients, all of which either operate drug rehab centers or are in the business of marketing drug rehab centers.</p>
<div id="attachment_35331" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/ee535970.topseekclients.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/topseekclients.png"><img class="wp-image-35331 size-medium" src="media/de97cdaf.topseekclients-580x295.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/topseekclients-580x295.png" alt="TopSeek Inc's client list includes Narconon, a Scientology front group that seeks to recruit new members via a network of unorthodox drug treatment facilities. " width="580" height="295" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/topseekclients-580x295.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/topseekclients-768x391.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/06/topseekclients-940x479.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/06/topseekclients.png 1033w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">TopSeek Inc&#8217;s client list includes Narconon, a Scientology front group that seeks to recruit new members via a network of unorthodox drug treatment facilities.</p></div>
<p>Calls and emails to Mr. Harvey went unreturned, but it&#8217;s clear he quickly figured out that the jig was up: Just hours after KrebsOnSecurity reached out to Mr. Harvey for comment, all of his phony addiction treatment center reviews mysteriously disappeared (some of the reviews are preserved in the screenshot below).</p>
<p>&#8220;This guy is sitting in Hawaii saying he&#8217;s retired and that he&#8217;s not taking any more clients,&#8221; Seely said. &#8220;Well, maybe he&#8217;s going to have to come out of retirement to go into prison, because he&#8217;s committed fraud in almost every state.&#8221;</p>
<p>While writing fake online reviews may not be strictly illegal or an offense that could send one to jail, several states have begun <a href="http://searchenginewatch.com/sew/news/2296366/fake-online-reviews-cost-19-companies-usd350-000" target="_blank">cracking down on “reputation management” and SEO companies</a> that engage in writing or purchasing fake reviews. However, it&#8217;s unclear whether the fines being enforced for violations will act as a deterrent, since those fines are likely a fraction of the revenues that shady SEO companies stand gain by engaging in this deceptive practice.</p>
<div id="attachment_35336" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/17d0bafc.johnharvey.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/johnharvey.png"><img class="wp-image-35336 size-medium" src="media/71850223.johnharvey-580x339.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/johnharvey-580x339.png" alt="Some of John Harvey's reviews. All of these have since been deleted." width="580" height="339" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/johnharvey-580x339.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/johnharvey-768x449.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/06/johnharvey-940x550.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/06/johnharvey.png 1151w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Some of John Harvey&#8217;s reviews. All of these have since been deleted.</p></div>
<h4>WHAT YOU CAN DO ABOUT FAKE ONLINE REVIEWS</h4>
<p>Before doing business with a company you found online, don’t just pick the company that comes up tops in the search results on Google. Unfortunately, that generally guarantees little more than the company is good at marketing.</p>
<p>Take the time to research the companies you wish to hire before booking them for jobs or services, especially when it comes to big, expensive, and potentially risky services like drug rehab or <a href="http://krebsonsecurity.com/2015/07/dont-be-fooled-by-phony-online-reviews/" target="_blank">moving companies</a>. By the way, if you&#8217;re looking for a legitimate rehab facility, you could do worse than to start at the aforementioned rehabs.com, a legitimate rehab search engine.</p>
<p>It&#8217;s a good idea to get in the habit of verifying that the organization&#8217;s physical address, phone number and Web address shown in the search result match that of the landing page. If the phone numbers are different, use the contact number listed on the linked site.</p>
<p>Take the time to learn about the organization&#8217;s reputation online and in social media; if it has none (other than a Google Maps listing with all glowing, 5-star reviews), it&#8217;s probably fake. Search the Web for any public records tied to the business&#8217; listed physical address, including articles of incorporation from the local secretary of state office online. A search of the company&#8217;s <a href="https://whois.domaintools.com/" target="_blank">domain name registration records</a> can give you an idea of how long its Web site has been in business, as well as additional details about the company and/or the organization itself.</p>
<p>Seely said one surefire way to avoid these marketing shell games is to ask a simple question of the person who answers the phone in the online listing.</p>
<p>&#8220;Ask anyone on the phone what company they&#8217;re with,&#8221; Seely said. &#8220;Have them tell you, take their information and then call them back. If they aren&#8217;t forthcoming about who they are, they&#8217;re most likely a scam.&#8221;</p>
<p>For the record, I requested comment on this story from Google &#8212; and specifically from the people at Google who handle Google Maps &#8212; but have yet to hear back from them. I&#8217;ll update this story in the event that changes.</p>
<p><strong>Update, 7:47 p.m. ET:</strong> Google responded with the following statement: &#8220;We’re in a constant arms race with local business spammers who, unfortunately, use all sorts of tricks to try to game our system &#8211; and who’ve been a thorn in the Internet’s side for over a decade. Millions of businesses regularly make edits to their addresses, hours of operation and more, so we rely heavily on the community to help keep listings up-to-date and flag issues. But this kind of spam is a clear violation of our <a href="https://support.google.com/business/answer/3038177?hl=en" target="_blank" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=https://support.google.com/business/answer/3038177?hl%3Den&amp;source=gmail&amp;ust=1467157602794000&amp;usg=AFQjCNE-6NWhKlP_YrlMWWOxbIMYEoC5UQ">policies</a> and we want to eradicate it. As spammers change their techniques, we’re continually working on new, better ways to keep them off Google Search and Maps. There’s work to do, and we want to keep doing better.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=36478
title: Inside Arizona’s Pump Skimmer Scourge
uri: Inside-Arizona-s-Pump-Skimmer-Scourge
url: https://krebsonsecurity.com/2016/09/inside-arizonas-pump-skimmer-scourge/
content:
<p>Crooks who deploy skimming devices made to steal payment card details from fuel station pumps don&#8217;t just target filling stations at random: They tend to focus on those that neglect to deploy various tools designed to minimize such scams, including security cameras, non-standard pump locks and tamper-proof security tape. But don&#8217;t take my word for it: Here&#8217;s a look at fuel station compromises in 2016 as documented by the state of<strong> Arizona</strong>, which has seen a dramatic spike in fuel skimming attacks over the past year.</p>
<p>KrebsOnSecurity examined nearly nine months worth of pump skimming incidents in Arizona, where officials say they&#8217;ve documented more skimming attacks in the month of August 2016 alone <a href="http://www.azcentral.com/story/money/business/consumers/2016/09/02/arizona-credit-card-skimmers-on-rise-gas-pumps/89729970/" target="_blank">than in all of 2015 combined</a>.</p>
<p>With each incident, the <strong>Arizona Department of Agriculture&#8217;s Weights and Measures Services Division</strong> <a href="http://ctutools.azda.gov/dwm/pv/Inspection_Search.asp#" target="_blank">files a report</a> detailing whether victim fuel station owners had observed industry best practices leading up to the hacks. As we can see from the interactive story map KrebsOnSecurity created below, the vast majority of compromised filling stations failed to deploy security cameras, and/or tamper-evident seals on the pumps.</p>
<p><iframe src="http://uploads.knightlab.com/storymapjs/4e32fc7e993ad31f11032c23384655fd/arizpumpskim/index.html" width="100%" height="800" frameborder="0"></iframe></p>
<p>Fewer still had changed the factory-default locks on their pumps, meaning thieves armed with a handful of master keys were free to unlock the pumps and install skimming devices at will.</p>
<p>These security report cards for fuel station owners aren&#8217;t complete assessments by any means. Some contain scant details about the above-mentioned precautionary measures, while other reports painstakingly document such information &#8212; complete with multiple photos of the skimming devices. Regardless, the data available show a clear trend of fraudsters targeting owners and operators that flout basic security best practices.<span id="more-36478"></span></p>
<p>Indeed, the data assembled here suggests that skimmer thieves favor off-brand filling stations and target pumps furthest from the station/closest to the street. Also, all but three of the 35 incidents included in this report targeted fuel dispensers made by one manufacturer: <a href="https://en.wikipedia.org/wiki/Gilbarco_Veeder-Root" target="_blank">Gilbarco</a> &#8212; probably because the skimmer thieves responsible were armed with a master key for Gilbarco pumps.</p>
<p>In only one documented skimming incident did the station owner report having used non-standard pump locks. In some cases, the same filling station was hit with separate skimming attacks just a few months apart.</p>
<div id="attachment_36490" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36490" src="media/82daa04e.pumpskim-bt-search-580x155.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/pumpskim-bt-search-580x155.png" alt="A portion of the incident report for the Bluetooth skimmers found at a gas station in Phoenix on Sept. 6, 2016" width="580" height="155" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/pumpskim-bt-search-580x155.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/pumpskim-bt-search-768x205.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/pumpskim-bt-search-940x251.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/09/pumpskim-bt-search.png 1038w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A portion of the incident report for the Bluetooth skimmers found at a gas station in Phoenix on Sept. 6, 2016</p></div>
<p>Investigators also appear to be increasingly finding pump skimmers that employ Bluetooth wireless technology. Bluetooth-based skimmers allow thieves to collect stolen card data merely by pulling up to a pump and downloading it with a Bluetooth-enabled laptop or mobile device (as opposed to taking the risk of re-opening the pumps to retrieve the siphoned card data).</p>
<p>A review of the locations of the skimmed stations suggests that skimmer scammers prefer poorly secured stations that are quite close to a major highway, no doubt so that they get away from the station relatively quickly after the skimmers are planted. It&#8217;s unclear whether the skimming attacks documented here are the work of one or multiple scammers or gangs, but the activity pretty clearly shows a focus on stations directly off the main arteries from Phoenix on down to Tuscon.</p>
<p><img class="alignright wp-image-36487" src="media/478dae38.az-skimline.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/az-skimline.png" alt="az-skimline" width="261" height="291" /></p>
<p>In some of the images in the slideshow above, it may be difficult to readily tell among the jumble of wires which bit is the skimmer. When in doubt, look for an area wrapped in black or grey colored electrical tape, which seems to be found in nearly all of these pump skimming attacks.</p>
<p>Arizona is almost certainly a microcosm of pump skimming activity going on nationally. Last year, KrebsOnSecurity ran <a href="https://krebsonsecurity.com/2015/11/gas-theft-gangs-fuel-pump-skimming-scams/" target="_blank">an in-depth piece</a> profiling a <strong>U.S. Secret Service</strong> task force that&#8217;s been battling a surge in pump skimming scams perpetrated by organized crime gangs in and around Los Angeles. Other stories on pump skimmers can be found in <a href="https://krebsonsecurity.com/?s=pump+skimmer&amp;x=0&amp;y=0" target="_blank">this search link</a>.</p>
<p>Consumers should remember that they’re not liable for fraudulent charges on their credit or debit cards, but they still have to report the phony transactions. There is no substitute for keeping a close eye on your card statements. Also, use credit cards instead of debit cards at the pump; having your checking account emptied of cash while your bank sorts out the situation can be a huge hassle and create secondary problems (bounced checks, for instance).</p>
<p>I realize that the project above &#8212; made with the free <a href="https://storymap.knightlab.com/" target="_blank">StoryMap tool</a> from <a href="https://knightlab.northwestern.edu/projects/#about" target="_blank">Northwestern University&#8217;s Knight Lab</a> &#8212; may be difficult to view comfortably within the confines of this blog. <a href="https://uploads.knightlab.com/storymapjs/4e32fc7e993ad31f11032c23384655fd/arizpumpskim/draft.html" target="_blank">Here&#8217;s a direct link</a> to the full map and timeline.</p>


feed_id: https://krebsonsecurity.com/?p=36451
title: The Democratization of Censorship
uri: The-Democratization-of-Censorship
url: https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/
content:
<p><strong>John Gilmore</strong>, an American entrepreneur and civil libertarian, once famously <a href="https://en.wikipedia.org/wiki/John_Gilmore_(activist)" target="_blank">quipped</a> that “the Internet interprets censorship as damage and routes around it.&#8221; This notion undoubtedly rings true for those who see national governments as the principal threats to free speech.</p>
<p>However, events of the past week have convinced me that one of the fastest-growing censorship threats on the Internet today comes not from nation-states, but from super-empowered individuals who have been quietly building extremely potent cyber weapons with transnational reach.</p>
<p><img class="aligncenter size-medium wp-image-36461" src="media/34c17fa0.underwater-580x580.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/underwater-580x580.jpg" alt="underwater" width="580" height="580" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/underwater-150x150.jpg 150w, http://krebsonsecurity.com/wp-content/uploads/2016/09/underwater-580x580.jpg 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/underwater-768x768.jpg 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/underwater-940x940.jpg 940w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>More than 20 years after Gilmore first coined that turn of phrase, his most notable quotable has effectively been inverted &#8212; “Censorship can in fact route around the Internet.” The Internet can’t route around censorship when the censorship is all-pervasive and armed with, for all practical purposes, near-infinite reach and capacity. I call this rather unwelcome and hostile development the “The Democratization of Censorship.”</p>
<p>Allow me to explain how I arrived at this unsettling conclusion. As many of you know, my site was taken offline for the better part of this week. The outage came in the wake of a <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">historically large distributed denial-of-service</a> (DDoS) attack which hurled so much junk traffic at Krebsonsecurity.com that my DDoS protection provider <strong>Akamai</strong> chose to unmoor my site from its protective harbor.</p>
<p>Let me be clear: I do not fault Akamai for their decision. I was a pro bono customer from the start, and Akamai and its sister company Prolexic have stood by me through countless attacks over the past four years. It just so happened that this last siege was nearly twice the size of the next-largest attack they had ever seen before. Once it became evident that the assault was beginning to cause problems for the company’s paying customers, they explained that the choice to let my site go was a business decision, pure and simple.</p>
<p>Nevertheless, Akamai rather abruptly informed me I had until 6 p.m. that very same day — roughly two hours later — to make arrangements for migrating off their network. My main concern at the time was making sure my hosting provider wasn’t going to bear the brunt of the attack when the shields fell. To ensure that absolutely would not happen, I asked Akamai to redirect my site to 127.0.0.1 — effectively relegating all traffic destined for KrebsOnSecurity.com into a giant black hole.</p>
<p>Today, I am happy to report that the site is back up — this time under <a href="https://jigsaw.google.com/projects/#project-shield" target="_blank">Project Shield</a>, a free program run by <strong>Google</strong> to help protect journalists from online censorship. And make no mistake, DDoS attacks — particularly those the size of the assault that hit my site this week — are uniquely effective weapons for stomping on free speech, for reasons I’ll explore in this post.</p>
<div id="attachment_36458" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36458" src="media/b93fda08.projectshield-580x381.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/projectshield-580x381.png" alt="Google's Project Shield is now protecting KrebsOnSecurity.com" width="580" height="381" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/projectshield-580x381.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/projectshield-768x504.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/projectshield-940x617.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/09/projectshield.png 1238w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Google&#8217;s Project Shield is now protecting KrebsOnSecurity.com</p></div>
<p>Why do I speak of DDoS attacks as a form of censorship? Quite simply because the economics of mitigating large-scale DDoS attacks do not bode well for protecting the individual user, to say nothing of independent journalists.</p>
<p>In <a href="https://www.bostonglobe.com/business/2016/09/23/cybercrooks-akamai/qOAhvHoohJcmkxIwg5ChKO/story.html" target="_blank">an interview</a> with <em>The Boston Globe</em>, Akamai executives said the attack &#8212; if sustained &#8212; likely would have cost the company millions of dollars. In the hours and days following my site going offline, I spoke with multiple DDoS mitigation firms. One offered to host KrebsOnSecurity for two weeks at no charge, but after that they said the same kind of protection I had under Akamai would cost between $150,000 and $200,000 per year.</p>
<p>Ask yourself how many independent journalists could possibly afford that kind of protection money? A number of other providers offered to help, but it was clear that they did not have the muscle to be able to withstand such massive attacks.</p>
<p>I’ve been toying with the idea of forming a 501(c)3 non-profit organization — ‘The Center for the Defense of Internet Journalism’, if you will — to assist Internet journalists with obtaining the kind of protection they may need when they become the targets of attacks like the one that hit my site.  Maybe a Kickstarter campaign, along with donations from well-known charitable organizations, could get the ball rolling.  It’s food for thought.<span id="more-36451"></span></p>
<h4>CALIBRATING THE CANNONS</h4>
<p>Earlier this month, noted cryptologist and security blogger <strong>Bruce Schneier</strong> penned an unusually alarmist column titled, “<a href="https://www.schneier.com/blog/archives/2016/09/someone_is_lear.html" target="_blank">Someone Is Learning How to Take Down the Internet</a>.” Citing unnamed sources, Schneier warned that there was strong evidence indicating that nation-state actors were actively and aggressively probing the Internet for weak spots that could allow them to bring the entire Web to a virtual standstill.</p>
<p>“Someone is extensively testing the core defensive capabilities of the companies that provide critical Internet services,” Schneier wrote. “Who would do this? It doesn&#8217;t seem like something an activist, criminal, or researcher would do. Profiling core infrastructure is common practice in espionage and intelligence gathering. It&#8217;s not normal for companies to do that.&#8221;</p>
<p>Schneier continued:</p>
<p>&#8220;Furthermore, the size and scale of these probes &#8212; and especially their persistence &#8212; points to state actors. It feels like a nation&#8217;s military cyber command trying to calibrate its weaponry in the case of cyberwar. It reminds me of the US&#8217;s Cold War program of flying high-altitude planes over the Soviet Union to force their air-defense systems to turn on, to map their capabilities.”</p>
<p>Whether Schneier’s sources were accurate in their assessment of the actors referenced in his blog post is unknown. But as my friend and mentor <strong>Roland Dobbins</strong> at <a href="http://www.arbornetworks.com" target="_blank">Arbor Networks</a> eloquently put it, “When it comes to DDoS attacks, nation-states are just another player.”</p>
<p><span class="pullquote pqleft">“Today’s reality is that DDoS attacks have become the Great Equalizer between private actors &amp; nation-states,” Dobbins quipped.</span></p>
<h4>UM&#8230;YOUR RERUNS OF &#8216;SEINFELD&#8217; JUST ATTACKED ME</h4>
<p>What exactly was it that generated the record-smashing DDoS of 620 Gbps against my site this week? Was it a space-based weapon of mass disruption built and tested by a rogue nation-state, or an arch villain like <a href="http://jamesbond.wikia.com/wiki/SPECTRE" target="_blank">SPECTRE</a> from the James Bond series of novels and films? If only the enemy here was that black-and-white.</p>
<p>No, as I reported in the last blog post before my site was unplugged, the enemy in this case was far less sexy. There is every indication that this attack was launched with the help of a botnet that has enslaved a large number of hacked so-called “Internet of Things,” (IoT) devices — mainly routers, IP cameras and digital video recorders (DVRs) that are exposed to the Internet and protected with weak or hard-coded passwords. Most of these devices are available for sale on retail store shelves for less than $100, or — in the case of routers — are shipped by ISPs to their customers.</p>
<p>Some readers on Twitter have asked why the attackers would have “burned” so many compromised systems with such an overwhelming force against my little site. After all, they reasoned, the attackers showed their hand in this assault, exposing the Internet addresses of a huge number of compromised devices that might otherwise be used for actual money-making cybercriminal activities, such as hosting malware or relaying spam. Surely, network providers would take that list of hacked devices and begin blocking them from launching attacks going forward, the thinking goes.</p>
<p>As KrebsOnSecurity reader <strong>Rob Wright</strong> commented on Twitter, “the DDoS attack on @briankrebs feels like testing the Death Star on the Millennium Falcon instead of <a href="https://www.youtube.com/watch?v=p0qLzsIhUMk" target="_blank">Alderaan</a>.” I replied that this maybe wasn’t the most apt analogy. The reality is that there are currently millions — if not tens of millions — of insecure or poorly secured IoT devices that are ripe for being enlisted in these attacks at any given time. And we’re adding millions more each year.</p>
<p>I <a href="https://twitter.com/briankrebs/status/779303562962694144" target="_blank">suggested</a> to Mr. Wright perhaps a better comparison was that ne’er-do-wells now have a virtually limitless supply of <a href="http://starwars.wikia.com/wiki/Stormtrooper" target="_blank">Stormtrooper</a> clones that can be conscripted into an attack at a moment’s notice.</p>
<div id="attachment_36454" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36454" src="media/69c4f137.deathstar-580x259.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/deathstar-580x259.png" alt="A scene from the 1978 movie Star Wars, which the Death Star tests its firepower by blowing up a planet." width="580" height="259" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/deathstar-580x259.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/deathstar.png 617w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A scene from the 1977 movie Star Wars, in which the Death Star tests its firepower by blowing up a planet.</p></div>
<h4>SHAMING THE SPOOFERS</h4>
<p>The problem of DDoS conscripts goes well beyond the millions of IoT devices that are shipped insecure by default: Countless hosting providers and ISPs do nothing to prevent devices on their networks from being used by miscreants to “spoof” the source of DDoS attacks.</p>
<p>As I noted in a November 2015 story, <a href="http://krebsonsecurity.com/2015/11/the-lingering-mess-from-default-insecurity/" target="_blank">The Lingering Mess from Default Insecurity</a>, one basic step that many ISPs can but are not taking to blunt these attacks involves a network security standard that was developed and released more than a dozen years ago. Known as <a href="https://tools.ietf.org/html/bcp38" target="_blank">BCP38</a>, its use prevents insecure resources on an ISPs network (hacked servers, computers, routers, DVRs, etc.) from being leveraged in such powerful denial-of-service attacks.</p>
<p>Using a technique called traffic amplification and reflection, the attacker can reflect his traffic from one or more third-party machines toward the intended target. In this type of assault, the attacker sends a message to a third party, while spoofing the Internet address of the victim. When the third party replies to the message, the reply is sent to the victim — and the reply is much larger than the original message, thereby amplifying the size of the attack.</p>
<p>BCP38 is designed to filter such spoofed traffic, so that it never even traverses the network of an ISP that’s adopted the anti-spoofing measures. However, there are non-trivial economic reasons that many ISPs fail to adopt this best practice. <a href="http://www.internetsociety.org/deploy360/blog/2014/07/anti-spoofing-bcp-38-and-the-tragedy-of-the-commons/" target="_blank">This blog post</a> from the Internet Society does a good job of explaining why many ISPs ultimately decide not to implement BCP38.</p>
<p>Fortunately, there are efforts afoot to gather information about which networks and ISPs have neglected to filter out spoofed traffic leaving their networks. The idea is that by “naming and shaming” the providers who aren’t doing said filtering, the Internet community might pressure some of these actors into doing the right thing (or perhaps even offer preferential treatment to those providers who do conduct this basic network hygiene).</p>
<p>A research experiment by the <strong>Center for Applied Internet Data Analysis</strong> (CAIDA) called the &#8220;<a href="https://spoofer.caida.org/recent_tests.php" target="_blank">Spoofer Project</a>&#8221; is slowly collecting this data, but it relies on users voluntarily running CAIDA’s software client to gather that intel. Unfortunately, a huge percentage of the networks that allow spoofing are hosting providers that offer extremely low-cost, virtual private servers (VPS). And these companies will never voluntarily run CAIDA’s spoof-testing tools.</p>
<div id="attachment_36455" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36455" src="media/d8f82a3f.spooferproject-580x382.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/spooferproject-580x382.png" alt="CAIDA's Spoofer Project page." width="580" height="382" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/spooferproject-580x382.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/spooferproject-768x506.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/spooferproject-940x620.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/09/spooferproject.png 986w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">CAIDA&#8217;s Spoofer Project page.</p></div>
<p>As a result, the biggest offenders will continue to fly under the radar of public attention unless and until more pressure is applied by hardware and software makers, as well as ISPs that are doing the right thing.</p>
<p>How might we gain a more complete picture of which network providers aren’t blocking spoofed traffic — without relying solely on voluntary reporting? That would likely require a concerted effort by a coalition of major hardware makers, operating system manufacturers and cloud providers, including <strong>Amazon</strong>, <strong>Apple</strong>, <strong>Google</strong>, <strong>Microsoft</strong> and entities which maintain the major Web server products (<strong>Apache</strong>, <strong>Nginx</strong>, e.g.), as well as the major <strong>Linux</strong> and <strong>Unix</strong> operating systems.</p>
<p>The coalition could decide that they will unilaterally build such instrumentation into their products. At that point, it would become difficult for hosting providers or their myriad resellers to hide the fact that they’re allowing systems on their networks to be leveraged in large-scale DDoS attacks.</p>
<p>To address the threat from the mass-proliferation of hardware devices such as Internet routers, DVRs and IP cameras that ship with default-insecure settings, we probably need an industry security association, with published standards that all members adhere to and are audited against periodically.</p>
<p>The wholesalers and retailers of these devices might then be encouraged to shift their focus toward buying and promoting connected devices which have this industry security association seal of approval. Consumers also would need to be educated to look for that seal of approval. Something like <a href="https://en.wikipedia.org/wiki/UL_(safety_organization)" target="_blank">Underwriters Laboratories</a> (UL), but for the Internet, perhaps.</p>
<h4>THE BLEAK VS. THE BRIGHT FUTURE</h4>
<p>As much as I believe such efforts could help dramatically limit the firepower available to today’s attackers, I’m not holding my breath that such a coalition will materialize anytime soon. But it’s probably worth mentioning that there are several precedents for this type of cross-industry collaboration to fight global cyber threats.</p>
<p>In 2008, the <strong>United States Computer Emergency Readiness Team</strong> (CERT) announced that researcher <strong>Dan Kaminsky</strong> had discovered a fundamental flaw in DNS that could allow anyone to intercept and manipulate most Internet-based communications, including email and e-commerce applications. A diverse community of software and hardware makers came together to fix the vulnerability and to coordinate the disclosure and patching of the design flaw.</p>
<p><img class="alignright wp-image-36456" src="media/e4b0c9c5.deathtoddos.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/deathtoddos.png" alt="deathtoddos" width="246" height="306" />In 2009, Microsoft heralded the formation of an industry group to collaboratively counter <a href="https://en.wikipedia.org/wiki/Conficker" target="_blank">Conficker</a>, a malware threat that infected tens of millions of Windows PCs and held the threat of allowing cybercriminals to amass a stupendous army of botted systems virtually overnight. A group of software and security firms, dubbed the <a href="http://www.confickerworkinggroup.org/" target="_blank">Conficker Cabal</a>, hashed out and executed a plan for corralling infected systems and halting the spread of Conficker.</p>
<p>In 2011, a diverse group of industry players and law enforcement organizations came together to eradicate the threat from the <a href="https://krebsonsecurity.com/?s=dnschanger&amp;x=0&amp;y=0" target="_blank">DNS Changer Trojan</a>, a malware strain that infected millions of Microsoft Windows systems and enslaved them in a botnet that was used for large-scale cyber fraud schemes.</p>
<p>These examples provide useful templates for a solution to the DDoS problem going forward. What appears to be missing is any sense of urgency to address the DDoS threat on a coordinated, global scale.</p>
<p>That’s probably because at least for now, the criminals at the helm of these huge DDoS crime machines are content to use them to launch petty yet costly attacks against targets that suit their interests or whims.</p>
<p>For example, the massive 620 Gbps attack that hit my site this week was an apparent retaliation for <a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">a story I wrote</a> exposing two Israeli men <a href="https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/" target="_blank">who were arrested</a> shortly after that story ran for allegedly operating vDOS — until recently the most popular DDoS-for-hire network. The traffic hurled at my site in that massive attack included the text string “freeapplej4ck,” a reference to the hacker nickname used by one of vDOS’s alleged co-founders.</p>
<p>Most of the time, ne’er-do-wells like Applej4ck and others are content to use their huge DDoS armies to attack gaming sites and services. But the crooks maintaining these large crime machines haven’t just been targeting gaming sites. <strong>OVH</strong>, a major Web hosting provider based in France, said in a post on Twitter this week that it was recently the victim of an even more massive attack than hit my site. According to <a href="https://twitter.com/olesovhcom/status/779297257199964160" target="_blank">a Tweet</a> from OVH founder <strong>Octave Klaba</strong>, that attack was launched by a botnet consisting of more than 145,000 compromised IP cameras and DVRs.</p>
<p>I don’t know what it will take to wake the larger Internet community out of its slumber to address this growing threat to free speech and ecommerce. My guess is it will take an attack that endangers human lives, shuts down critical national infrastructure systems, or disrupts national elections.</p>
<p>But what we’re allowing by our inaction is for individual actors to build the instrumentality of tyranny. And to be clear, these weapons can be wielded by anyone — with any motivation — who’s willing to expend a modicum of time and effort to learn the most basic principles of its operation.</p>
<p>The sad truth these days is that it&#8217;s a lot easier to censor the digital media on the Internet than it is to censor printed books and newspapers in the physical world. On the Internet, anyone with an axe to grind and the willingness to learn a bit about the technology can become an instant, self-appointed global censor.</p>
<p>I sincerely hope we can address this problem before it’s too late. And I’m deeply grateful for the overwhelming outpouring of support and solidarity that I’ve seen and heard from so many readers over the past few days. Thank you.</p>


feed_id: http://krebsonsecurity.com/?p=36426
title: KrebsOnSecurity Hit With Record DDoS
uri: KrebsOnSecurity-Hit-With-Record-DDoS
url: https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/
content:
<p>On Tuesday evening, KrebsOnSecurity.com was the target of an extremely large and unusual distributed denial-of-service (DDoS) attack designed to knock the site offline. The attack did not succeed thanks to the hard work of the engineers at <strong>Akamai</strong>, the company that protects my site from such digital sieges. But according to Akamai, it was nearly double the size of the largest attack they&#8217;d seen previously, and was among the biggest assaults the Internet has ever witnessed.<br />
<img class="aligncenter wp-image-36433" src="media/ec45f675.iotstuf.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/09/iotstuf.jpg" alt="iotstuf" width="560" height="316" /></p>
<p>The attack began around 8 p.m. ET on Sept. 20, and initial reports put it at approximately 665 Gigabits of traffic per second. Additional analysis on the attack traffic suggests the assault was closer to 620 Gbps in size, but in any case this is many orders of magnitude more traffic than is typically needed to knock most sites offline.</p>
<p><strong>Martin McKeay</strong>, Akamai&#8217;s senior security advocate, said the largest attack the company had seen previously clocked in earlier this year at 363 Gbps. But he said there was a major difference between last night&#8217;s DDoS and the previous record holder: The 363 Gpbs attack is thought to have been generated by a botnet of compromised systems using well-known techniques allowing them to &#8220;amplify&#8221; a relatively small attack into a much larger one.</p>
<p><em>In contrast, the huge assault this week on my site appears to have been launched almost exclusively by a very large botnet of hacked devices.</em></p>
<p>The largest DDoS attacks on record tend to be the result of a tried-and-true method known as a <a title="http://technet.microsoft.com/en-us/security/hh972393.aspx" href="http://technet.microsoft.com/en-us/security/hh972393.aspx" target="_blank">DNS reflection attack</a>. In such assaults, the perpetrators are able to leverage unmanaged <a title="http://compnetworking.about.com/od/dns_domainnamesystem/f/dns_servers.htm" href="http://compnetworking.about.com/od/dns_domainnamesystem/f/dns_servers.htm" target="_blank">DNS servers</a> on the Web to create huge traffic floods.</p>
<p>Ideally, DNS servers only provide services to machines within a trusted domain. But DNS reflection attacks rely on consumer and business routers and other devices equipped with DNS servers that are (mis)configured to accept queries from anywhere on the Web. Attackers can send spoofed DNS queries to these so-called “open recursive” DNS servers, forging the request so that it appears to come from the target’s network. That way, when the DNS servers respond, they reply to the spoofed (target) address.</p>
<p>The bad guys also can amplify a reflective attack by crafting DNS queries so that the responses are much bigger than the requests. They do this by taking advantage of an extension to the DNS protocol that enables large DNS messages. For example, an attacker could compose a DNS request of less than 100 bytes, prompting a response that is 60-70 times as large. This “amplification” effect is especially pronounced if the perpetrators query dozens of DNS servers with these spoofed requests simultaneously.</p>
<p>But according to Akamai, none of the attack methods employed in Tuesday night&#8217;s assault on KrebsOnSecurity relied on amplification or reflection. Rather, many were garbage Web attack methods that require a legitimate connection between the attacking host and the target, including <a href="https://en.wikipedia.org/wiki/SYN_flood" target="_blank">SYN</a>, <a href="http://security.stackexchange.com/questions/29220/what-are-http-get-post-flood-attacks" target="_blank">GET and POST</a> floods.</p>
<p>That is, with the exception of one attack method: Preliminary analysis of the attack traffic suggests that perhaps the biggest chunk of the attack came in the form of traffic designed to look like it was <a href="https://www.incapsula.com/blog/what-is-gre-tunnel.html" target="_blank">generic routing encapsulation</a> (GRE) data packets, a communication protocol used to establish a direct, point-to-point connection between network nodes. GRE lets two peers share data they wouldn’t be able to share over the public network itself.</p>
<p>&#8220;Seeing that much attack coming from GRE is really unusual,&#8221; Akamai&#8217;s McKeay said. &#8220;We&#8217;ve only started seeing that recently, but seeing it at this volume is very new.&#8221;<span id="more-36426"></span></p>
<p>McKeay explained that the source of GRE traffic can&#8217;t be spoofed or faked the same way DDoS attackers can spoof DNS traffic. Nor can junk Web-based DDoS attacks like those mentioned above. That suggests the attackers behind this record assault launched it from quite a large collection of hacked systems &#8212; possibly hundreds of thousands of systems.</p>
<p><span class="pullquote pqleft">&#8220;Someone has a botnet with capabilities we haven&#8217;t seen before,&#8221; McKeay said.</span> &#8220;We looked at the traffic coming from the attacking systems, and they weren&#8217;t just from one region of the world or from a small subset of networks &#8212; they were everywhere.&#8221;</p>
<p>There are some indications that this attack was launched with the help of a botnet that has enslaved a large number of hacked so-called &#8220;Internet of Things,&#8221; (IoT) devices &#8212; <a href="http://krebsonsecurity.com/2015/01/lizard-stresser-runs-on-hacked-home-routers/" target="_blank">routers</a>, <a href="http://krebsonsecurity.com/2016/02/this-is-why-people-fear-the-internet-of-things/" target="_blank">IP cameras</a> and digital video recorders (DVRs) that are exposed to the Internet and protected with weak or hard-coded passwords.</p>
<p>As noted in a <a href="https://www.flashpoint-intel.com/attack-of-things/" target="_blank">recent report</a> from <strong>Flashpoint</strong> and <strong>Level 3 Threat Research Labs</strong>, the threat from IoT-based botnets is powered by malware that goes by many names, including &#8220;Lizkebab,&#8221; &#8220;BASHLITE,&#8221; &#8220;Torlus&#8221; and &#8220;gafgyt.&#8221; According to that report, the source code for this malware was leaked in early 2015 and has been spun off into more than a dozen variants.</p>
<p>&#8220;Each botnet spreads to new hosts by scanning for vulnerable devices in order to install the malware,&#8221; the report notes. &#8220;Two primary models for scanning exist. The first instructs bots to port scan for telnet servers and attempts to brute force the username and password to gain access to the device.&#8221;</p>
<p>Their analysis continues:</p>
<p>&#8220;The other model, which is becoming increasingly common, uses external scanners to find and harvest new bots, in some cases scanning from the [botnet control] servers themselves. The latter model adds a wide variety of infection methods, including brute forcing login credentials on SSH servers and exploiting known security weaknesses in other services.&#8221;</p>
<p>I&#8217;ll address some of the challenges of minimizing the threat from large-scale DDoS attacks in a future post. But for now it seems likely that we can expect such monster attacks to soon become the new norm.</p>
<p>Many readers have been asking whether this attack was in retaliation for my <a href="http://krebsonsecurity.com/?s=vdos&amp;x=0&amp;y=0" target="_blank">recent series </a>on the takedown of the DDoS-for-hire service vDOS, which coincided with <a href="http://Alleged vDOS Proprietors Arrested in Israel" target="_blank">the arrests of two young men</a> named in my original report as founders of the service.</p>
<p>I can&#8217;t say for sure, but it seems likely related: Some of the POST request attacks that came in last night as part of this 620 Gbps attack included the string &#8220;freeapplej4ck,&#8221; a reference to the nickname used by one of the vDOS co-owners.</p>
<p><strong>Update Sept. 22, 8:33 a.m. ET:</strong> Corrected the maximum previous DDoS seen by Akamai. It was 363, not 336 as stated earlier.</p>


feed_id: http://krebsonsecurity.com/?p=36360
title: DDoS Mitigation Firm Has History of Hijacks
uri: DDoS-Mitigation-Firm-Has-History-of-Hijacks
url: https://krebsonsecurity.com/2016/09/ddos-mitigation-firm-has-history-of-hijacks/
content:
<p>Last week, KrebsOnSecurity detailed how <strong>BackConnect Inc.</strong> &#8212; a company that defends victims against large-scale distributed denial-of-service (DDoS) attacks &#8212; admitted to hijacking hundreds of Internet addresses from a European Internet service provider in order to glean information about attackers who were targeting BackConnect. According to an exhaustive analysis of historic Internet records, BackConnect appears to have a history of such &#8220;hacking back&#8221; activity.</p>
<p>On Sept. 8, 2016, KrebsOnSecurity <a href="http://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">exposed the inner workings of <strong>vDOS</strong></a>, a DDoS-for-hire or &#8220;booter&#8221; service whose tens of thousands of paying customers used the service to launch attacks against hundreds of thousands of targets over the service&#8217;s four-year history in business.</p>
<div id="attachment_36386" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/a60fff15.vdosloggedin.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdosloggedin.png"><img class="wp-image-36386 size-medium" src="media/8d4e34c1.vdosloggedin-580x405.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdosloggedin-580x405.png" alt="vDOS as it existed on Sept. 8, 2016." width="580" height="405" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdosloggedin-580x405.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdosloggedin-768x536.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdosloggedin.png 877w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">vDOS as it existed on Sept. 8, 2016.</p></div>
<p>Within hours of that story running, the two alleged owners &#8212; 18-year-old Israeli men identified in the original report &#8212; <a href="http://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/" target="_blank">were arrested in Israel</a> in connection with an FBI investigation into the shady business, which earned well north of $600,000 for the two men.</p>
<p>In my follow-up report on their arrests, I noted that vDOS itself had gone offline, and that automated Twitter feeds which report on large-scale changes to the global Internet routing tables observed that vDOS&#8217;s provider &#8212; a Bulgarian host named <strong>Verdina[dot]net</strong> &#8212; had been briefly relieved of control over 255 Internet addresses (including those assigned to vDOS) as the direct result of an unusual counterattack by BackConnect.</p>
<p>Asked about the reason for the counterattack, BackConnect CEO <strong>Bryant Townsend</strong> confirmed to this author that it had executed what&#8217;s known as a &#8220;BGP hijack.&#8221; In short, the company had fraudulently &#8220;announced&#8221; to the rest of the world&#8217;s Internet service providers (ISPs) that it was the rightful owner of the range of those 255 Internet addresses at Verdina occupied by vDOS.</p>
<p>In <a href="http://mailman.nanog.org/pipermail/nanog/2016-September/087902.html" target="_blank">a post on NANOG Sept. 13</a>, BackConnect&#8217;s Townsend said his company took the extreme measure after coming under a sustained DDoS attack thought to have been launched by a botnet controlled by vDOS. Townsend explained that the hijack allowed his firm to &#8220;collect intelligence on the actors behind the botnet as well as identify the attack servers used by the booter service.&#8221;</p>
<p>Short for <a href="https://en.wikipedia.org/wiki/Border_Gateway_Protocol" target="_blank">Border Gateway Protocol</a>, BGP is a mechanism by which ISPs of the world share information about which providers are responsible for routing Internet traffic to specific addresses. However, like most components built into the modern Internet, BGP was never designed with security in mind, which leaves it vulnerable to exploitation by rogue actors.</p>
<p>BackConnect&#8217;s BGP hijack of Verdina caused quite an uproar among many Internet technologists who discuss such matters at the mailing list of the <strong>North American Network Operators Group</strong> (NANOG).</p>
<p>BGP hijacks are hardly unprecedented, but when they are non-consensual they are either done accidentally or are the work of cyber criminals such as spammers looking to hijack address space for use in blasting out junk email. If BackConnect&#8217;s hijacking of Verdina was an example of a DDoS mitigation firm &#8220;hacking back,&#8221; what would discourage others from doing the same, they wondered?</p>
<p>&#8220;Once we let providers cross the line from legal to illegal actions, we&#8217;re no better than the crooks, and the Internet will descend into lawless chaos,&#8221; <a href="http://mailman.nanog.org/pipermail/nanog/2016-September/087870.html" target="_blank">wrote</a> <strong>Mel Beckman</strong>, owner of Beckman Software Engineering and a computer networking consultant in the Los Angeles area. <span class="pullquote pqleft">&#8220;BackConnect&#8217;s illicit action undoubtedly injured innocent parties, so it&#8217;s not self defense, any more than shooting wildly into a crowd to stop an attacker would be self defense.&#8221;</span></p>
<h4>A HISTORY OF HIJACKS</h4>
<p>Townsend&#8217;s explanation seemed to produce more questions than answers among the NANOG crowd (read the entire <a href="http://mailman.nanog.org/pipermail/nanog/2016-September/thread.html#87902" target="_blank">&#8220;Defensive BGP Hijacking&#8221; thread here</a> if you dare). I grew more curious to learn whether this was a pattern for BackConnect when I started looking deeper into the history of two young men who co-founded BackConnect (more on them in a bit).</p>
<p>To get a better picture of BackConnect&#8217;s history, I turned to BGP hijacking expert <strong>Doug Madory</strong>, director of Internet analysis at <a href="http://www.dyn.com" target="_blank">Dyn</a>, a cloud-based Internet performance management company. Madory pulled historic BGP records for BackConnect, and sure enough a strange pattern began to emerge.</p>
<p>Madory was careful to caution up front that not all BGP hijacks are malicious. Indeed, my DDoS protection provider &#8212; a company called <strong>Prolexic Communications</strong> (now owned by <strong>Akamai Technologies)</strong> &#8212; practically invented the use of BGP hijacks as a DDoS mitigation method, he said.</p>
<p>In such a scenario, an organization under heavy DDoS attack might approach Prolexic and ask for assistance. With the customer&#8217;s permission, Prolexic would use BGP to announce to the rest of the world&#8217;s ISPs that it was now the rightful owner of the Internet addresses under attack. This would allow Prolexic to &#8220;scrub&#8221; the customer&#8217;s incoming Web traffic to drop data packets designed to knock the customer offline &#8212; and forward the legitimate traffic on to the customer&#8217;s site.</p>
<p>Given that BackConnect is also a DDoS mitigation company, I asked Madory how one could reasonably tell the difference between a BGP hijack that BackConnect had launched to protect a client versus one that might have been launched for other purposes &#8212; such as surreptitiously collecting intelligence on DDoS-based botnets and their owners?</p>
<p>Madory explained that in evaluating whether a BGP hijack is malicious or consensual, he looks at four qualities: The duration of the hijack; whether it was announced globally or just to the target ISP&#8217;s local peers; whether the hijacker took steps to obfuscate which ISP was doing the hijacking; and whether the hijacker and hijacked agreed upon the action.</p>
<p><a class="lightbox" href="media/55f930e8.bcbgp.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/bcbgp.png"><img class="aligncenter wp-image-36388 size-medium" src="media/b0007756.bcbgp-580x228.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/bcbgp-580x228.png" alt="bcbgp" width="580" height="228" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/bcbgp-580x228.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/bcbgp-768x302.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/bcbgp-940x370.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/09/bcbgp.png 1181w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>For starters, malicious BGP attacks designed to gather information about an attacking host are likely to be very brief &#8212; often lasting just a few minutes. The brevity of such hijacks makes them somewhat ineffective at mitigating large-scale DDoS attacks, which often last for hours at a time. For example, the BGP hijack that BackConnect launched against Verdina lasted a fraction of an hour, and according to the company&#8217;s CEO was launched only after the DDoS attack subsided.</p>
<p>Second, if the party conducting the hijack is doing so for information gathering purposes, that party may attempt to limit the number ISPs that receive the new routing instructions. This might help an uninvited BGP hijacker achieve the end result of intercepting traffic to and from the target network without informing all of the world&#8217;s ISPs simultaneously.</p>
<p>&#8220;If a sizable portion of the Internet’s routers do not carry a route to a DDoS mitigation provider, then they won’t be sending DDoS traffic destined for the corresponding address space to the provider’s traffic scrubbing centers, thus limiting the efficacy of any mitigation,&#8221; Madory <a href="http://research.dyn.com/2016/09/backconnects-suspicious-bgp-hijacks/" target="_blank">wrote in his own blog post</a> about our joint investigation.</p>
<p>Thirdly, a BGP hijacker who is trying not to draw attention to himself can &#8220;forge&#8221; the BGP records so that it appears that the hijack was performed by another party. Madory said this forgery process often fools less experienced investigators, but that ultimately it is impossible to hide the true origin of forged BGP records.</p>
<p>Finally, in BGP hijacks that are consensual for DDoS mitigation purposes, the host under attack stops &#8220;announcing&#8221; to the world&#8217;s ISPs that it is the rightful owner of an address block under siege at about the same time the DDoS mitigation provider begins claiming it. When we see BGP hijacks in which both parties are claiming in the BGP records to be authoritative for a given swath of Internet addresses, Madory said, it&#8217;s less likely that the BGP hijack is consensual.</p>
<p>Madory and KrebsOnSecurity spent several days reviewing historic records of BGP hijacks attributed to BackConnect over the past year, and at least three besides the admitted hijack against Verdina strongly suggest that the company has engaged in this type of intel-gathering activity previously. The strongest indicator of a malicious and non-consensual BGP hijack, Madory said, were the ones that included forged BGP records.<span id="more-36360"></span></p>
<p>Working together, Madory and KrebsOnSecurity identified at least 17 incidents during that time frame that were possible BGP hijacks conducted by BackConnect. Of those, five included forged BGP records. One was an hours-long hijack against <strong>Ghostnet[dot]de</strong>, a hosting provider in Germany.</p>
<p>Two other BGP hijacks from BackConnect that included spoofed records were against <strong>Staminus Communications</strong>, a competing DDoS mitigation provider and a firm that employed BackConnect CEO Townsend for three years as senior vice president of business development until his departure from Staminus in December 2015.</p>
<p><span class="pullquote pqleft">&#8220;This hijack wasn&#8217;t conducted by Staminus. It was BackConnect posing as Staminus,&#8221; Dyn&#8217;s Madory concluded.</span></p>
<p>Two weeks after BackConnect hijacked the Staminus routes, Staminus was <a href="http://krebsonsecurity.com/2016/03/hackers-target-anti-ddos-firm-staminus/" target="_blank">massively hacked</a>. Unknown attackers, operating under the banner &#8220;Fuck &#8216;Em All,&#8221; reset all of the configurations on the company&#8217;s Internet routers, and then posted online Staminus&#8217;s customer credentials, support tickets, credit card numbers and other sensitive data. The intruders also posted to Pastebin a taunting note ridiculing the company&#8217;s security practices.</p>
<div id="attachment_36391" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36391" src="media/858e3e39.bc-staminus-580x502.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/bc-staminus-580x502.png" alt="BackConnect's apparent hijack of address space owned by Staminus Communications on Feb. 20, 2016. Image: Dyn." width="580" height="502" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/bc-staminus-580x502.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/bc-staminus.png 687w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">BackConnect&#8217;s apparent hijack of address space owned by Staminus Communications on Feb. 20, 2016. Image: Dyn.</p></div>
<h4>POINTING FINGERS</h4>
<p>I asked Townsend to comment on the BGP hijacks identified by KrebsOnSecurity and Dyn as having spoofed source information. Townsend replied that he could not provide any insight as to why these incidents occurred, noting that he and the company&#8217;s chief technology officer &#8212; 24-year-old <strong>Marshal Webb</strong> &#8212; only had access and visibility into the network after the company BackConnect Inc. was created on April 27, 2016.</p>
<p>According to Townsend, the current BackConnect Inc. is wholly separate from <strong>BackConnect Security LLC</strong>, which is a company started in 2014 by two young men: Webb and a 19-year-old security professional named <strong>Tucker Preston</strong>. In April 2016, Preston was voted out of the company by Webb and Townsend and forced to sell his share of the company, which was subsequently renamed BackConnect Inc.</p>
<p>&#8220;Before that, the original owner of BackConnect Security LLC was the only one that had the ability to access servers and perform any type of networking commands,&#8221; he explained. &#8220;We had never noticed these occurred until this last Saturday and the previous owner never communicated anything regarding these hijacks. Wish I could provide more insight, but Marshal and I do not know the reasons behind the previous owners decision to hijack those ranges or what he was trying to accomplish.&#8221;</p>
<p>In a phone interview, Preston told KrebsOnSecurity that Townsend had little to no understanding about the technical side of the business, and was merely &#8220;a sales guy&#8221; for BackConnect. He claims that Webb absolutely had and still has the ability to manipulate BackConnect&#8217;s BGP records and announcements.</p>
<p>Townsend countered that Preston was the only network engineer at the company.</p>
<p>&#8220;We had to self-learn how to do anything network related once the new company was founded and Tucker removed,&#8221; he said. &#8220;Marshal and myself didn&#8217;t even know how to use BGP until we were forced to learn it in order to bring on new clients. To clarify further, Marshal did not have a networking background and had only been working on our web panel and DDoS mitigation rules.&#8221;</p>
<h4>L33T, LULZ, W00W00 AND CHIPPY</h4>
<p>Preston said he first met Webb in 2013 after the latter admitted to launching DDoS attacks against one of Preston&#8217;s customers at the time. Webb had been painted with a somewhat sketchy recent history at the time &#8212; being fingered as a low-skilled hacker who went by the nicknames &#8220;m_nerva&#8221; and &#8220;Chippy1337.&#8221;</p>
<p>Webb, whose <a href="https://www.facebook.com/lulznet" target="_blank">Facebook alias is &#8220;lulznet</a>,&#8221; was <a href="http://latimesblogs.latimes.com/technology/2011/06/lulzsec-outs-snitches.html" target="_blank">publicly accused in 2011</a> by the hacker group <strong>LulzSec</strong> of snitching on the activities of the group to the <strong>FBI</strong>, claiming that information he shared with law enforcement led to the arrest of a teen hacker in England associated with LulzSec. Webb has publicly denied being an informant for the FBI, but did not respond to requests for comment on this story.</p>
<p>LulzSec members claimed that Webb was behind the hacking of the Web site for the video game &#8220;Deus Ex.&#8221; As KrebsOnSecurity <a href="http://krebsonsecurity.com/2011/05/anonymous-splinter-group-implicated-in-game-company-hack/" target="_blank">noted in a story about the Deus Ex hack</a>, the intruder defaced the gaming site with the message &#8220;Owned by Chippy1337.&#8221;</p>
<div id="attachment_9635" style="width: 541px" class="wp-caption aligncenter"><a class="lightbox" href="media/2db1f4d9.deusex.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2011/05/deusex.jpg"><img class="wp-image-9635" src="media/5dd4deb1.deusex-300x99.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2011/05/deusex-300x99.jpg" alt="The defacement message left on deusex.com." width="531" height="175" /></a><p class="wp-caption-text">The defacement message left on deusex.com.</p></div>
<p>I was introduced to Webb at the Defcon hacking convention in Las Vegas in 2014. Since then, I have come to know him a bit more as a participant of <strong>w00w00</strong>, an invite-only <a href="http:///www.slack.com" target="_blank">Slack</a> chat channel populated mainly by information security professionals who work in the DDoS mitigation business. Webb chose the handle Chippy1337 for his account in that Slack channel.</p>
<p>At the time, Webb was trying to convince me to take another look at <a href="https://apps.db.ripe.net/search/query.html?searchtext=37.221.175.250#resultsAnchor#resultsAnchor" target="_blank">Voxility</a>, a hosting provider that I&#8217;ve previously noted has a rather <a href="http://krebsonsecurity.com/2013/01/inside-the-gozi-bulletproof-hosting-facility/" target="_blank">checkered history</a> and one that BackConnect appears to rely upon exclusively for its own hosting.</p>
<p>In our examination of BGP hijacks attributed to BackConnect, Dyn and KrebsOnSecurity identified an unusual incident in late July 2016 in which BackConnect could be seen hijacking an address range previously announced by Datawagon, a hosting provider with <a href="http://www.webhostingtalk.com/search.php?searchid=6147016" target="_blank">a rather dodgy reputation</a> for hosting spammers and DDoS-for-hire sites.</p>
<p>That address range previously announced by Datawagon included the Internet address 1.3.3.7, which is hacker &#8220;<a href="https://en.wikipedia.org/wiki/Leet" target="_blank">leet speak</a>&#8221; for the word &#8220;leet,&#8221; or &#8220;elite.&#8221; Interestingly, on the w00w00 DDoS discussion Slack channel I observed Webb (Chippy1337) offering other participants in the channel vanity addresses and virtual private connections (VPNs) ending in 1.3.3.7. In the screen shot below, Webb can be seen posting a screen shot demonstrating his access to the 1.3.3.7 address while logged into it on his mobile phone.</p>
<div id="attachment_36357" style="width: 453px" class="wp-caption aligncenter"><a class="lightbox" href="media/01f06f63.chippyw001337.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/chippyw001337.png"><img class="wp-image-36357 size-full" src="media/01f06f63.chippyw001337.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/chippyw001337.png" alt="Webb, logged into the w00w00 DDoS discussion channel using his nickname &quot;chippy1337,&quot; demonstrating that his mobile phone connection was being routed through the Internet address 1.3.3.7, which BackConnect BGP hijacked in July 2016." width="443" height="637" /></a><p class="wp-caption-text">Webb, logged into the w00w00 DDoS discussion channel using his nickname &#8220;chippy1337,&#8221; demonstrating that his mobile phone connection was being routed through the Internet address 1.3.3.7, which BackConnect BGP hijacked in July 2016.</p></div>
<h4>THE MONEY TEAM</h4>
<p>The Web <a href="https://www.virustotal.com/en/ip-address/1.3.3.7/information/" target="_blank">address 1.3.3.7</a> currently does not respond to browser requests, but it <a href="https://web.archive.org/web/20151129170013/http://1.3.3.7/" target="_blank">previously routed to a page</a> listing the core members of a hacker group calling itself the <strong>Money Team</strong>. <a href="http://krebsonsecurity.com/wp-content/uploads/2016/09/1-3-3-7-sites.txt" target="_blank">Other sites</a> also previously tied to that Internet address include numerous DDoS-for-hire services, such as nazistresser[dot]biz, exostress[dot]in, scriptkiddie[dot]eu, packeting[dot]eu, leet[dot]hu, booter[dot]in, vivostresser[dot]com, shockingbooter[dot]com and xboot[dot]info, among others.</p>
<p>The Money Team comprised a group of online gaming enthusiasts of the massively popular game <a href="https://en.wikipedia.org/wiki/Counter-Strike" target="_blank">Counterstrike</a>, and the group&#8217;s members specialized in selling cheats and hacks for the game, as well as various booter services that could be used to knock rival gamers offline.</p>
<p>Datawagon&#8217;s founder is an 18-year-old American named <strong>CJ Sculti</strong> whose 15-minutes of fame came last year in a <a href="https://en.wikipedia.org/wiki/Cybersquatting" target="_blank">cybersquatting</a> dispute after <a href="http://www.trademarksandbrandsonline.com/news/domino-s-branded-disgraceful-over-pizza-domain-saga-4443" target="_blank">he registered the domain dominos.pizza</a>. A <a href="https://web.archive.org/web/20151129170013/http://1.3.3.7/" target="_blank">cached version</a> of the Money Team&#8217;s home page saved by <strong>Archive.org</strong> lists CJ at the top of the member list, with &#8220;chippy1337&#8221; as the third member from the top.</p>
<div id="attachment_36376" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/e702e19f.moneyteam.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/moneyteam.png"><img class="wp-image-36376 size-medium" src="media/4c17c666.moneyteam-580x499.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/moneyteam-580x499.png" alt="The MoneyTeam's roster as of November 2015. Image: Archive.org." width="580" height="499" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/moneyteam-580x499.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/moneyteam-768x660.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/moneyteam-940x808.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/09/moneyteam.png 1032w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The MoneyTeam&#8217;s roster as of November 2015. Image: Archive.org.</p></div>
<p>Asked why he chose to start a DDoS mitigation company with a kid who was into DDoS attacks, Preston said he got to know Webb over several years before teaming up with him to form BackConnect LLC.</p>
<p>&#8220;We were friends long before we ever started the company together,&#8221; Preston said. &#8220;I thought Marshal had turned over a new leaf and had moved away from all that black hat stuff. He seem to stay true to that until we split and he started getting involved with the Datawagon guys. I guess his lulz mentality came back in a really stupid way.&#8221;</p>
<p>Townsend said Webb was never an FBI informant, and was never arrested for involvement with LulzSec.</p>
<p>&#8220;Only a search warrant was executed at his residence,&#8221; Townsend said. &#8220;Chippy is not a unique handle to Marshal and it has been used by many people. Just because he uses that handle today doesn&#8217;t mean any past chippy actions are his doing. Marshal did not even go by Chippy when LulzSec was in the news. These claims are completely fabricated.&#8221;</p>
<p>As for the apparent Datawagon hijack, Townsend said Datawagon gave BackConnect permission to announce the company&#8217;s Internet address space but later decided not to become a customer.</p>
<p>&#8220;They were going to be a client and they gave us permission to announce that IP range via an LOA [letter of authorization]. They did not become a client and we removed the announcement. Also note that the date of the screen shot you present of Marshal talking about the 1.3.3.7. is not even the same as when we announced Datawagons IPs.&#8221;</p>
<h4>SOMETHING SMELLS BAD</h4>
<p>When vDOS was hacked, its entire user database was leaked to this author. Among the more active users of vDOS in 2016 was a user who went by the username &#8220;pp412&#8221; and who registered in February 2016 using the email address <strong>mn@gnu.so</strong>.</p>
<p>The information about who originally registered the gnu.so domain has long been hidden behind WHOIS privacy records. But for several months in 2015 and 2016 the registration records show it was registered to a <strong>Tucker Preston LLC</strong>. Preston denies that he ever registered the gnu.so domain, and claims that he never conducted any booter attacks via vDOS. However, Preston also was on the w00w00 Slack channel along with Webb, and registered there using the email address <strong>tucker@gnu.so</strong>.</p>
<p>But whoever owned that pp412 account at vDOS was active in attacking a large number of targets, including multiple assaults on networks belonging to the <a href="http://www.fsf.org" target="_blank">Free Software Foundation</a> (FSF).</p>
<div id="attachment_36398" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36398" src="media/589ff473.pp412-580x265.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/pp412-580x265.png" alt="Logs from the hacked vDOS attack database show the user pp4l2 attacked the Free Software Foundation in May 2016." width="580" height="265" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/pp412-580x265.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/pp412.png 613w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Logs from the hacked vDOS attack database show the user pp4l2 attacked the Free Software Foundation in May 2016.</p></div>
<p><strong>Lisa Marie Maginnis</strong>, until very recently a senior system administrator at the FSF, said the foundation began evaluating DDoS mitigation providers in the months leading up to its <a href="https://libreplanet.org/2016/program/" target="_blank">LibrePlanet2016</a> conference in the third week of March. The organization had never suffered any real DDoS attacks to speak of previously, but NSA whistleblower <strong>Edward Snowden</strong> was slated to speak at the conference, and the FSF was concerned that someone might launch a DDoS attack to disrupt the streaming of Snowden&#8217;s keynote.</p>
<p>&#8220;We were worried this might bring us some extra unwanted attention,&#8221; she said.</p>
<p>Maginnis said the FSF had looked at BackConnect and other providers, but that it ultimately decided it didn&#8217;t have time to do the testing and evaluation required to properly vet a provider prior to the conference. So the organization tabled that decision. As it happened, the Snowden keynote was a success, and the FSF&#8217;s fears of a massive DDoS never materialized.</p>
<p>But all that changed in the weeks following the conference.</p>
<p>&#8220;The first attack we got started off kind of small, and it came around 3:30 on a Friday morning,&#8221; Maginnis recalled. &#8220;The next Friday at about the same time we were hit again, and then the next and the next.&#8221;</p>
<p>The DDoS attacks grew bigger with each passing week, she said, peaking at more than 200 Gbps &#8212; more than enough to knock large hosting providers offline, let alone individual sites like the FSF&#8217;s. When the FSF&#8217;s Internet provider succeeded in blacklisting the addresses doing the attacking, the attackers switched targets and began going after larger-scale ISPs further upstream.</p>
<p>&#8220;That&#8217;s when our ISP told us we had to do something because the attacks were really starting to impact the ISP&#8217;s other customers,&#8221; Maginnis said. &#8220;Routing all of our traffic through another company wasn&#8217;t exactly an ideal situation for the FSF, but the other choice was we would just be disconnected and there would be no more FSF online.&#8221;</p>
<p>In August, the FSF announced that it had signed up with BackConnect to be protected from DDoS attacks, in part because the foundation only uses free software to perform its work, and BackConnect advertises &#8220;open source DDoS protection and security,&#8221; and it agreed to provide the service without charge.</p>
<p>The FSF declined to comment for this story. Maginnis said she can&#8217;t be sure whether the foundation will continue to work with BackConnect. But she said the timing of the attacks is suspicious.</p>
<p>&#8220;The whole thing just smells bad,&#8221; she said. &#8220;It does feel like there could be a connection between the DDoS and BackConnect&#8217;s timing to approach clients. On the other hand, I don&#8217;t think we received a single attack until Tucker [Preston] left BackConnect.&#8221;</p>
<p>DDoS attacks are rapidly growing in size, sophistication and disruptive impact, presenting a clear and present threat to online commerce and free speech alike. Since reporting about the hack of vDOS and the arrest of its proprietors nearly two weeks ago, KrebsOnSecurity.com has been under near-constant DDoS attack. One assault this past Sunday morning maxed out at more than 210 Gbps &#8212; the largest assault on this site to date.</p>
<p>Addressing the root causes that contribute to these attacks is a complex challenge that requires cooperation, courage and ingenuity from a broad array of constituencies &#8212; including ISPs, hosting providers, policy and hardware makers, and even end users.</p>
<p>In the meantime, some worry that as the disruption and chaos caused by DDoS attacks continues to worsen, network owners and providers may be increasingly tempted to take matters into their own hands and strike back at their assailants.</p>
<p>But this is almost never a good idea, said <b>Rich Kulawiec</b>, an anti-spam activist who is active on the NANOG mailing list.</p>
<p>&#8220;It&#8217;s tempting (and even trendy these days in portions of the security world which advocate striking back at putative attackers, never mind that attack attribution is almost entirely an unsolved problem in computing),&#8221; Kulawiec wrote. &#8220;It&#8217;s emotionally satisfying. It&#8217;s sometimes momentarily effective. But all it really does [is] open up still more attack vectors and accelerate the spiral to the bottom.&#8221;</p>
<p>KrebsOnSecurity would like to thank Dyn and Doug Madory for their assistance in researching the technical side of this story. For a deep dive into the BGP activity attributed to BackConnect, check out Madory&#8217;s post, <a href="http://research.dyn.com/2016/09/backconnects-suspicious-bgp-hijacks/" target="_blank">BackConnect&#8217;s Suspicious Hijacks</a>.</p>


feed_id: http://krebsonsecurity.com/?p=36337
title: Ransomware Getting More Targeted, Expensive
uri: Ransomware-Getting-More-Targeted-Expensive
url: https://krebsonsecurity.com/2016/09/ransomware-getting-more-targeted-expensive/
content:
<p>I shared a meal not long ago with a source who works at a financial services company. The subject of ransomware came up and he told me that a server in his company had recently been infected with a particularly nasty strain that spread to several systems before the outbreak was quarantined. He said the folks in finance didn&#8217;t bat an eyelash when asked to authorize several payments of $600 to satisfy the Bitcoin ransom demanded by the intruders: After all, my source confessed, <em>the data on one of the infected systems was worth millions &#8212; possibly tens of millions &#8212; of dollars</em>, but for whatever reason the company didn&#8217;t have backups of it.</p>
<p>This anecdote has haunted me because it speaks volumes about what we can likely expect in the very near future from ransomware &#8212; malicious software that scrambles all files on an infected computer with strong encryption, and then requires payment from the victim to recover them.</p>
<p><img class="size-medium wp-image-32771" src="media/b9e7c8f6.ransomware-kav-580x438.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/ransomware-kav-580x438.png" alt="Image: Kaspersky Lab" width="580" height="438" srcset="http://krebsonsecurity.com/wp-content/uploads/2015/11/ransomware-kav-580x438.png 580w, http://krebsonsecurity.com/wp-content/uploads/2015/11/ransomware-kav.png 631w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>What we can expect is not only more targeted and destructive attacks, but also ransom demands that vary based on the attacker&#8217;s estimation of the value of the data being held hostage and/or the ability of the victim to pay some approximation of what it might be worth.</p>
<p>In <a href="https://www.ic3.gov/media/2016/160915.aspx" target="_blank">an alert</a> published today, the <strong>U.S. Federal Bureau of Investigation</strong> (FBI) warned that recent ransomware variants have targeted and compromised vulnerable business servers (rather than individual users) to identify and target hosts, thereby multiplying the number of potential infected servers and devices on a network.</p>
<p>&#8220;Actors engaging in this targeting strategy are also charging ransoms based on the number of host (or servers) infected,&#8221; the FBI warned. &#8220;Additionally, recent victims who have been infected with these types of ransomware variants have not been provided the decryption keys for all their files after paying the ransom, and some have been extorted for even more money after payment.&#8221;</p>
<p>According to the FBI, this recent technique of targeting host servers and systems &#8220;could translate into victims paying more to get their decryption keys, a prolonged recovery time, and the possibility that victims will not obtain full decryption of their files.&#8221;</p>
<p><img class="aligncenter size-medium wp-image-36344" src="media/acd0d9ba.fbipsi-ransom-580x297.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/fbipsi-ransom-580x297.png" alt="fbipsi-ransom" width="580" height="297" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/fbipsi-ransom-580x297.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/fbipsi-ransom-768x394.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/fbipsi-ransom.png 806w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>Today there are dozens of ransomware strains, most of which are sold on underground forums as crimeware packages &#8212; with new families emerging regularly. These kits typically include a point-and-click software interface for selecting various options that the ransom installer may employ, as well as instructions that tell the malware where to direct the victim to pay the ransom. Some kits even bundle the HTML code needed to set up the Web site that users will need to visit to pay and recover their files.</p>
<p>To some degree, a variance in ransom demands based on the victim&#8217;s perceived relative wealth is already at work. <strong>Lawrence Abrams</strong>, owner of the tech-help site <a href="http://www.bleepingcomputer.com" target="_blank">BleepingComputer</a>, said his analysis of multiple ransomware kits and control channels that were compromised by security professionals indicate that these kits usually include default suggested ransom amounts that vary depending on the geographic location of the victim.</p>
<p>&#8220;People behind these scams seem to be setting different rates for different countries,&#8221; Abrams said. &#8220;Victims in the U.S. generally pay more than people in, say, Spain. There was one [kit] we looked at recently that showed while victims in the U.S. were charged $200 in Bitcoin, victims in Italy were asked for just $20 worth of Bitcoin by default.&#8221;</p>
<p>In early 2016, a new ransomware variant <a href="media/d20348e0.Analysis_SamSa_Ransomware.pdf" data-original-source="http://www.intelsecurity.com/advanced-threat-research/content/Analysis_SamSa_Ransomware.pdf" target="_blank">dubbed &#8220;Samsam&#8221;</a> (PDF) was observed targeting businesses running outdated versions of <strong>Red Hat</strong>&#8216;s <strong>JBoss</strong> enterprise products. When companies were hacked and infected with Samsam, Abrams said, they received custom ransom notes with varying ransom demands.</p>
<p>&#8220;When these companies were hacked, they each got custom notes with very different ransom demands that were much higher than the usual amount,&#8221; Abrams said. &#8220;These were very targeted.&#8221;</p>
<p>Which brings up the other coming shift with ransomware: More targeted ransom attacks. For the time being, most ransomware incursions are instead the result of opportunistic malware infections. The first common distribution method is spamming the ransomware installer out to millions of email addresses, disguising it as a legitimate file such as an invoice.</p>
<p>More well-heeled attackers may instead or also choose to spread ransomware using &#8220;exploit kits,&#8221; a separate crimeware-as-a-service product that is stitched into hacked or malicious Web sites and lying in wait for someone to visit with a browser that is not up to date with the latest security patches (either for the browser itself or for a myriad of browser plugins like <strong>Adobe Flash</strong> or <strong>Adobe Reader</strong>).</p>
<p>But Abrams said that&#8217;s bound to change, and that the more targeted attacks are likely to come from individual hackers who can&#8217;t afford to spend thousands of dollars a month renting exploit kits.</p>
<p>&#8220;If you throw your malware into a good exploit kit, you can achieve a fairly wide distribution of it in a short amount of time,&#8221; Abrams said. &#8220;The only problem is the good kits are very expensive and can cost upwards of $4,000 per month. Right now, most of these guys are just throwing the ransomware up in the air and wherever it lands is who they&#8217;re targeting. But that&#8217;s going to change, and these guys are going to start more aggressively targeting really data intensive organizations like medical practices and law and architectural firms.&#8221;</p>
<p>Earlier this year, experts began noticing that ransomware purveyors appeared to be targeting hospitals &#8212; organizations that are extremely data-intensive and heavily reliant on instant access to patient records. Indeed, the above-mentioned SamSAM ransomware family is <a href="http://blog.talosintel.com/2016/03/samsam-ransomware.html" target="_blank">thought to be targeting healthcare firms</a>.</p>
<p>According to <a href="media/c58ecfdf.asset_redirect.html" data-original-source="http://www.mcafee.com/common/js/asset_redirect.html" target="_blank">a new report</a> by <strong>Intel Security</strong>, the healthcare sector is experiencing over 20 data loss incidents per day related to ransomware attacks. The company said it identified almost $100,000 in payments from hospital ransomware victims to specific bitcoin accounts so far in 2016.<span id="more-36337"></span></p>
<h4>RUSSIAN ROULETTE</h4>
<p>An equally disturbing trend in ransomware is the incidence of new strains which include the ability to randomly delete an encrypted file from the victim&#8217;s machine at some predefined interval &#8211;and to continue doing so unless and until the ransom demand is paid or there are no more files to destroy.</p>
<p>Abrams said the a ransomware variant known as &#8220;<a href="http://www.bleepingcomputer.com/news/security/jigsaw-ransomware-decrypted-will-delete-your-files-until-you-pay-the-ransom/" target="_blank">Jigsaw</a>&#8221; debuted this capability in April 2016. Jigsaw also penalized victims who tried to reboot their computer in an effort to rid the machine of the infection, by randomly deleting 1,000 encrypted files for each reboot.</p>
<p>&#8220;Basically, what it would do is show a two hour countdown clock, and when that clock got to zero it would delete a random encrypted file,&#8221; Abrams said. &#8220;And then every hour after that it would double the number of files it deleted unless you paid.&#8221;</p>
<div id="attachment_36346" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36346" src="media/1b640da9.jigsawmessage-580x328.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/jigsawmessage-580x328.png" alt="Part of the ransom note left behind by Jigsaw. Image: Bleepingcomputer.com" width="580" height="328" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/jigsawmessage-580x328.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/jigsawmessage-768x434.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/jigsawmessage.png 829w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Part of the ransom note left behind by Jigsaw. Image: Bleepingcomputer.com</p></div>
<p>Abrams said this same Russian Roulette feature recently has shown up in other ransomware strains, including one called &#8220;<a href="http://www.bleepingcomputer.com/news/security/stampado-ransomware-campaign-decrypted-before-it-started/" target="_blank">Stampado</a>&#8221; and another dubbed &#8220;<a href="http://www.bleepingcomputer.com/news/security/the-week-in-ransomware-september-9th-2016-crypy-crylocker-philadelphia-and-more/" target="_blank">Philadelphia</a>.&#8221;</p>
<p>&#8220;Philadelphia has a similar feature where [one] can specify how many files it deletes and how often,&#8221; he said.</p>
<p>Most ransomware variants have used some version of the countdown clock, with victims most often being told they have 72 hours to pay the ransom or else kiss their files goodbye forever. In practice, however, the people behind these schemes are usually happy to extend that deadline, but the ransom demands almost invariably increase significantly at that point.</p>
<p>The introduction of a destructive element tied to a countdown clock is especially worrisome given how difficult it can be for the unlearned to obtain the virtual Bitcoin currency needed to pay the ransom, Abrams said.</p>
<p>&#8220;I had an architectural firm reach out to me, and they&#8217;d decided to pay the ransom,&#8221; he said. &#8220;So I helped my contact there figure out how to create an account at Coinbase.com and get funds into there, but the whole process took almost a week.&#8221;</p>
<p>Hoping to get access to his files more immediately, Abrams&#8217; contact at the architectural firm inquired about more speedy payment options. Abrams told him about <strong>localbitcoins.com</strong>, which helps people meet in person to exchange bitcoins for cash. In the end, however, the contact wasn&#8217;t comfortable with this option.</p>
<p>&#8220;It&#8217;s not hard to see why,&#8221; he said. &#8220;Some of the exchangers on there have crazy demands, like &#8216;Meet me at the local Starbucks, and absolutely no phones!&#8217; It really sort of feels like a drug deal.&#8221;</p>
<div id="attachment_36349" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36349" src="media/137b070e.stampado-580x394.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/stampado-580x394.png" alt="The ransom demand left by Stampado." width="580" height="394" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/stampado-580x394.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/stampado-768x522.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/stampado.png 841w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The ransom demand left by Stampado. Image: Bleepingcomputer.com</p></div>
<h4>HOW TO PREVENT ATTACKS &amp; WHAT TO DO IF YOU&#8217;RE A VICTIM</h4>
<p>In its alert published today, the FBI urged victims of ransomware incidents to report the crimes to federal law enforcement to help the government &#8220;gain a more comprehensive view of the current threat and its impact on U.S. victims.&#8221;</p>
<p>Specifically, the FBI is asking victims to report the date of infection; the ransomware variant; how the infection occurred; the requested ransom amount; the actors Bitcoin wallet address; the ransom amount paid (if any); the overall losses associated with the ransomware infection; and a victim impact statement.</p>
<p>Previous <a href="http://www.businessinsider.com/fbi-recommends-paying-ransom-for-infected-computer-2015-10" target="_blank">media</a> reports have quoted an FBI agent saying that the agency condones paying such ransom demands. But today&#8217;s plea from the feds to ransomware victims is unequivocal on this point:</p>
<p>&#8220;The FBI does not support paying a ransom to the adversary,&#8221; the agency advised. &#8220;Paying a ransom does not guarantee the victim will regain access to their data; in fact, some individuals or organizations are never provided with decryption keys after paying a ransom.&#8221;</p>
<p>What can businesses do to lessen the chances of becoming the next ransomware victim? The FBI has the following tips:</p>
<ul>
<li>Regularly back up data and verify the integrity of those backups. Backups are critical in ransomware incidents; if you are infected, backups may be the best way to recover your critical data.</li>
<li>Secure your backups. Ensure backups are not connected to the computers and networks they are backing up. Examples might include securing backups in the cloud or physically storing them offline. It should be noted, some instances of ransomware have the capability to lock cloud-based backups when systems continuously back up in real-time, also known as persistent synchronization.</li>
<li>Scrutinize links contained in e-mails and do not open attachments included in unsolicited e-mails.</li>
<li>Only download software – especially free software – from sites you know and trust. When possible, verify the integrity of the software through a digital signature prior to execution.</li>
<li>Ensure application patches for the operating system, software, and firmware are up to date, including Adobe Flash, Java, Web browsers, etc.</li>
<li>Ensure anti-virus and anti-malware solutions are set to automatically update and regular scans are conducted.</li>
<li>Disable macro scripts from files transmitted via e-mail. Consider using Office Viewer software to open Microsoft Office files transmitted via e-mail instead of full Office Suite applications.</li>
<li>Implement software restrictions or other controls to prevent the execution of programs in common ransomware locations, such as temporary folders supporting popular Internet browsers, or compression/decompression programs, including those located in the AppData/LocalAppData folder.</li>
</ul>
<p>Additional considerations for businesses include the following:</p>
<ul>
<li>Focus on awareness and training. Because end users are often targeted, employees should be made aware of the threat of ransomware, how it is delivered, and trained on information security principles and techniques.</li>
<li>Patch all endpoint device operating systems, software, and firmware as vulnerabilities are discovered. This precaution can be made easier through a centralized patch management system.</li>
<li>Manage the use of privileged accounts by implementing the principle of least privilege. No users should be assigned administrative access unless absolutely needed. Those with a need for administrator accounts should only use them when necessary; they should operate with standard user accounts at all other times.</li>
<li>Configure access controls with least privilege in mind. If a user only needs to read specific files, he or she should not have write access to those files, directories, or shares.</li>
<li>Use virtualized environments to execute operating system environments or specific programs.</li>
<li>Categorize data based on organizational value, and implement physical/logical separation of networks and data for different organizational units. For example, sensitive research or business data should not reside on the same server and/or network segment as an organization’s e-mail environment.</li>
<li>Require user interaction for end user applications communicating with Web sites uncategorized by the network proxy or firewall. Examples include requiring users to type in information or enter a password when the system communicates with an uncategorized Web site.</li>
<li>Implement application whitelisting. Only allow systems to execute programs known and permitted by security policy.</li>
</ul>


feed_id: http://krebsonsecurity.com/?p=36330
title: Adobe, Microsoft Push Critical Updates
uri: 2016-09-28-Adobe-Microsoft-Push-Critical-Updates
url: https://krebsonsecurity.com/2016/09/adobe-microsoft-push-critical-updates-3/
content:
<p><strong>Adobe</strong> and <strong>Microsoft</strong> on Tuesday each issued updates to fix multiple critical security vulnerabilities in their software. Adobe pushed a patch that addresses 29 security holes in its widely-used <strong>Flash Player</strong> browser plug-in. Microsoft released some 14 patch bundles to correct at least 50 flaws in <strong>Windows</strong> and associated software, including a zero-day bug in <strong>Internet Explorer</strong>.</p>
<p><img class="alignright wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="178" height="186" />Half of the updates Microsoft released Tuesday earned the company&#8217;s most dire &#8220;critical&#8221; rating, meaning they could be exploited by malware or miscreants to install malicious software with no help from the user, save for maybe just visiting a hacked or booby-trapped Web site. Security firms <a href="https://blog.qualys.com/laws-of-vulnerabilities/2016/09/13/large-microsoft-patch-tuesday-update-for-september-2016" target="_blank">Qualys</a> and <a href="http://blog.shavlik.com/september-patch-tuesday-2016/" target="_blank">Shavlik</a> have more granular writeups on the Microsoft patches.</p>
<p>Adobe&#8217;s advisory for this Flash Update is <a href="https://helpx.adobe.com/security/products/flash-player/apsb16-29.html" target="_blank">here</a>. It brings Flash to <em>v. 23.0.0.162</em> for Windows and Mac users. If you have Flash installed, you should update, hobble or remove Flash as soon as possible.<span id="more-36330"></span></p>
<p>The smartest option is probably to ditch the program once and for all and significantly increase the security of your system in the process. I’ve got more on that approach (as well as slightly less radical solutions ) in <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">A Month Without Adobe Flash Player</a>.</p>
<p><img class="alignleft wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="161" height="137" />If you choose to update, please do it today. The most recent versions of Flash should be available from <a href="https://www.adobe.com/products/flashplayer/distribution3.html" target="_blank">this Flash distribution page</a> or the <a href="https://get.adobe.com/flashplayer/" target="_blank">Flash home page.</a> Windows users who browse the Web with anything other than <strong>Internet Explorer</strong> may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>
<p><strong>Chrome </strong>and IE should auto-install the latest Flash version on browser restart (I had to manually check for updates in Chrome an restart the browser to get the latest Flash version).<span id="more-35216"></span></p>
<p>As always, if you run into any issues installing any of these updates, please feel free to leave a comment about your experience below.</p>


feed_id: http://krebsonsecurity.com/?p=36312
title: Secret Service Warns of ‘Periscope’ Skimmers
uri: Secret-Service-Warns-of-Periscope-Skimmers
url: https://krebsonsecurity.com/2016/09/secret-service-warns-of-periscope-skimmers/
content:
<p>The <strong>U.S. Secret Service</strong> is warning banks and ATM owners about a new technological advance in cash machine skimming known as &#8220;<strong>periscope skimming</strong>,&#8221; which involves a specialized skimming probe that connects directly to the ATM&#8217;s internal circuit board to steal card data.</p>
<div id="attachment_36317" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/d395ec6f.skimmingcontroldevice.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/skimmingcontroldevice.png"><img class="wp-image-36317 size-medium" src="media/12d2aa20.skimmingcontroldevice-580x243.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/skimmingcontroldevice-580x243.png" alt="At left, the skimming control device. Pictured right is the skimming control device with wires protruding from the periscope." width="580" height="243" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/skimmingcontroldevice-580x243.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/skimmingcontroldevice-768x322.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/skimmingcontroldevice.png 879w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">At left, the skimming control device. Pictured right is the skimming control device with wires protruding from the periscope. These were recovered from a cash machine in Connecticut.</p></div>
<p>According to a non-public alert released to bank industry sources by a financial crimes task force in Connecticut, this is thought to be the first time periscope skimming devices have been detected in the United States. The task force warned that the devices may have the capability to remain powered within the ATM for up to 14 days and can store up to 32,000 card numbers before exhausting the skimmer&#8217;s battery strength and data storage capacity.</p>
<p>The alert documents the first known case of periscope skimming in the United States, discovered Aug. 19, 2016 at an ATM in Greenwich, Conn. A second periscope skimmer was reportedly found hidden inside a cash machine in Pennsylvania on Sept. 3.<span id="more-36312"></span></p>
<div id="attachment_36318" style="width: 319px" class="wp-caption alignright"><a class="lightbox" href="media/b7dc939c.periscopeskimmer.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/periscopeskimmer.png"><img class="wp-image-36318" src="media/b7dc939c.periscopeskimmer.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/periscopeskimmer.png" alt="The periscope device." width="309" height="424" /></a><p class="wp-caption-text">The periscope device.</p></div>
<p>The task force alert notes that in both cases the crooks were able to gain direct access to the insides of the ATMs (referred to as &#8220;top-hat&#8221; entry) with a key. The suspects then installed two devices connected together by wiring. The first device &#8212; the periscope skimming probe &#8212; is installed through a pre-existing hole on the frame of the motorized card reader.</p>
<p>The probe is set in place to connect to the circuit board and directly onto the pad that transfers cardholder data stored on the magnetic stripe on the backs of customer payment cards. The probe is then held in place with fast-drying superglue to the card reader frame.</p>
<p>According to the Secret Service, the only visible part of this skimming device once the top-hat is opened will be the wire extending from the periscope probe that leads to the second part of this skimmer &#8212; called a &#8220;skimming control device.&#8221; This second device contains the battery source and data storage unit, and looks similar to a small external hard drive.</p>
<p>As I&#8217;ve noted in previous stories in my series <a href="http://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers</a>, the emergence of this type of skimming attack is thought to be response to the widespread availability of third party anti-skimming technology which is successful at preventing the operation of a traditional skimmer placed on the outside of the ATM.</p>
<p>The Connecticut task task force notes that authorities there did not find hidden cameras or other methods of capturing customer PINs at the ATMs compromised by periscope skimmers, suggesting these attacks involved mere prototypes and that the thieves responsible are in the process of refining their technology.</p>
<p>Nevertheless, crooks who are serious about this type of crime eventually will want to capture your PIN so they can later drain your debit account at another ATM. So it&#8217;s important to remember that covering the PIN pad with your hand defeats the hidden camera from capturing your PIN. Occasionally, skimmer thieves will use <a href="media/b2afe186.skimgallery1.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2010/08/skimgallery1.jpg" target="_blank">PIN pad overlays</a>, but these are comparatively rare and quite a bit more expensive; hidden cameras are used on the vast majority of the more than three dozen ATM skimming incidents that I’ve documented here.</p>
<div id="attachment_36320" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/8f4e4d71.PAperiscopeskimmer.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/PAperiscopeskimmer.png"><img class="wp-image-36320 size-medium" src="media/b4e2b6f0.PAperiscopeskimmer-580x310.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/PAperiscopeskimmer-580x310.png" alt="The periscope skimming device found at an ATM in Pennsylvania." width="580" height="310" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/PAperiscopeskimmer-580x310.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/PAperiscopeskimmer-768x411.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/PAperiscopeskimmer.png 810w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Another periscope skimming device found at an ATM in Pennsylvania.</p></div>
<p>Shockingly, few people bother to take this simple, effective step, as detailed in <a href="http://krebsonsecurity.com/2012/09/a-handy-way-to-foil-atm-skimmer-scams/" target="_blank">this skimmer tale from 2012</a>, wherein I obtained hours worth of video seized from two ATM skimming operations and saw customer after customer walk up, insert their cards and punch in their digits — all in the clear.</p>
<p>Many readers have asked whether the incidence of such skimming scams will decrease as more banks begin issuing more secure chip-based payment cards. The answer is probably not. That&#8217;s because even after most U.S. banks put in place chip-capable ATMs, the magnetic stripe will still be needed because it’s an integral part of the way ATMs work: Most ATMs in use today require a magnetic stripe for the card to be accepted into the machine.</p>
<p>The principal reason for this is to ensure that customers are putting the card into the slot correctly, as embossed letters and numbers running across odd spots in the card reader can take their toll on the machines over time. As long as the cardholder&#8217;s data remains stored on a chip card&#8217;s magnetic stripe, thieves will continue building and placing these types of skimmers.</p>
<p>Also, the thieves conducting these periscope skimming attacks don&#8217;t necessarily need a key to access the ATMs. As I&#8217;ve noted in past skimming stories, crooks who specialize in <a href="http://krebsonsecurity.com/2015/01/thieves-jackpot-atms-with-black-box-attack/" target="_blank">compromising ATMs with malicious software</a> often target stand-alone cash machines that may be easier to access from the top-hat. My advice? Stick to ATMs that are installed in the wall at a bank or otherwise not exposed from the top.</p>
<p>Most importantly, watch out for your own <a href="http://krebsonsecurity.com/2016/09/flash-hijacks-add-new-twist-to-muggings/" target="_blank">physical safety</a> while using an ATM. Keep your wits about you as you transact in and leave the area, and try to be keenly aware of your immediate surroundings. Use only machines in public, well-lit areas, and avoid ATMs in secluded spots.</p>


feed_id: http://krebsonsecurity.com/?p=36288
title: Alleged vDOS Proprietors Arrested in Israel
uri: Alleged-vDOS-Proprietors-Arrested-in-Israel
url: https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/
content:
<p>Two young Israeli men alleged to be the co-owners of a popular online attack-for-hire service were reportedly arrested in Israel on Thursday. The pair were arrested around the same time that KrebsOnSecurity <a href="http://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">published a story</a> naming them as the masterminds behind a service that can be hired to knock Web sites and Internet users offline with powerful blasts of junk data.</p>
<div id="attachment_36310" style="width: 264px" class="wp-caption alignright"><img class=" wp-image-36310" src="media/b1bbd434.yb-580x633.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/yb-580x633.png" alt="Alleged vDOS co-owner Yarden Bidani." width="254" height="277" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/yb-580x633.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/yb-768x839.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/yb.png 806w" sizes="(max-width: 254px) 100vw, 254px" /><p class="wp-caption-text">Alleged vDOS co-owner Yarden Bidani.</p></div>
<p>According to a story at Israeli news site <a href="http://www.themarker.com/technation/1.3063772" target="_blank">TheMarker.com</a>, <strong>Itay Huri</strong> and <strong>Yarden Bidani, </strong>both 18 years old, were arrested Thursday in connection with an investigation by the <strong>U.S. Federal Bureau of Investigation</strong> (FBI).</p>
<p>The pair were reportedly questioned and released Friday on the equivalent of about USD $10,000 bond each. Israeli authorities also seized their passports, placed them under house arrest for 10 days, and forbade them from using the Internet or telecommunications equipment of any kind for 30 days.</p>
<p>Huri and Bidani are suspected of running an attack service called <strong>vDOS. </strong>As I described in <a href="http://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">this week&#8217;s story</a>, vDOS is a “booter” service that has earned in excess of $600,000 over the past two years helping customers coordinate more than 150,000 so-called distributed denial-of-service (DDoS) attacks designed to knock Web sites offline.</p>
<p>The two men&#8217;s identities were exposed because vDOS got massively hacked, spilling secrets about tens of thousands of paying customers and their targets. A copy of that database was obtained by KrebsOnSecurity.</p>
<p>For most of Friday, KrebsOnSecurity came under a heavy and sustained denial-of-service attack, which spiked at almost 140 Gbps. A single message was buried in each attack packet: &#8220;godiefaggot.&#8221; For a brief time the site was unavailable, but thankfully it is guarded by DDoS protection firm <strong>Prolexic/Akamai</strong>. The attacks against this site are ongoing.</p>
<p>Huri and Bidani were fairly open about their activities, or at least not terribly careful to cover their tracks. Yarden&#8217;s now abandoned Facebook page contains several messages from friends who refer to him by his hacker nickname &#8220;AppleJ4ck&#8221; and discuss DDoS activities. vDOS&#8217;s customer support system was configured to send a text message to Huri&#8217;s phone number in Israel &#8212; the same phone number that was listed in the Web site registration records for the domain v-email[dot]org, a domain the proprietors used to help manage the site.</p>
<p>At the end of August 2016, Huri and Bidani authored a <a href="media/ef6ae671.40331.pdf" data-original-source="https://www.exploit-db.com/docs/40331.pdf" target="_blank">technical paper</a> (PDF) on DDoS attack methods which was published in the Israeli security e-zine <em><a href="http://digitalwhisper.co.il" target="_blank">Digital Whisper</a></em>. In it, Huri signs his real name and says he is 18 years old and about to be drafted into the <a href="https://en.wikipedia.org/wiki/Israel_Defense_Forces" target="_blank">Israel Defense Forces</a>. Bidani co-authored the paper under the alias &#8220;Raziel.b7@gmail.com,&#8221; an email address that I pointed out in my previous reporting was assigned to one of the administrators of vDOS.</p>
<p>Sometime on Friday, vDOS went offline. It is currently unreachable. Before it went offline, vDOS was supported by at least four servers hosted in Bulgaria at a provider called <strong>Verdina.net</strong> (the Internet address of those servers was <strong>82.118.233.144</strong>). But according to <a href="https://twitter.com/search?f=tweets&amp;vertical=default&amp;q=AS203959%20&amp;src=typd" target="_blank">several automated Twitter feeds</a> that track suspicious large-scale changes to the global Internet routing tables, sometime in the last 24 hours vDOS was apparently the victim of what&#8217;s known as a <a href="http://krebsonsecurity.com/?s=bgp+hijacking&amp;x=0&amp;y=0" target="_blank">BGP hijack</a>. (Update: For some unknown reason, some of the tweets referenced above from BGPstream were deleted; I&#8217;ve archived them in <a href="media/c479c05e.AS203959-Twitter-Search.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/AS203959-Twitter-Search.pdf" target="_blank">this PDF</a>).<span id="more-36288"></span></p>
<p>BGP hijacking involves one ISP fraudulently “announcing” to the rest of the world’s ISPs that it is in fact the rightful custodian of a range of Internet addresses that it doesn’t actually have the right to control. It is a hack most often associated with spamming activity. According to those Twitter feeds, vDOS&#8217;s Internet addresses were hijacked by a firm called <strong>BackConnect Security</strong>.</p>
<p><span class="pullquote pqleft">Reached by phone, <strong>Bryant Townsend</strong>, founder and CEO of BackConnect Security, confirmed that his company did in fact hijack Verdina/vDOS&#8217;s Internet address space.</span> Townsend said the company took the extreme measure in an effort to get out from under a massive attack launched on the company&#8217;s network Thursday, and that the company received an email directly from vDOS claiming credit for the attack.</p>
<p>&#8220;For about six hours, we were seeing attacks of more than 200 Gbps hitting us,&#8221; Townsend explained. &#8220;What we were doing was for defensive purposes. We were simply trying to get them to stop and to gather as much information as possible about the botnet they were using and report that to the proper authorities.&#8221;</p>
<p>I noted earlier this week that I would be writing more about the victims of vDOS. That story will have to wait for a few more days, but Friday evening <strong>CloudFlare</strong> (another DDoS protection service that vDOS was actually hiding behind) agreed to host the <a href="https://t.co/gfK3VdR0zn" target="_blank">rather large log file</a> listing roughly four months of vDOS attack logs from April through July 2016.</p>
<p>For some reason the attack logs only go back four months, probably because they were wiped at one point. But vDOS has been in operation since Sept. 2012, so this is likely a very small subset of the attacks this DDoS-for-hire service has perpetrated.</p>
<p>The file lists the vDOS username that ordered and paid for the attack; the target Internet address; the method of attack; the Internet address of the vDOS user at the time; the date and time the attack was executed; and the browser user agent string of the vDOS user.</p>
<div id="attachment_36297" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/c0f1a31e.vdosattacklogs.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdosattacklogs.png"><img class="wp-image-36297 size-medium" src="media/196d4310.vdosattacklogs-580x110.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdosattacklogs-580x110.png" alt="A few lines from the vDOS attack logs." width="580" height="110" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdosattacklogs-580x110.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdosattacklogs-768x145.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdosattacklogs-940x178.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdosattacklogs.png 1069w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A few lines from the vDOS attack logs.</p></div>


feed_id: http://krebsonsecurity.com/?p=35857
title: Israeli Online Attack Service ‘vDOS’ Earned $600,000 in Two Years
uri: Israeli-Online-Attack-Service-vDOS-Earned-600-000-in-Two-Years
url: https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/
content:
<p><strong>vDOS </strong>&#8212;<strong> </strong>a &#8220;booter&#8221; service that has earned in excess of $600,000 over the past two years helping customers coordinate more than 150,000 so-called distributed denial-of-service (DDoS) attacks designed to knock Web sites offline &#8212; has been massively hacked, spilling secrets about tens of thousands of paying customers and their targets.</p>
<p>The vDOS database, obtained by KrebsOnSecurity.com at the end of July 2016, points to two young men in Israel as the principal owners and masterminds of the attack service, with support services coming from several young hackers in the United States.</p>
<div id="attachment_36219" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/2ddc22a8.vdoshome.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome.png"><img class="wp-image-36219 size-medium" src="media/fa2da85d.vdoshome-580x379.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome-580x379.png" alt="The vDos home page." width="580" height="379" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome-580x379.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome-768x502.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome-940x615.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome.png 1191w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The vDos home page.</p></div>
<p>To say that vDOS has been responsible for a majority of the DDoS attacks clogging up the Internet over the past few years would be an understatement. The various subscription packages to the service are sold based in part on how many seconds the denial-of-service attack will last. <em>And in just four months between April and July 2016, vDOS was responsible for launching more than 277 million seconds of attack time, or approximately 8.81 years worth of attack traffic. </em></p>
<p>Let the enormity of that number sink in for a moment: That&#8217;s nearly nine of what I call &#8220;DDoS years&#8221; crammed into just four months. That kind of time compression is possible because vDOS handles hundreds &#8212; if not thousands &#8212; of concurrent attacks on any given day.</p>
<p>Although I can&#8217;t prove it yet, it seems likely that vDOS is responsible <em>for several decades worth of DDoS years</em>. That&#8217;s because the data leaked in the hack of vDOS suggest that the proprietors erased all digital records of attacks that customers launched between Sept. 2012 (when the service first came online) and the end of March 2016.</p>
<h4>HOW vDOS GOT HACKED</h4>
<p>The hack of vDOS came about after a source was investigating a vulnerability he discovered on a similar attack-for-hire service called <strong>PoodleStresser</strong>. The vulnerability allowed my source to download the configuration data for PoodleStresser&#8217;s attack servers, which pointed back to <strong>api.vdos-s[dot]com</strong>. PoodleStresser, as well as a large number of other booter services, appears to rely exclusively on firepower generated by vDOS.</p>
<p>From there, the source was able to exploit a more serious security hole in vDOS that allowed him to dump all of the service&#8217;s databases and configuration files, and to discover the true Internet address of four rented servers in Bulgaria (at <strong>Verdina.net</strong>) that are apparently being used to launch the attacks sold by vDOS. The DDoS-for-hire service is hidden behind DDoS protection firm <a href="http://www.cloudflare.com" target="_blank">Cloudflare</a>, but its actual Internet address is 82.118.233.144.</p>
<p>vDOS had a reputation on cybercrime forums for prompt and helpful customer service, and the leaked vDOS databases offer a fascinating glimpse into the logistical challenges associated with running a criminal attack service online that supports tens of thousands of paying customers &#8212; a significant portion of whom are all trying to use the service simultaneously.</p>
<p>Multiple vDOS tech support tickets were filed by customers who complained that they were unable to order attacks on Web sites in Israel. Responses from the tech support staff show that the proprietors of vDOS are indeed living in Israel and in fact set the service up so that it was unable to attack any Web sites in that country &#8212; presumably so as to not attract unwanted attention to their service from Israeli authorities. Here are a few of those responses:</p>
<blockquote><p>(&#8216;4130&#8242;,&#8217;Hello `d0rk`,\r\nAll Israeli IP ranges have been blacklisted due to security reasons.\r\n\r\nBest regards,\r\nP1st.&#8217;,&#8217;03-01-2015 08:39),</p>
<p>(&#8216;15462&#8242;,&#8217;Hello `g4ng`,\r\nMh, neither. I\&#8217;m actually from Israel, and decided to blacklist all of them. It\&#8217;s my home country, and don\&#8217;t want something to happen to them :)\r\n\r\nBest regards,\r\nDrop.&#8217;,&#8217;11-03-2015 15:35),</p>
<p>(&#8216;15462&#8242;,&#8217;Hello `roibm123`,\r\nBecause I have an Israeli IP that is dynamic.. can\&#8217;t risk getting hit/updating the blacklist 24/7.\r\n\r\nBest regards,\r\nLandon.&#8217;,&#8217;06-04-<wbr />2015 23:04),</p>
<p>(&#8216;4202&#8242;,&#8217;Hello `zavi156`,\r\nThose IPs are in israel, and we have all of Israel on our blacklist. Sorry for any inconvinience.\r\n\r\nBest regards,\r\nJeremy.&#8217;,&#8217;20-05-<wbr />2015 10:14),</p>
<p>(&#8216;4202&#8242;,&#8217;Hello `zavi156`,\r\nBecause the owner is in Israel, and he doesn\&#8217;t want his entire region being hit offline.\r\n\r\nBest regards,\r\nJeremy.&#8217;,&#8217;20-05-<wbr />2015 11:12),</p>
<p>(&#8216;9057&#8242;,&#8217;There is a option to buy with Paypal? I will pay more than $2.5 worth.\r\nThis is not the first time I am buying booter from you.\r\nIf no, Could you please ask AplleJack? I know him from Israel.\r\nThanks.&#8217;,&#8217;21-05-<wbr />2015 12:51),</p>
<p>(&#8216;4120&#8242;,&#8217;Hello `takedown`,\r\nEvery single IP that\&#8217;s hosted in israel is blacklisted for safety reason. \r\n\r\nBest regards,\r\nAppleJ4ck.&#8217;,&#8217;02-<wbr />09-2015 08:57),</p></blockquote>
<h4>WHO RUNS vDOS?</h4>
<p>As we can see from the above responses from vDOS&#8217;s tech support, the owners and operators of vDOS are young Israeli hackers who go by the names <strong>P1st a.k.a.</strong> <strong>P1st0</strong>, and <strong>AppleJ4ck</strong>. The two men <a href="https://webcache.googleusercontent.com/search?q=cache:FEhj2XS8C6YJ:https://hackforums.net/printthread.php%3Ftid%3D4555812+&amp;cd=2&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank">market their service</a> mainly on the site <strong>hackforums[dot]net</strong>, selling monthly subscriptions using multiple pricing tiers ranging from $20 to $200 per month. AppleJ4ck hides behind the same nickname on Hackforums, while P1st goes by the alias &#8220;<strong>M30w</strong>&#8221; on the forum.</p>
<div id="attachment_36220" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/60133bf3.p1st-m30w.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/p1st-m30w.png"><img class="wp-image-36220 size-medium" src="media/c4ca5f21.p1st-m30w-580x297.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/p1st-m30w-580x297.png" alt="Some of P1st/M30W's posts on Hackforums regarding his service vDOS." width="580" height="297" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/p1st-m30w-580x297.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/p1st-m30w-768x393.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/p1st-m30w-940x481.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Some of P1st/M30W&#8217;s posts on Hackforums regarding his service vDOS.</p></div>
<p>vDOS appears to be the longest-running booter service advertised on Hackforums, and it is by far and away the most profitable such business. Records leaked from vDOS indicate that since July 2014, tens of thousands of paying customers spent a total of more than $618,000 at the service using <strong>Bitcoin</strong> and <strong>PayPal</strong>.</p>
<p><em>Incredibly</em>, f<em>or brief periods the site even accepted credit cards in exchange for online attacks,</em> although it&#8217;s unclear how much the site might have made in credit card payments because the information is not in the leaked databases.</p>
<p>The Web server hosting vDOS also houses several other sites, including <strong>huri[dot]biz</strong>, <strong>ustress[dot]io</strong>, and <strong>vstress[dot]net</strong>. Virtually all of the administrators at vDOS have an email account that ends in <strong>v-email[dot]org,</strong> a domain that also is registered to an <strong>Itay Huri</strong> with a phone number that traces back to Israel.</p>
<p>The proprietors of vDOS set their service up so that anytime a customer asked for technical assistance the site would blast a text message to six different mobile numbers tied to administrators of the service, using an SMS service called <strong>Nexmo.com</strong>. Two of those mobile numbers go to phones in Israel. One of them is the same number listed for Itay Huri in the Web site registration records for v-email[dot]org; the other belongs to an Israeli citizen named <a href="https://twitter.com/AppleJ4ck_vDos/followers" target="_blank">Yarden Bidani</a>. Neither individual responded to requests for comment.</p>
<p>The leaked database and files indicate that vDOS uses <a href="https://www.mailgun.com/" target="_blank">Mailgun</a> for email management, and the secret keys needed to manage that Mailgun service were among the files stolen by my source. The data shows that vDOS support emails go to itay@huri[dot]biz, itayhuri8@gmail.com and raziel.b7@gmail.com.</p>
<h4>LAUNDERING THE PROCEEDS FROM DDOS ATTACKS</h4>
<p>The $618,000 in earnings documented in the vDOS leaked logs is almost certainly a conservative income figure. That&#8217;s because the vDOS service actually dates back to Sept 2012, yet the payment records are not available for purchases prior to 2014. As a result, it&#8217;s likely that this service has made its proprietors more than $1 million.</p>
<p>vDOS does not currently accept PayPal payments. But for several years until recently it did, and records show the proprietors of the attack service worked assiduously to launder payments for the service through a round-robin chain of PayPal accounts.</p>
<p>They did this because at the time PayPal was working with a team of academic researchers to identify, seize and shutter PayPal accounts that were found to be accepting funds on behalf of booter services like vDOS. Anyone interested in reading more on their success in making life harder for these booter service owners should check out my August 2015 story, <a href="http://krebsonsecurity.com/2015/08/stress-testing-the-booter-services-financially/" target="_blank">Stress-Testing the Booter Services, Financially</a>.</p>
<p>People running dodgy online services that violate PayPal&#8217;s terms of service generally turn to several methods to mask the true location of their PayPal Instant Payment Notification systems. <a href="http://pastebin.com/gFafT15F" target="_blank">Here</a> is an interesting analysis of how popular booter services are doing so using shell corporations, link shortening services and other tricks.</p>
<p>Turns out, AppleJ4ck and p1st routinely recruited other forum members on Hackforums to help them launder significant sums of PayPal payments for vDOS each week.</p>
<p>&#8220;The paypals that the money are sent from are not verified,&#8221; AppleJ4ck says in one recruitment thread. &#8220;Most of the payments will be 200$-300$ each and I&#8217;ll do around 2-3 payments per day.&#8221;</p>
<div id="attachment_36183" style="width: 571px" class="wp-caption aligncenter"><img class="size-full wp-image-36183" src="media/1e734809.vdospaypal.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdospaypal.png" alt="vDos co-owner AppleJ4ck recruiting Hackforums members to help launder PayPal payments for his booter service." width="561" height="888" /><p class="wp-caption-text">vDos co-owner AppleJ4ck recruiting Hackforums members to help launder PayPal payments for his booter service.</p></div>
<p>It is apparent from the leaked vDOS logs that in July 2016 the service&#8217;s owners implemented an additional security measure for Bitcoin payments, which they accept through <a href="https://www.coinbase.com" target="_blank">Coinbase</a>. The data shows that they now use an intermediary server (45.55.55.193) to handle Coinbase traffic. When a Bitcoin payment is received, Coinbase notifies this intermediary server, not the actual vDOS servers in Bulgaria.</p>
<p>A server situated in the middle and hosted at a U.S.-based address from <strong>Digital Ocean</strong> then updates the database in Bulgaria, perhaps because the vDOS proprietors believed payments from the USA would attract less interest from Coinbase than huge sums traversing through Bulgaria each day.<span id="more-35857"></span></p>
<h4>ANALYSIS</h4>
<p>The extent to which the proprietors of vDOS went to launder profits from the service and to obfuscate their activities clearly indicate they knew that the majority of their users were using the service to knock others offline.</p>
<p>Defenders of booter and stresser services argue the services are legal because they can be used to help Web site owners stress-test their own sites and to build better defenses against such attacks. While it&#8217;s impossible to tell what percentage of vDOS users actually were using the service to stress-test their own sites, the leaked vDOS logs show that a huge percentage of the attack targets are online businesses.</p>
<p><span class="pullquote pqleft">In reality, the methods that vDOS uses to sustain its business are practically indistinguishable from those employed by organized cybercrime gangs, said <strong>Damon McCoy</strong>, an assistant professor of computer science at New York University.</span></p>
<p>&#8220;These guys are definitely taking a page out of the playbook of the Russian cybercriminals,&#8221; said McCoy, the researcher principally responsible for pushing vDOS and other booter services off of PayPal (see the aforementioned story <a href="http://krebsonsecurity.com/2015/08/stress-testing-the-booter-services-financially/" target="_blank">Stress-Testing the Booter Services, Financially</a> for more on this).</p>
<p>&#8220;A lot of the Russian botnet operators who routinely paid people to infect Windows computers with malware used to say they wouldn&#8217;t buy malware installs from Russia or <a href="https://en.wikipedia.org/wiki/Commonwealth_of_Independent_States" target="_blank">CIS countries</a>,&#8221; McCoy said. &#8220;The main reason was they didn&#8217;t want to make trouble in their local jurisdiction in the hopes that no one in their country would be a victim and have standing to bring a case against them.&#8221;</p>
<p>The service advertises attacks at up to 50 gigabits of data per second (Gbps). That&#8217;s roughly the equivalent of trying to cram two, high-definition Netflix movies down a target&#8217;s network pipe all at the same moment.</p>
<p>But <strong>Allison Nixon</strong>, director of security research at business risk intelligence firm <a href="https://www.flashpoint-intel.com/" target="_blank">Flashpoint</a>, said her tests of vDOS&#8217;s service generated attacks that were quite a bit smaller than that &#8212; 14 Gbps and 6 Gbps. Nevertheless, she noted, even an attack that generates just 6 Gbps is well more than enough to cripple most sites which are not already protected by anti-DDoS services.</p>
<p>And herein lies the rub with services like vDOS: They put high-powered, point-and-click cyber weapons in the hands of people &#8212; mostly young men in their teens &#8212; who otherwise wouldn&#8217;t begin to know how to launch such attacks. Worse still, they force even the smallest of businesses to pay for DDoS protection services or else risk being taken offline by anyone with a grudge or agenda.</p>
<p>&#8220;The problem is that this kind of firepower is available to literally anyone willing to pay $30 a month,&#8221; Nixon said. &#8220;Basically what this means is that you must have DDoS protection to participate on the Internet. Otherwise, any angry young teenager is going to be able to take you offline in a heartbeat. It&#8217;s sad, but these attack services mean that DDoS protection has become the price of admission for running a Web site these days.&#8221;</p>
<p>Stay tuned for the next piece in this series on the hack of vDOS, which will examine some of the more interesting victims of this service.</p>


feed_id: http://krebsonsecurity.com/?p=36198
title: The Limits of SMS for 2-Factor Authentication
uri: The-Limits-of-SMS-for-2-Factor-Authentication
url: https://krebsonsecurity.com/2016/09/the-limits-of-sms-for-2-factor-authentication/
content:
<p>A recent ping from a reader reminded me that I&#8217;ve been meaning to blog about the security limitations of using cell phone text messages for two-factor authentication online. The reader&#8217;s daughter had received a text message claiming to be from <strong>Google</strong>, warning that her <strong>Gmail</strong> account had been locked because someone in India had tried to access her account. The young woman was advised to expect a 6-digit verification code to be sent to her and to reply to the scammer&#8217;s message with that code.</p>
<p><strong><img class="alignright wp-image-36253" src="media/bc17e41e.2fa-580x596.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/2fa-580x596.png" alt="2fa" width="229" height="235" />Mark Cobb</strong>, a computer technician in Reno, Nev., said had his daughter fallen for the ruse, her Gmail account would indeed have been completely compromised, and she really would have been locked out of her account because the crooks would have changed her password straight away.</p>
<p>Cobb&#8217;s daughter received the scam text message because she&#8217;d enabled 2-factor authentication on her Gmail account, selecting the option to have Google request that she enter a 6-digit code texted to her cell phone each time it detects a login from an unknown computer or location (in practice, the code is to be entered on the Gmail site, <em>not</em> sent in any kind of texted or emailed reply).</p>
<p>In this case, the thieves already had her password &#8212; most likely because she re-used it on some other site that got hacked. Cobb says he and his daughter believe her mobile number and password may have been exposed as part of <a href="http://krebsonsecurity.com/2016/05/as-scope-of-2012-breach-expands-linkedin-to-again-reset-passwords-for-some-users/" target="_blank">the 2012 breach at LinkedIn</a>.</p>
<p>In any case, the crooks were priming her to expect a code and to repeat it back to them because that code was the only thing standing in the way of their seizing control over her account. And they could control when Google would send the code to her phone because Google would do this as soon as they tried to log in using her username and password. Indeed, the timing aspect of this attack helps make it more believable to the target.</p>
<p>This is a fairly clever &#8212; if not novel &#8212; attack, and it&#8217;s one I&#8217;d wager would likely fool a decent percentage of users who have enabled text messages as a form of two-factor authentication. Certainly, text messaging is far from the strongest form of 2-factor authentication, but it is better than allowing a login with nothing more than a username and password, as this scam illustrates.</p>
<p>Nevertheless, text messaging codes to users isn&#8217;t the safest way to do two-factor authentication, even if some entities &#8212; like the <a href="http://krebsonsecurity.com/2016/08/social-security-administration-now-requires-two-factor-authentication/" target="_blank">U.S. Social Security Administration</a> and <a href="https://www.playstation.com/en-us/account-security/2-step-verification/" target="_blank">Sony&#8217;s Playstation network</a> &#8212; are just getting around to offering two-factor via SMS.</p>
<p>But don&#8217;t take my word for it. That&#8217;s according to the <strong>National Institute of Standards and Technology </strong>(NIST), which recently issued <a href="https://pages.nist.gov/800-63-3/" target="_blank">new proposed digital authentication guidelines</a> urging organizations to favor other forms of two-factor &#8212; such as time-base one-time passwords generated by mobile apps &#8212; over text messaging. By the way, NIST is <a href="https://pages.nist.gov/800-63-3/comment_help.html" target="_blank">seeking feedback</a> on these recommendations.</p>
<p>If anyone&#8217;s interested, <strong>Sophos&#8217;s Naked Security blog</strong> has a <a href="https://nakedsecurity.sophos.com/2016/08/18/nists-new-password-rules-what-you-need-to-know/?utm_content=buffer1244e&amp;utm_medium=social&amp;utm_source=twitter.com&amp;utm_campaign=buffer" target="_blank">very readable breakdown</a> of what&#8217;s new in the NIST guidelines. Among my favorite highlights is this broad directive: Favor the user.</p>
<p>&#8220;To begin with, make your password policies user friendly and put the burden on the verifier when possible,&#8221; Sophos&#8217;s <strong>Chester Wisniewski</strong> writes. &#8220;In other words, we need to stop asking users to do things that aren&#8217;t actually improving security.&#8221; Like expiring passwords and making users change them frequently, for example.</p>
<p>Okay, so the geeks-in-chief are saying it&#8217;s time to move away from texting as a form of 2-factor authentication. And, of course, they&#8217;re right, because text messages are a lot like email, in that it&#8217;s difficult to tell who really sent the message, and the message itself is sent in plain text &#8212; i.e. is readable by anyone who happens to be lurking in the middle.</p>
<p>But security experts and many technology enthusiasts have a tendency to think that everyone should see the world through the lens of security, whereas most mere mortal users just want to get on with their lives and are perfectly content to use the same password across multiple sites &#8212; regardless of how many times they&#8217;re told not to do so.<span id="more-36198"></span></p>
<div id="attachment_36251" style="width: 223px" class="wp-caption alignleft"><a class="lightbox" href="media/3874a4f6.goog2fa.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/goog2fa.png"><img class="wp-image-36251" src="media/3874a4f6.goog2fa.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/goog2fa.png" alt="Google's new push-based two-factor authentication system. Image: Google." width="213" height="415" /></a><p class="wp-caption-text">Google&#8217;s new push-based two-factor authentication system. Image: Google.</p></div>
<p>Indeed, while many more companies now offer some form of two-factor authentication than did two or three years ago &#8212; consumer adoption of this core security feature remains seriously lacking. For example, the head of security at <strong>Dropbox</strong> <a href="http://krebsonsecurity.com/2016/06/dropbox-smeared-in-week-of-megabreaches/" target="_blank">recently told KrebsOnSecurity</a> that <em>less than one percent of its user base of 500 million registered users had chosen to turn on 2-factor authentication for their accounts</em>. And Dropbox isn&#8217;t exactly a Johnny-come-lately to the 2-factor party: It has been offering 2-factor logins for <a href="http://krebsonsecurity.com/2012/08/dropbox-now-offers-two-step-authentication/" target="_blank">a full four years now</a>.</p>
<p>I doubt Dropbox is somehow an aberration in this regard, and it seems likely that other services also suffer from single-digit two-factor adoption rates. But if more consumers haven&#8217;t enabled two-factor options, it&#8217;s probably because a) it&#8217;s still optional and b) it still demands too much caring and understanding from the user about what&#8217;s going on and how these security systems can be subverted.</p>
<p>Personally, I favor app-based <a href="http://searchsecurity.techtarget.com/definition/time-based-one-time-password-TOTP" target="_blank">time-based one-time password</a> (TOTP) systems like <a href="http://www.howtogeek.com/105041/how-to-secure-your-google-account-with-google-authenticator/" target="_blank">Google Authenticator</a>, which continuously auto-generates a unique code via a mobile-based app.</p>
<p>Google recently went a step further along the lines of where I&#8217;d like to see two-factor headed across the board, by <a href="http://googleappsupdates.blogspot.co.uk/2016/06/new-settings-for-2-step-verification.html" target="_blank">debuting a new &#8220;push&#8221; authentication system</a> that generates a prompt on the user&#8217;s mobile device that users need to tap to approve login requests. This is very similar to another push-based two-factor system I&#8217;ve long used and trusted &#8212; from <a href="https://duo.com/" target="_blank">Duo Security</a> [full disclosure: Duo is an advertiser on this site].</p>
<p>For a comprehensive breakdown of which online services offer two-factor authentication and of what type, check out <a href="https://twofactorauth.org/" target="_blank">twofactorauth.org</a>. And bear in mind that even if text-based authentication is all that&#8217;s offered, that&#8217;s still better than nothing. What&#8217;s more, it&#8217;s still probably more security than the majority of the planet has protecting their accounts.</p>


feed_id: https://krebsonsecurity.com/?p=36514
title: ‘Money Mule’ Gangs Turn to Bitcoin ATMs
uri: Money-Mule-Gangs-Turn-to-Bitcoin-ATMs
url: https://krebsonsecurity.com/2016/09/money-mule-gangs-turn-to-bitcoin-atms/
content:
<p>Fraudsters who hack corporate bank accounts typically launder stolen funds by making deposits from the hacked company into accounts owned by &#8220;money mules,&#8221; willing or unwitting dupes recruited through work-at-home job scams. The mules usually are then asked to withdraw the funds in cash and wire the money to the scammers. Increasingly, however, the mules are being instructed to remit the stolen money via <strong>Bitcoin ATMs</strong>.</p>
<div align="center"><iframe src="http://www.youtube.com/embed/it3h4sjj45o" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>I recently heard from a reader in Canada who said she&#8217;d recently accepted a job as a customer service officer for a company called <strong>LunarBay</strong>. This company claims to be a software development firm, and told this reader they needed to hire people to help process payments for LunarBay&#8217;s clients.</p>
<p>LunarBay&#8217;s Web site &#8212; <strong>Lunarbay[dot]biz</strong> &#8212; claims the company has been in business for several years, and even references <a href="https://beta.companieshouse.gov.uk/company/08722023/filing-history" target="_blank">a legitimate business</a> by the same name in the United Kingdom. But the domain name was registered only in late August 2016, and appears to have lifted all of its content from a legitimate Australian digital marketing firm called <a href="https://www.bonfire.com.au/about/" target="_blank">Bonfire</a>.</p>
<p>The Canadian reader who contacted KrebsOnSecurity about this scam was offered $870 per week and a five percent commission on every transaction she handled. After providing her bank account information to get paid, she became suspicious when she received instructions on how to forward funds on the LunarBay.</p>
<p>The scammers told her to withdraw the money from her account by going into the bank itself &#8212; not from the ATM (mainly due to daily withdrawal limits at the ATM). They also sent her a QR code (pictured below) that she was instructed to save as an image on her smartphone. The crooks then proceeded to tell her the location of the nearest Bitcoin ATM:</p>
<blockquote><p>a) The nearest Bitcoin ATM is located at: 6364 Rue Pascal, Montréal-Nord, QC H1G 1T6, Canada (Bitcoin ATM is located at Dépanneur Pascal 2003 convenience shop in Montreal).</p>
<p>b) You can find the instructions of how to make payment using Bitcoin ATM in <a href="https://www.youtube.com/watch?v=it3h4sjj45o" target="_blank">this video</a></p>
<p>c) Please find the image attached to this message. This is a QR code &#8211; an unique identification number for a transaction. I ask you to save this image to your smartphone beforehand.</p>
<p>4. The payment must be processed within 3 hours. The Bitcoin rate is constantly changing in relation to CAD, USD and other currencies. That&#8217;s why the payment must be made during this time interval.</p></blockquote>
<p>As the above Youtube video demonstrates, sending funds merely requires the user to scan a QR code shared by the intended recipient, and then insert cash into the Bitcoin ATM. Because Bitcoin is a non-refundable form of payment, once the money is sent the transaction cannot be reversed.<span id="more-36514"></span></p>
<p>It&#8217;s not immediately clear why these thieves are avoiding tried-and-true methods of disbursing cash &#8212; like <strong>Western Union</strong> and <strong>MoneyGram</strong> &#8212; in favor of Bitcoin ATMs. I suppose it&#8217;s possible that the wire transfer companies are getting better at detecting and blocking suspicious transactions, but I doubt that&#8217;s the reason. More likely, sending cash via Bitcoin results in a more immediate payday for the scammers, and avoids the costs and hassle associated with hiring <a href="https://krebsonsecurity.com/2012/11/online-service-offers-bank-robbers-for-hire/" target="_blank">&#8220;far-end&#8221; mules</a> to collect fraudulent wire transfers in the scammer&#8217;s home country.</p>
<div id="attachment_36516" style="width: 176px" class="wp-caption alignright"><img class=" wp-image-36516" src="media/3a2f8b4c.qr.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/qr.png" alt="The QR code used by the scammers at the fake LunarBay company." width="166" height="166" /><p class="wp-caption-text">The QR code used by the scammers at the fake LunarBay company.</p></div>
<p>It may seem difficult to believe that people might be gullible enough to to get embroiled in such money laundering scams, but countless individuals do every day. The crooks operating this scam no doubt use multiple QR codes linked to many different Bitcoin addresses. The one given to the reader who contacted me links to <a href="https://blockchain.info/address/1FW3HhYFSaWiyU7dfkPJu8XNrcBJy1cN9V" target="_blank">this Bitcoin account</a>, which has received a total of eight transactions over three days this past week totaling more than 6.3 Bitcoins &#8212; roughly $3,823 at current exchange rates.</p>
<p>Word to the wise: Money mule scammers specialize in hacking employer accounts at job recruitment Web sites like <strong>Monster.com</strong>, <strong>Hotjobs.com</strong> and other popular employment search services. Armed with the employer accounts, the crooks are free to search through millions of resumes and reach out to people who are currently between jobs or seeking part-time employment.</p>
<p>If you receive a job solicitation via email that sounds too-good-to-be-true, it probably is related in some way to one of these money-laundering schemes. Even if you can&#8217;t see the downside to you, someone is likely getting ripped off. Also, know that money mules &#8212; however unwitting &#8212; may find themselves in hot water with local police, and may be asked by their bank to pay back funds that were illegally transferred into the mules&#8217; account.</p>
<p>For more on the crucial role of money mules in facilitating cybercrime, check out <a href="https://krebsonsecurity.com/?s=money+mules&amp;x=0&amp;y=0" target="_blank">these stories</a>.</p>


feed_id: https://krebsonsecurity.com/?p=36541
title: Source Code for IoT Botnet ‘Mirai’ Released
uri: Source-Code-for-IoT-Botnet-Mirai-Released
url: https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/
content:
<p>The source code that powers the &#8220;Internet of Things&#8221; (IoT) botnet responsible for launching the <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">historically large distributed denial-of-service (DDoS) attack</a> against KrebsOnSecurity last month has been publicly released, virtually guaranteeing that the Internet will soon be flooded with attacks from many new botnets powered by insecure routers, IP cameras, digital video recorders and other easily hackable devices.</p>
<p>The leak of the source code was announced Friday on the English-language hacking community <strong><a href="http://krebsonsecurity.com/?s=hackforums&amp;x=0&amp;y=0" target="_blank">Hackforums</a></strong>. The malware, dubbed &#8220;<strong>Mirai</strong>,&#8221; spreads to vulnerable devices by continuously scanning the Internet for IoT systems protected by factory default or hard-coded usernames and passwords.</p>
<div id="attachment_36550" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36550" src="media/61e3129a.mirai-hf-580x232.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/mirai-hf-580x232.png" alt="The Hackforums post that includes links to the Mirai source code." width="580" height="232" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/10/mirai-hf-580x232.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/10/mirai-hf-768x308.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/10/mirai-hf-940x377.png 940w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The Hackforums post that includes links to the Mirai source code.</p></div>
<p>Vulnerable devices are then seeded with malicious software that turns them into &#8220;bots,&#8221; forcing them to report to a central control server that can be used as a staging ground for launching powerful DDoS attacks designed to knock Web sites offline.</p>
<p>The Hackforums user who released the code, using the nickname &#8220;<strong>Anna-senpai</strong>,&#8221; told forum members the source code was being released in response to increased scrutiny from the security industry.</p>
<p>&#8220;When I first go in DDoS industry, I wasn&#8217;t planning on staying in it long,&#8221; Anna-senpai wrote. &#8220;I made my money, there&#8217;s lots of eyes looking at IOT now, so it&#8217;s time to <a href="http://www.urbandictionary.com/define.php?term=GTFO" target="_blank">GTFO</a> [link added]. So today, I have an amazing release for you. With Mirai, I usually pull max 380k bots from telnet alone. However, after the Kreb [sic] DDoS, ISPs been slowly shutting down and cleaning up their act. Today, max pull is about 300k bots, and dropping.&#8221;</p>
<p>Sources tell KrebsOnSecurity that Mirai is one of at least two malware families that are currently being used to quickly assemble very large IoT-based DDoS armies. The other dominant strain of IoT malware, dubbed &#8220;<strong>Bashlight</strong>,&#8221; functions similarly to Mirai in that it also infects systems via default usernames and passwords on IoT devices.</p>
<p>According to research from security firm <strong>Level3 Communications</strong>, the Bashlight botnet currently is responsible for enslaving nearly a million IoT devices and is in direct competition with botnets based on Mirai.</p>
<p>&#8220;Both [are] going after the same IoT device exposure and, in a lot of cases, the same devices,&#8221; said <strong>Dale Drew</strong>, Level3&#8217;s chief security officer.<br />
<span id="more-36541"></span></p>
<p>Infected systems can be cleaned up by simply rebooting them &#8212; thus wiping the malicious code from memory. But experts say there is so much constant scanning going on for vulnerable systems that <em>vulnerable IoT devices can be re-infected within minutes of a reboot</em>. Only changing the default password protects them from rapidly being reinfected on reboot.</p>
<p>In the days since the record 620 Gbps DDoS on KrebsOnSecurity.com, this author has been able to confirm that the attack was launched by a Mirai botnet. As I wrote last month, preliminary analysis of the attack traffic suggested that perhaps the biggest chunk of the attack came in the form of traffic designed to look like it was <a href="https://www.incapsula.com/blog/what-is-gre-tunnel.html" target="_blank">generic routing encapsulation</a> (GRE) data packets, a communication protocol used to establish a direct, point-to-point connection between network nodes. GRE lets two peers share data they wouldn’t be able to share over the public network itself.</p>
<p>One security expert who asked to remain anonymous said he examined the Mirai source code following its publication online and confirmed that it includes a section responsible for coordinating GRE attacks.</p>
<p>It&#8217;s an open question why anna-senpai released the source code for Mirai, but it&#8217;s unlikely to have been an altruistic gesture: Miscreants who develop malicious software often dump their source code publicly when law enforcement investigators and security firms start sniffing around a little too close to home. Publishing the code online for all to see and download ensures that the code&#8217;s original authors aren&#8217;t the only ones found possessing it if and when the authorities come knocking with search warrants.</p>
<p>My guess is that (if it&#8217;s not already happening) there will soon be many Internet users complaining to their ISPs about slow Internet speeds as a result of hacked IoT devices on their network hogging all the bandwidth. On the bright side, if that happens it may help to lessen the number of vulnerable systems.</p>
<p>On the not-so-cheerful side, there are plenty of new, default-insecure IoT devices being plugged into the Internet each day. <strong>Gartner Inc.</strong> <a href="http://www.gartner.com/newsroom/id/3165317" target="_blank">forecasts</a> that 6.4 billion connected things will be in use worldwide in 2016, up 30 percent from 2015, and will reach 20.8 billion by 2020. In 2016, 5.5 million new things will get connected each day, Gartner estimates.</p>
<p>For more on what we can and must do about the dawning IoT nightmare, see the second half of this week&#8217;s story, <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank">The Democratization of Censorship</a>. In the meantime, <a href="https://blog.sucuri.net/2016/09/iot-home-router-botnet-leveraged-in-large-ddos-attack.html" target="_blank">this post</a> from <strong>Sucuri Inc. </strong>points to some of the hardware makers whose default-insecure products are powering this IoT mess.</p>


feed_id: https://krebsonsecurity.com/?p=36566
title: Who Makes the IoT Things Under Attack?
uri: Who-Makes-the-IoT-Things-Under-Attack
url: https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/
content:
<p>As KrebsOnSecurity observed over the weekend, the source code that powers the “Internet of Things” (IoT) botnet responsible for launching the <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">historically large distributed denial-of-service (DDoS) attack</a> against KrebsOnSecurity last month has been <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank">publicly released</a>. Here’s a look at which devices are being targeted by this malware.</p>
<p>The malware, dubbed “<strong>Mirai</strong>,” spreads to vulnerable devices by continuously scanning the Internet for IoT systems protected by factory default usernames and passwords. Many readers have asked for more information about which devices and hardware makers were being targeted. As it happens, this is fairly easy to tell just from looking at the list of usernames and passwords included in the Mirai source code.</p>
<p><a href="media/7ec3ad67.iotbadpass-pdf.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/iotbadpass-pdf.png"><img class="aligncenter wp-image-36568 size-medium" src="media/7662305d.iotbadpass-pdf-580x375.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/iotbadpass-pdf-580x375.png" alt="iotbadpass-pdf" width="580" height="375" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/10/iotbadpass-pdf-580x375.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/10/iotbadpass-pdf-768x497.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/10/iotbadpass-pdf-940x608.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/10/iotbadpass-pdf.png 977w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>In all, there are 68 username and password pairs in the botnet source code. However, many of those are generic and used by dozens of products, including routers, security cameras, printers and digital video recorder (DVRs).</p>
<p>I examined the less generic credential pairs and tried to match each with a IoT device maker and device type.  As we can see from the spreadsheet above (also available in <a href="https://krebsonsecurity.com/wp-content/uploads/2016/10/IoTbadpass-Sheet1.csv" target="_blank">CSV</a> and <a href="media/776892af.IoTbadpass-Sheet1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/10/IoTbadpass-Sheet1.pdf" target="_blank">PDF</a>formats), most of the devices are network-based cameras, with a handful of Internet routers, DVRs and even printers sprinkled in.</p>
<p>I don’t claim to have special knowledge of each match, and welcome corrections if any of these are in error. Mainly, I turned to Google to determine which hardware makers used which credential pairs, but in some cases this wasn’t obvious or easy.</p>
<p>Which is part of the problem, says <strong>Will Dormann</strong>, senior vulnerability analyst at the <a href="https://en.wikipedia.org/wiki/CERT_Coordination_Center" target="_blank">CERT Coordination Center</a> (CERT/CC).</p>
<p>“Even when users are interested in and looking for this information, the vendor doesn’t always make it easy,” Dormann said.</p>
<p>Dormann said instead of hard-coding credentials or setting default usernames and passwords that many users will never change, hardware makers should require users to pick a strong password when setting up the device.</p>
<p>Indeed, according to <a href="https://ipvm.com/reports/ip-cameras-default-passwords-directory" target="_blank">this post</a> from video surveillance forum <strong>IPVM</strong>, several IoT device makers — including <strong>Hikvision</strong>, <strong>Samsung</strong>, and <strong>Panasonic</strong> — have begun to require unique passwords by default, with most forcing a mix of upper and lowercase letters, numbers, and special characters.</p>
<p>“As long as the password can’t be reversed — for example, an algorithm based off of a discoverable tidbit of information — that would be a reasonable level of security.” Dormann said.<span id="more-36566"></span></p>
<p>Some readers have asked how these various IoT devices could be exposed if users have configured them to operate behind wired or wireless routers. After all, these readers note, most consumer routers assign each device inside the user’s home network so-called <a href="http://computer.howstuffworks.com/nat.htm" target="_blank">Network Address Translation</a> (NAT) addresses that cannot be directly reached from the Internet.</p>
<p>But as several readers already commented in my previous story on the Mirai source code leak, many IoT devices will use a technology called <a href="https://en.wikipedia.org/wiki/Universal_Plug_and_Play" target="_blank">Universal Plug and Play</a> (UPnP) that will automatically open specific virtual portholes or “ports,” essentially poking a hole in the router’s shield for that device that allows it to be communicated with from the wider Internet. Anyone looking for an easy way to tell whether any of network ports may be open and listening for incoming external connections could do worse than to run <strong>Steve Gibson</strong>‘s <a href="https://www.grc.com/unpnp/unpnp.htm" target="_blank">“Shields Up” UPnP exposure test</a>.</p>
<h4>HELP! I NEVER CHANGED THE DEFAULT PASSWORD!</h4>
<p>Regardless of whether your device is listed above, if you own a wired or wireless router, IP camera or other device that has a Web interface and you haven’t yet changed the factory default credentials, your system may already be part of an IoT botnet. Unfortunately, there is no simple way to tell one way or the other whether it has been compromised.</p>
<p>However, the solution to eliminating and preventing infections from this malware isn’t super difficult. Mirai is loaded into memory, which means it gets wiped once the infected device is disconnected from its power source.</p>
<p>But as I noted in Saturday’s story, there is so much constant scanning going on for vulnerable systems that <em>IoT devices with default credentials can be re-infected within minutes of a reboot</em>. Only changing the default password protects them from rapidly being reinfected on reboot.</p>
<p>My advice for those running devices with the default credentials? First off, make sure you know how to access the device’s administration panel. If you’re unsure how to reach the administration panel, a quick search online for the make and model of your device should reveal an address and default credential pair that can be typed or pasted into a Web browser.</p>
<p>If possible, reset the device to the factory-default settings. This should ensure that if any malware has been uploaded to the device that it will be wiped permanently. Most devices have a small, recessed button that needs to be pressed and held down for a several seconds while powered on to reset the thing back to the factory default settings.</p>
<p>When the device comes back online, quickly fire up a Web browser, navigate to the administration panel, enter the default credentials, and then change the default password to something stronger and more memorable. I hope it goes without saying that any passwords remotely resembling the default passwords noted in the image above are horrible passwords.<a href="http://krebsonsecurity.com/password-dos-and-donts/" target="_blank">Here’s some advice</a> on picking better ones.</p>
<p>Unfortunately, many of these devices also require periodic software or “firmware” updates to fix previously unknown security vulnerabilities that the vendor discovers or that are reported to the hardware maker post-production.  However, relatively few hardware makers do a good job of making this process simple and easy for users, let alone alerting customers to the availability of firmware updates.</p>
<p>“When it comes to software updates, automatic updates are good,” Dormann said. “Simple updates that notify the user and require intervention are okay. Updates that require the user to dig around to find and install manually are next to worthless.  Devices that don’t have updates at all are completely worthless. And that can be applied to traditional computing as well.  It’s just that with IoT, you likely have even-less-technical users at the helm.”</p>
<p>Only after fixing any problems related to default credentials should readers consider checking for firmware updates. Some hardware makers include the ability to check for updates through a Web-based administration panel (like the one used to change the device’s default password), while others may only allow firmware updates manually via downloads from the manufacturer’s site.</p>
<p>Firmware updates can be tricky to install, because if you fail follow the manufacturer’s instructions to the letter you may end up with little more than an oversized paperweight. So if you decide to go ahead with any firmware updates, please do so carefully and deliberately.</p>


feed_id: https://krebsonsecurity.com/?p=36591
title: Feds Charge Two In Lizard Squad Investigation
uri: Feds-Charge-Two-In-Lizard-Squad-Investigation
url: https://krebsonsecurity.com/2016/10/feds-charge-two-in-lizard-squad-investigation/
content:
<p>The <strong>U.S. Justice Department</strong> has charged two 19-year-old men alleged to be core members of the hacking groups <strong>Lizard Squad</strong> and <strong>PoodleCorp</strong>. The pair are charged with credit card theft and operating so-called &#8220;booter&#8221;or &#8220;stresser&#8221; services that allowed paying customers to launch powerful attacks designed to knock Web sites offline.</p>
<div id="attachment_36594" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36594" src="media/c17c1626.poodlecorp-580x346.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/poodlecorp-580x346.png" alt="The PoodleCorp attack-for-hire service. Image: USDOJ." width="580" height="346" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/10/poodlecorp-580x346.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/10/poodlecorp-768x458.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/10/poodlecorp-940x560.png 940w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The PoodleCorp/PoodleStresser attack-for-hire service. Image: USDOJ.</p></div>
<p>Federal investigators charged <strong>Zachary Buchta</strong> of Fallston, Md., and <strong>Bradley Jan Willem Van Rooy</strong> of Leiden, the Netherlands with conspiring to cause damage to protected computers.</p>
<p>According to <a href="https://www.justice.gov/usao-ndil/pr/american-and-dutch-teenagers-arrested-criminal-charges-allegedly-operating" target="_blank">a statement</a> from the <strong>U.S. Attorney&#8217;s Office for the Northern District of Illinois</strong>, Buchta, &#8220;who used the online screen names “@fbiarelosers,” “pein,” “xotehpoodle” and “lizard,” and van Rooy, who used the names “Uchiha,” “@UchihaLS,” “dragon” and “fox,” also conspired with other members of Lizard Squad to operate websites that provided cyber-attack-for-hire services, facilitating thousands of denial-of-service attacks, and to traffic stolen payment card account information for thousands of victims.&#8221;</p>
<p>The PoodleCorp&#8217;s &#8220;Poodlestresser&#8221; attack-for-hire service appears to have drawn much of its firepower using an <a href="https://en.wikipedia.org/wiki/Application_programming_interface" target="_blank">application programming interface</a> (API) set up by the proprietors of vDOS &#8212; a similar attack service that went offline last month following <a href="https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/" target="_blank">the arrest of two 18-year-old Israeli men</a> who allegedly ran vDOS.</p>
<p>vDOS was <a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">hacked earlier this summer</a>, and a copy of the user database was shared with KrebsOnSecurity. The database indicates that Poodlestresser was among vDOS&#8217;s biggest clients, and that KrebsOnSecurity was a frequent target of the attack-for-hire services.<span id="more-36591"></span></p>
<p>Federal investigators allege that van Rooy and Buchta also operated a service called <strong>phonebomber[dot]net</strong>, a site that enabled paying customers to select victims to receive repeated harassing and threatening phone calls from spoofed phone numbers. The service, which cost $20 per month, would call the target number once per hour with pre-recorded messages. Here&#8217;s one of those messages, according to the Justice Department:</p>
<p>&#8220;When you walk the fucking streets, Motherfucker, you better look over your fucking back because I don’t flying fuck if we have to burn your fucking house down, if we have to fucking track your goddamned family down, we will fuck your shit up motherfuck.&#8221;</p>
<p>According to a<a href="https://www.justice.gov/usao-ndil/file/900826/download" target="_blank"> complaint</a> (PDF) filed by the United States Attorney for the Northern District of Illinois, at least one incarnation of the attack-for-hire services included a section where customers could purchase stolen credit cards.  The government alleges that the card shop contained approximately 347 pages of payment card data available for purchase with each page appearing to contain approximately ten records per page.</p>
<p>Buchta was arrested last month in Maryland and was slated to make an initial court appearance in Chicago on Wednesday. Authorities in the Netherlands arrested van Rooy last month and he remains in custody there. The conspiracy charge carries a maximum sentence of ten years in prison.</p>


feed_id: https://krebsonsecurity.com/?p=36602
title: Europe to Push New Security Rules Amid IoT Mess
uri: Europe-to-Push-New-Security-Rules-Amid-IoT-Mess
url: https://krebsonsecurity.com/2016/10/europe-to-push-new-security-rules-amid-iot-mess/
content:
<p>The <strong>European Commission</strong> is drafting new cybersecurity requirements to beef up security around so-called <strong>Internet of Things</strong> (IoT) devices such as Web-connected security cameras, routers and digital video recorders (DVRs). News of the expected proposal comes as security firms are warning that a great many IoT devices are equipped with little or no security protections.</p>
<p><img class="alignright wp-image-36612" src="media/d646240f.iotb2-580x562.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/iotb2-580x562.png" alt="iotb2" width="253" height="244" />According to <a href="https://www.euractiv.com/section/innovation-industry/news/commission-plans-cybersecurity-rules-for-internet-connected-machines/" target="_blank">a report</a> at <strong>Euractive.com</strong>, the Commission is planning the new IoT rules as part of a new plan to overhaul the European Union&#8217;s telecommunications laws. &#8220;The Commission would encourage companies to come up with a labeling system for internet-connected devices that are approved and secure,&#8221; wrote <strong>Catherine Stupp</strong>. &#8220;The EU labelling system that rates appliances based on how much energy they consume could be a template for the cybersecurity ratings.&#8221;</p>
<p>In last week&#8217;s piece, &#8220;<a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" target="_blank">Who Makes the IoT Things Under Attack?</a>,&#8221; I looked at which companies are responsible for IoT products being sought out by <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank">Mirai</a> &#8212; malware that scans the Internet for devices running default usernames and passwords and then forces vulnerable devices to participate in extremely powerful attacks designed to knock Web sites offline.</p>
<p>One of those default passwords &#8212; username: root and password: <strong>xc3511</strong> &#8212; is in a broad array of white-labeled DVR and IP camera electronics boards made by a Chinese company called <strong>XiongMai Technologies</strong>. These components are sold downstream to vendors who then use it in their own products.</p>
<p>That information comes in <a href="https://www.flashpoint-intel.com/when-vulnerabilities-travel-downstream/" target="_blank">an analysis</a> published this week by <strong>Flashpoint Intel</strong>, whose security analysts discovered that the Web-based administration page for devices made by this Chinese company (http://ipaddress/Login.htm) can be trivially bypassed without even supplying a username or password, just by navigating to a page called &#8220;DVR.htm&#8221; prior to login.</p>
<p>Worse still, even if owners of these IoT devices change the default credentials via the device&#8217;s Web interface, those machines can still be reached over the Internet via communications services called “<strong>Telnet</strong>” and “<strong>SSH</strong>.” These are command-line, text-based interfaces that are typically accessed via a command prompt (e.g., in <strong>Microsoft Windows</strong>, a user could click Start, and in the search box type “cmd.exe” to launch a command prompt, and then type “telnet” to reach a username and password prompt at the target host).</p>
<p><span class="pullquote pqleft">&#8220;The issue with these particular devices is that a user cannot feasibly change this password,&#8221; said Flashpoint&#8217;s <strong>Zach Wikholm</strong>. &#8220;The password is hardcoded into the firmware, and the tools necessary to disable it are not present.</span> Even worse, the web interface is not aware that these credentials even exist.&#8221;</p>
<p>Flashpoint&#8217;s researchers said they scanned the Internet on Oct. 6 for systems that showed signs of running the vulnerable hardware, and found more than 515,000 of them were vulnerable to the flaws they discovered.</p>
<p>Flashpoint says the majority of media coverage surrounding the Mirai attacks on KrebsOnSecurity and other targets has outed products made by Chinese hi-tech vendor Dahua as a primary source of compromised devices. Indeed, Dahua&#8217;s products were <a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" target="_blank">heavily represented</a> in the analysis I published last week.</p>
<p>For its part, Dahua appears to be downplaying the problem. On Thursday, Dahua published a <a href="http://www.cepro.com/article/dahua_addresses_recent_report_regarding_ddos_attack" target="_blank">carefully-worded statement</a> that took issue with a <em>Wall Street Journal</em> <a href="http://www.wsj.com/articles/hackers-infect-army-of-cameras-dvrs-for-massive-internet-attacks-1475179428" target="_blank">story</a> about the role of Dahua&#8217;s products in the Mirai botnet attacks.</p>
<p>&#8220;To clarify, Dahua Technology has maintained a B2B business model and sells its products through the channel,&#8221; the company said. &#8220;Currently in the North America market, we don’t sell our products directly to consumers and businesses through [our] website or retailers like Amazon. Amazon is not an approved Dahua distributor and we proactively conduct research to identify and take action against the unauthorized sale of our products. A list of authorized distributors is available <a href="http://www.dahuasecurity.com/en/us/best-practices.php" target="_blank">here</a>.&#8221;<span id="more-36602"></span></p>
<p>Dahua said the company&#8217;s investigation determined the devices that became part of the DDoS attack had one or more of these characteristics:</p>
<p>-The devices were using firmware dating prior to January 2015.<br />
-The devices were using the default user name and password.<br />
-The devices were exposed to the internet without the protection of an effective network firewall.</p>
<div id="attachment_36609" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36609" src="media/d6fc7cd0.iotlogin-580x228.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/iotlogin-580x228.png" alt="The default login page of Xiongmai Technologies “Netsurveillance” and “CMS” software. Image: Flashpoint." width="580" height="228" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/10/iotlogin-580x228.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/10/iotlogin-768x302.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/10/iotlogin-940x369.png 940w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The default login page of Xiongmai Technologies “Netsurveillance” and “CMS” software. Image: Flashpoint.</p></div>
<p>Dahua also said that to the best of the company&#8217;s knowledge, DDoS [distributed denial-of-service attacks] threats have not affected any Dahua-branded devices deployed or sold in North America.</p>
<p>Flashpoint&#8217;s<strong> </strong>Wikholm said his analysis of the Mirai infected nodes found differently, that in the United States Dahua makes up about 65% of the attacking sources (~3,000 Internet addresses in the US out of approximately 400,000 addresses total).</p>
<h4>ANALYSIS</h4>
<p>Dahau&#8217;s statement that devices which were enslaved as part of the DDoS botnet were likely operating under the default password is duplicitous, given that threats like Mirai spread via Telnet and because the default password can&#8217;t effectively be changed.</p>
<p>Dahua and other IoT makers who have gotten a free pass on security for years are about to discover that building virtually no security into their products is going to have consequences. It&#8217;s a fair bet that the European Commission&#8217;s promised IoT regulations will cost a handful of IoT hardware vendors plenty.</p>
<p>Also, in the past week I&#8217;ve heard from two different attorneys who are weighing whether to launch class-action lawsuits against IoT vendors who have been paying lip service to security over the years and have now created a massive security headache for the rest of the Internet.</p>
<p>I don&#8217;t normally think class-action lawsuits move the needle much, but in this case they seem justified because these companies are effectively dumping toxic waste onto the Internet. And make no mistake, these IoT things have quite a long half-life: A majority of them probably will remain in operation (i.e., connected to the Internet and insecure) for many years to come &#8212; unless and until their owners take them offline or manufacturers issue product recalls.</p>
<p>Perhaps Dahua is seeing the writing on the wall as well. In its statement this week, the company confirmed rumors reported by KrebsOnSecurity earlier, stating that it would offering replacement discounts as &#8220;a gesture of goodwill to customers who wish to replace pre-January 2015 models.&#8221; But it&#8217;s not clear yet whether and/or how end-users can take advantage of this offer, as the company maintains it does not sell to consumers directly. &#8220;Dealers can bring such products to an authorized Dahua dealer, where a technical evaluation will be performed to determine eligibility,&#8221; the IoT maker said.</p>
<p>In a post on Motherboard this week, security expert <strong>Bruce Schneier</strong> <a href="https://motherboard.vice.com/read/we-need-to-save-the-internet-from-the-internet-of-things" target="_blank">argued</a> that the universe of IoT things will largely remain insecure and open to compromise unless and until government steps in and fixes the problem.</p>
<p>&#8220;When we have market failures, government is the only solution,&#8221; Schneier wrote. &#8220;The government could impose security regulations on IoT manufacturers, forcing them to make their devices secure even though their customers don&#8217;t care. They could impose liabilities on manufacturers, allowing people like Brian Krebs to sue them. Any of these would raise the cost of insecurity and give companies incentives to spend money making their devices secure.&#8221;</p>
<p>I&#8217;m not planning on suing anyone related to these attacks, but I wonder what you think, dear reader? Are lawsuits and government regulations going to help mitigate the security threat from the 20 billion IoT devices that Gartner estimates will be plugged into the Internet by 2020? Sound off in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=36633
title: Microsoft: No More Pick-and-Choose Patching
uri: Microsoft-No-More-Pick-and-Choose-Patching
url: https://krebsonsecurity.com/2016/10/microsoft-no-more-pick-and-choose-patching/
content:
<p><strong>Adobe</strong> and <strong>Microsoft</strong> today each issued updates to fix critical security flaws in their products. Adobe&#8217;s got fixes for Acrobat and Flash Player ready. Microsoft&#8217;s patch bundle for October includes fixes for at least five separate &#8220;zero-day&#8221; vulnerabilities &#8212; dangerous flaws that attackers were already exploiting prior to today&#8217;s patch release. Also notable this month is that Microsoft is changing how it deploys security updates, removing the ability for Windows users to pick and choose which individual patches to install.</p>
<p><img class="alignright wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="197" height="206" />Zero-day vulnerabilities describe flaws that even the makers of the targeted software don&#8217;t know about before they start seeing the flaws exploited in the wild, meaning the vendor has &#8220;zero days&#8221; to fix the bugs.</p>
<p>According to security vendor <a href="https://blog.qualys.com/laws-of-vulnerabilities/2016/10/11/october-b-week-patch-tuesday-five-0-day-fixes" target="_blank">Qualys</a>, Patch Tuesday updates fix <a href="http://go.microsoft.com/fwlink/?LinkId=827591" target="_blank">zero-day</a> <a href="http://go.microsoft.com/fwlink/?LinkId=827592" target="_blank">bugs</a> in <strong>Internet Explorer</strong> and <strong>Edge </strong>&#8212; the default browsers on different versions of Windows. <a href="https://technet.microsoft.com/en-us/library/security/MS16-121.aspx" target="_blank">MS16-121</a> addresses <a href="http://go.microsoft.com/fwlink/?LinkId=828158" target="_blank">a zero-day</a> in <strong>Microsoft Office</strong>. Another zero-day <a href="http://go.microsoft.com/fwlink/?LinkId=827590" target="_blank">flaw</a> affects <strong>GDI+</strong> &#8212; a graphics component built into Windows that can be exploitable through the browser. <a href="https://technet.microsoft.com/en-us/library/security/ms16-126.aspx" target="_blank">The final zero-day</a> is present in the Internet Messaging component of Windows.</p>
<p>Starting this month, home and business Windows users will no longer be able to pick and choose which updates to install and which to leave for another time. For example, I&#8217;ve often advised home users to hold off on installing .NET updates until all other patches for the month are applied &#8212; reasoning that .NET updates are very large and in my experience have frequently been found to be the source of problems when applying huge numbers of patches simultaneously.</p>
<p>But that cafeteria-style patching goes out the&#8230;err&#8230;Windows with this month&#8217;s release. Microsoft made the announcement <a href="https://blogs.technet.microsoft.com/windowsitpro/2016/05/17/simplifying-updates-for-windows-7-and-8-1/" target="_blank">in May</a> of this year and <a href="https://blogs.technet.microsoft.com/windowsitpro/2016/08/15/further-simplifying-servicing-model-for-windows-7-and-windows-8-1/" target="_blank">revisited the subject</a> again in August to add more detail behind its decision:</p>
<blockquote><p>&#8220;Historically, we have released individual patches for these platforms, which allowed you to be selective with the updates you deployed,&#8221; wrote <strong>Nathan Mercer</strong>, a senior product marketing manager at Microsoft. &#8220;This resulted in fragmentation where different PCs could have a different set of updates installed leading to multiple potential problems:</p>
<ul>
<li>
<div>Various combinations caused sync and dependency errors and lower update quality</div>
</li>
<li>
<div>Testing complexity increased for enterprises</div>
</li>
<li>
<div>Scan times increased</div>
</li>
<li>
<div>Finding and applying the right patches became challenging</div>
</li>
<li>
<div>Customers encountered issues where a patch was already released, but because it was in limited distribution it was hard to find and apply proactively</div>
</li>
</ul>
<p>By moving to a rollup model, we bring a more consistent and simplified servicing experience to Windows 7 SP1 and 8.1, so that all supported versions of Windows follow a similar update servicing model. The new rollup model gives you fewer updates to manage, greater predictability, and higher quality updates. The outcome increases Windows operating system reliability, by eliminating update fragmentation and providing more proactive patches for known issues. Getting and staying current will also be easier with only one rollup update required. Rollups enable you to bring your systems up to date with fewer updates, and will minimize administrative overhead to install a large number of updates.&#8221;</p></blockquote>
<p><span class="il">Microsoft&#8217;s patch policy changes are slightly different for home versus business customers. Consumers on <strong>Windows 7 Service Pack 1</strong> and <strong>Windows 8.1</strong> will henceforth receive what Redmond is calling a &#8220;Monthly Rollup,&#8221; which addresses both security issues and reliability issues in a single update. The &#8220;Security-only updates&#8221; option &#8212; intended for enterprises and not available via Windows Update &#8212;  will only include new security patches that are released for that month. </span></p>
<p><span class="il"> What this means is that if any part of the patch bundle breaks, the only option is to remove the entire bundle (instead of the offending patch, as was previously possible). </span>I have no doubt this simplifies things for Microsoft and likely saves them a ton of money, but my concern is this will leave end-users unable to apply critical <span class="il">patches</span> simply due to a single <span class="il">patch</span> breaking something.<span id="more-36633"></span></p>
<p>It&#8217;s important to note that several update types won&#8217;t be included in a rollup, including those for Adobe Flash Player. As it happens, Adobe today issued <a href="https://helpx.adobe.com/security/products/flash-player/apsb16-32.html" target="_blank">an update</a> for its Flash Player browser plugin that fixes a dozen security vulnerabilities in the program. The company said it is currently not aware of any attempts to exploit these flaws in the wild (i.e., no zero-days in this month&#8217;s Flash patch).</p>
<p><img class="alignleft wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="179" height="153" />The latest update brings Flash to <em>v. 23.0.0.185</em> for Windows and Mac users alike. If you have Flash installed, you should update, hobble or remove Flash as soon as possible. To see which version of Flash your browser may have installed, check out <a href="http://www.adobe.com/software/flash/about/" target="_blank">this page</a>.</p>
<p>The smartest option is probably to ditch the program once and for all and significantly increase the security of your system in the process. I’ve got more on that approach (as well as slightly less radical solutions ) in <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">A Month Without Adobe Flash Player</a>.</p>
<p>If you choose to update, please do it today. The most recent versions of Flash should be available from <a href="https://www.adobe.com/products/flashplayer/distribution3.html" target="_blank">this Flash distribution page</a> or the <a href="https://get.adobe.com/flashplayer/" target="_blank">Flash home page.</a> Windows users who browse the Web with anything other than <strong>Internet Explorer</strong> may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.). <strong>Chrome </strong>and IE should auto-install the latest Flash version on browser restart (users may need to manually check for updates in and/or restart the browser to get the latest Flash version).</p>
<p>Finally, Adobe released security updates that correct a whopping 71 flaws in its <strong>PDF Reader</strong> and <strong>Acrobat</strong> products. If you use either of these software packages, please take a moment <a href="https://helpx.adobe.com/security/products/acrobat/apsb16-33.html" target="_blank">to update them</a>.</p>


feed_id: https://krebsonsecurity.com/?p=36622
title: IoT Devices as Proxies for Cybercrime
uri: IoT-Devices-as-Proxies-for-Cybercrime
url: https://krebsonsecurity.com/2016/10/iot-devices-as-proxies-for-cybercrime/
content:
<p>Multiple stories published here over the past few weeks have examined <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank">the disruptive power</a> of hacked &#8220;Internet of Things&#8221; (IoT) <a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" target="_blank">devices such as routers, IP cameras and digital video recorders</a>. This post looks at how crooks are using hacked IoT devices as proxies to hide their true location online as they engage in a variety of other types of cybercriminal activity &#8212; from frequenting underground forums to credit card and tax refund fraud.</p>
<p><img class="aligncenter size-medium wp-image-36655" src="media/66066241.networktechnicians-580x384.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians-580x384.png" alt="networktechnicians" width="580" height="384" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians-580x384.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians-768x508.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians-940x622.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians.png 1212w" sizes="(max-width: 580px) 100vw, 580px" />Recently, I heard from a cybersecurity researcher who&#8217;d created a virtual &#8220;honeypot&#8221; environment designed to simulate hackable IoT devices. The source, who asked to remain anonymous, said his honeypot soon began seeing traffic destined for <strong>Asus</strong> and <strong>Linksys</strong> routers running default credentials. When he examined what that traffic was designed to do, he found his honeypot systems were being told to download a piece of malware from a destination on the Web.</p>
<p>My source grabbed a copy of the malware, analyzed it, and discovered it had two basic functions: To announce to a set of Internet addresses hard-coded in the malware a registration &#8220;I&#8217;m here&#8221; beacon; and to listen for incoming commands, such as scanning for new vulnerable hosts or running additional malware. He then wrote a script to simulate the hourly &#8220;I&#8217;m here&#8221; beacons, interpret any &#8220;download&#8221; commands, and then execute the download and &#8220;run&#8221; commands.</p>
<p>The researcher found that the malware being pushed to his honeypot system was designed to turn his faux infected router into a &#8220;<a href="https://en.wikipedia.org/wiki/SOCKS" target="_blank">SOCKS proxy server</a>,&#8221; essentially a host designed to route traffic between a client and a server. Most often, SOCKS proxies are used to anonymize communications because they can help obfuscate the true origin of the client that is using the SOCKS server.</p>
<p><img class="aligncenter size-full wp-image-31323" src="media/dadfaa21.proxy.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/proxy.png" alt="proxy" width="416" height="174" /></p>
<p>When he realized how his system was being used, my source fired up several more virtual honeypots, and repeated the process. Employing a custom tool that allows the user to intercept (a.k.a. &#8220;man-in-the-middle&#8221;) encrypted SSL traffic, the researcher was able to collect the underlying encrypted data passing through his SOCKS servers and decrypt it.</p>
<p>What he observed was that all of the systems were being used for a variety of badness, from proxying Web traffic destined for cybercrime forums to testing stolen credit cards at merchant Web sites. <em>Further study of the malware files and the traffic beacons emanating from the honeypot systems indicated his honeypots were being marketed on a Web-based criminal service that sells access to SOCKS proxies in exchange for <strong>Bitcoin</strong>.</em></p>
<p>Unfortunately, this type of criminal proxying is hardly new. Crooks have been using hacked PCs to proxy their traffic for eons. KrebsOnSecurity has featured numerous stories about cybercrime services that <a href="https://krebsonsecurity.com/2013/12/hacked-via-rdp-really-dumb-passwords/" target="_blank">sell access</a> to <a href="https://krebsonsecurity.com/2011/04/is-your-computer-listed-for-rent/" target="_blank">hacked computers</a> as a means of helping thieves anonymize their nefarious activities online.<span id="more-36622"></span></p>
<p>And while the activity that my source witnessed with his honeypot project targeted ill-secured Internet routers, there is no reason the same type of proxying could not be done via other default-insecure IoT devices, such as Internet-based security cameras and digital video recorders.</p>
<p>Indeed, my guess is that this is exactly how these other types of hacked IoT devices are being used right now (in addition to being forced to participate in launching <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">huge denial-of-service attacks</a> against targets that criminals wish to knock offline).</p>
<p>&#8220;In a way, this feels like 1995-2000 with computers,&#8221; my source told me. &#8220;Devices were getting online, antivirus wasn&#8217;t as prevalent, and people didn&#8217;t know an average person&#8217;s computer could be enslaved to do something else. The difference now is, the number of vendors and devices has proliferated, and there is an underground ecosystem with the expertise to fuzz, exploit, write the custom software. Plus, what one person does can be easily shared to a small group or to the whole world.&#8221;</p>
<h4>ROUTER SECURITY 101</h4>
<p>As I wrote last week on <a href="https://krebsonsecurity.com/2016/10/europe-to-push-new-security-rules-amid-iot-mess/" target="_blank">the lingering and coming IoT security mess</a>, a great many IoT devices are equipped with <a href="http://news.softpedia.com/news/avtech-shuns-security-firm-and-leaves-all-products-vulnerable-without-a-patch-509223.shtml" target="_blank">little or no</a> security protections. On a large number of Internet-connected DVRs and IP cameras, changing the default passwords on the device&#8217;s Web-based administration panel does little to actually change the credentials hard-coded into the devices.</p>
<p>Routers, on the other hand, generally have a bit more security built in, but users still need to take several steps to harden these devices out-of-the-box.</p>
<p>For starters, make sure to change the default credentials on the router. This is the username and password pair that was factory installed by the router maker. The administrative page of most commercial routers can be accessed by typing 192.168.1.1, or 192.168.0.1 into a Web browser address bar. If neither of those work, try looking up the documentation at the router maker’s site, or checking to see if the address is listed <a title="http://www.techspot.com/guides/287-default-router-ip-addresses/" href="http://www.techspot.com/guides/287-default-router-ip-addresses/" target="_blank">here</a>. If you still can’t find it, open the command prompt (Start &gt; Run/or Search for “cmd”) and then enter <em>ipconfig</em>. The address you need should be next to Default Gateway under your Local Area Connection.</p>
<p>If you don’t know your router’s default username and password, you can look it up <a title="http://www.routerpasswords.com/" href="http://www.routerpasswords.com/" target="_blank">here</a>. Leaving these as-is out-of-the-box is a very bad idea. Most modern routers will let you change both the default user name and password, so do both if you can. But it’s most important to pick <a title="http://krebsonsecurity.com/password-dos-and-donts/" href="http://krebsonsecurity.com/password-dos-and-donts/" target="_blank">a strong password</a>.</p>
<p>When you’ve changed the default password, you’ll want to encrypt your connection if you’re using a wireless router (one that broadcasts your modem’s Internet connection so that it can be accessed via wireless devices, like tablets and smart phones). Onguardonline.gov has <a title="http://www.onguardonline.gov/articles/0013-securing-your-wireless-network" href="http://www.onguardonline.gov/articles/0013-securing-your-wireless-network" target="_blank">published some video how-tos</a> on enabling wireless encryption on your router. <strong>WPA2</strong> is the strongest encryption technology available in most modern routers, followed by <strong>WPA</strong> and <strong>WEP</strong> (the latter is fairly trivial to crack with open source tools, so don’t use it unless it’s your only option).</p>
<p>But even users who have a strong router password and have protected their wireless Internet connection with a strong WPA2 passphrase may have the security of their routers undermined by security flaws built into these routers. At issue is a technology called “Wi-Fi Protected Setup” (<strong>WPS</strong>) that ships with many routers marketed to consumers and small businesses. According to the <a title="Wi-Fi.org" href="http://www.wi-fi.org/wifi-protected-setup/" target="_blank">Wi-Fi Alliance</a>, an industry group, WPS is “designed to ease the task of setting up and configuring security on wireless local area networks. WPS enables typical users who possess little understanding of traditional Wi-Fi configuration and security settings to automatically configure new wireless networks, add new devices and enable security.”</p>
<p>However, WPS also may expose routers to easy compromise. Read more about this vulnerability <a title="http://krebsonsecurity.com/2011/12/new-tools-bypass-wireless-router-security/" href="http://krebsonsecurity.com/2011/12/new-tools-bypass-wireless-router-security/" target="_blank">here</a>. If your router is among those listed as vulnerable, see if you can disable WPS from the router’s administration page. If you’re not sure whether it can be, or if you’d like to see whether your router maker has shipped an update to fix the WPS problem on their hardware, check <a title="https://docs.google.com/spreadsheet/lv?key=0Ags-JmeLMFP2dFp2dkhJZGIxTTFkdFpEUDNSSHZEN3c" href="https://docs.google.com/spreadsheet/lv?key=0Ags-JmeLMFP2dFp2dkhJZGIxTTFkdFpEUDNSSHZEN3c" target="_blank">this spreadsheet</a>.</p>
<p>Finally, the hardware inside consumer routers is controlled by software known as &#8220;firmware,&#8221; and occasionally the companies that make these products ship updates for their firmware to correct security and stability issues. When you&#8217;re logged in to the administrative panel, if your router prompts you to update the firmware, it&#8217;s a good idea to take care of that at some point. If and when you decide to take this step, please be sure to follow the manufacturer&#8217;s instructions to the letter: Failing to do so could leave you with an oversized and expensive paperweight.</p>
<p>Personally, I never run the stock firmware that ships with these devices. Over the years, I&#8217;ve replaced the firmware in various routers I purchased with an open source alternative, such as <a title="http://www.dd-wrt.com/site/index" href="http://www.dd-wrt.com/site/index" target="_blank">DD-WRT</a> (my favorite) or <a title="http://www.polarcloud.com/tomato" href="http://www.polarcloud.com/tomato" target="_blank">Tomato</a>. These flavors generally are more secure and offer a much broader array of options and configurations. Again, though, before you embark on swapping out your router&#8217;s stock firmware with an open source alternative, take the time to research whether your router model is compatible, and that you understand and carefully observe all of the instructions involved in updating the firmware.</p>
<p>Since October is officially National Cybersecurity Awareness Month, it probably makes sense to note that the above tips on router security come directly from a piece I wrote a while back called <a href="http://krebsonsecurity.com/tools-for-a-safer-pc/" target="_blank">Tools for a Safer PC</a>, which includes a number of other suggestions to help beef up your personal and network security.</p>
<div></div>


feed_id: https://krebsonsecurity.com/?p=36631
title: Self-Checkout Skimmers Go Bluetooth
uri: Self-Checkout-Skimmers-Go-Bluetooth
url: https://krebsonsecurity.com/2016/10/self-checkout-skimmers-go-bluetooth/
content:
<p>This blog has featured several stories about payment card <a href="https://krebsonsecurity.com/?s=self-checkout&amp;x=0&amp;y=0" target="_blank">skimming devices</a> designed to be placed over top of credit card terminals in self-checkout lanes at grocery stores and other retailers. Many readers have asked for more details about the electronics that power these so-called &#8220;overlay&#8221; skimmers. Here&#8217;s a look at one overlay skimmer  equipped with Bluetooth technology that allows thieves to snarf swiped card data and PINs wirelessly using nothing more than a mobile phone.</p>
<p>The rather crude video below shows a Bluetooth enabled overlay skimmer crafted to be slipped directly over top of <strong>Ingenico iSC250</strong> credit card terminals. These Ingenico terminals are widely used at countless U.S. based merchants; earlier this year I wrote about Ingenico overlay skimmers being found in self-checkout lanes <a href="http://krebsonsecurity.com/2016/05/skimmers-found-at-walmart-a-closer-look/" target="_blank">at some WalMart locations</a>.</p>
<div align="center"><iframe src="http://www.youtube.com/embed/6hJ3zWB7hCo" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>The demo video briefly shows the electronics hidden on the back side of the overlay skimmer, but most of the sales video demonstrates the Bluetooth functionality built into the device. The video appears to show the skimmer seller connecting his mobile phone to the Bluetooth elements embedded in the skimmer. The demo continues on to show the phone intercepting PIN pad presses and card swipe data.<span id="more-36631"></span></p>
<p>Your basic Bluetooth signal has a range of approximately 100 meters (328 feet), so theoretically skimmer scammers who placed one of these devices over top of a card terminal in a store&#8217;s self-checkout lane could simply sit in a vehicle parked outside the storefront and suck down card data wirelessly in real-time. However, that kind of continuous communication likely would place undue strain on the skimmer&#8217;s internal battery, thus dramatically decreasing the length of time the skimmer could collect card and PIN data before needed a new battery.</p>
<p>Rather, such a skimmer would most likely be configured to store the stolen PIN and card data until such time as its owner skulks within range of the device and instructs it to transmit the stored card data.</p>
<p>Concerned about whether the Ingenico terminals at your favorite store may be compromised by one of these overlay skimmers? Turns out, payment terminals retrofitted with overlay skimmers have quite a few giveaways if you know what to look for. Learn how to identify one, by checking out my tutorial, <a href="https://krebsonsecurity.com/2016/06/how-to-spot-ingenico-self-checkout-skimmers/" target="_blank">How to Spot Ingenico Self-Checkout Skimmers</a>.</p>
<p>If you liked this piece, have a look at the other skimmer stories in my series, <a href="https://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers</a>. And if you&#8217;re curious about how card data stolen through skimmers like these are typically sold, <a href="https://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/" target="_blank">take a peek inside a professional carding shop</a>.</p>
<div id="attachment_35287" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-35287" src="media/ba0deede.redcalipers-580x326.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/redcalipers-580x326.png" alt="The red calipers in the image above show the size differences in various noticeable areas of the case overlay on the left compared to the actual ISC250 on the right. Source: Ingenico." width="580" height="326" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/redcalipers-580x326.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/redcalipers-768x431.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/06/redcalipers-940x528.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/06/redcalipers.png 1318w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The red calipers in the image above show the size differences in various noticeable areas of the case overlay on the left compared to the actual ISC250 on the right. Source: Ingenico.</p></div>
<p>Thanks to Alex Holden of Hold Security LLC for sharing the above video footage.</p>


feed_id: https://krebsonsecurity.com/?p=36672
title: Hackers Hit U.S. Senate GOP Committee
uri: Hackers-Hit-U-S-Senate-GOP-Committee
url: https://krebsonsecurity.com/2016/10/hackers-hit-u-s-senate-gop-committee/
content:
<p>The national news media has been consumed of late with <a href="https://news.google.com/news/story?ncl=d60t_FUiY4Ds8fMs8hoZy1xjq548M&amp;q=dnc+hack&amp;lr=English&amp;hl=en&amp;sa=X&amp;ved=0ahUKEwialbHRgNvPAhWJGR4KHQDHDbkQqgIIODAG" target="_blank">reports</a> of Russian hackers breaking into networks of the <strong>Democratic National Committee</strong>. Lest the Republicans feel left out of all the excitement, a report this past week out of The Netherlands suggests Russian hackers have for the past six months been siphoning credit card data from visitors to the Web storefront of the <strong>National Republican Senatorial Committee</strong> (NRSC).</p>
<p><img class="alignright  wp-image-36702" src="media/1295f0d3.nrsc.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/nrsc.png" alt="nrsc" width="257" height="123" />That&#8217;s right: If you purchased a &#8220;Never Hillary&#8221; poster or donated funds to the NRSC through <a href="http://www.nrsc.org/" target="_blank">its Web site</a> between March 2016 and the first week of this month, there&#8217;s an excellent chance that your payment card data was siphoned by malware and is now for sale in the cybercrime underground.</p>
<p>News of the break-in comes from Dutch researcher <strong>Willem De Groot</strong>, co-founder and head of security at Dutch e-commerce site <a href="http://byte.nl" target="_blank">byte.nl</a>. De Groot said <em>the NRSC was one of more than 5,900 e-commerce sites apparently hacked by the same actors</em>, and that the purloined card data was sent to a network of servers operated by a Russian-language Internet service provider incorporated in Belize.</p>
<p>De Groot said he dissected the malware planted on the NRSC&#8217;s site and other servers (his analysis of the malware is available <a href="https://gist.github.com/gwillem/3c3f566278ac01a290560f64129d3df0" target="_blank">here</a>) and found that the hackers used security vulnerabilities or weak passwords to break in to the various e-commerce sites.</p>
<p>The researcher found the malware called home to specific Web destinations made to look like legitimate sites associated with e-commerce activity, such as jquery-cloud[dot]net, visa-cdn[dot]com, and magento-connection[dot]com.</p>
<p>&#8220;[The attackers] really went out of their way to pick domain names that look legitimate,&#8221; De Groot said.</p>
<p>The NRSC did not respond to multiple requests for comment, but <a href="https://web.archive.org/web/20160316195340/https://store.nrsc.org/" target="_blank">a cached copy of the site&#8217;s source code</a> from October 5, 2016 indicates the malicious code was on the site at the time (load <a href="https://web.archive.org/web/20160316195340/https://store.nrsc.org/" target="_blank">this link</a>, click &#8220;view source&#8221; and then Ctrl-F for &#8220;jquery-cloud.net&#8221;).</p>
<p>A majority of the malicious domains inserted into the hacked sites by the malware map back to a few hundred Internet addresses assigned to a company called <strong>dataflow[dot]su</strong>.</p>
<p>Dataflow markets itself as an &#8220;offshore&#8221; hosting provider with presences in Belize and The Seychelles. Dataflow has long been advertised on Russian-language cybercrime forums as an offshore haven that offers so-called &#8220;<a href="http://krebsonsecurity.com/?s=bulletproof&amp;x=0&amp;y=0" target="_blank">bulletproof hosting</a>,&#8221; a phrase used to describe hosting firms that court all manner of sites that most legitimate hosting firms shun, including those that knowingly host spam and phishing sites as well as malicious software.</p>
<p>De Groot published <a href="http://ipv4info.com/domains-in-block/s666949/80.87.205.0-80.87.205.255.html" target="_blank">a list of the sites</a> currently present at Dataflow. The list speaks for itself as a collection of badness, including quite a number of Russian-language sites selling synthetic drugs and stolen credit card data.</p>
<p>According to De Groot, other sites that were retrofitted with the malware included e-commerce sites for the shoe maker <strong>Converse</strong> as well as the automaker <strong>Audi</strong>, although he says those sites and the NRSC&#8217;s have been scrubbed of the malicious software since his report was published.<span id="more-36672"></span></p>
<p>But De Groot said the hackers behind this scheme are continuing to find new sites to compromise.</p>
<p>&#8220;Last Monday my scans found about 5,900 hacked sites,&#8221; he said. &#8220;When I did another scan two days later, I found about 340 of those had been fixed, but that another 170 were newly compromised.&#8221;</p>
<p>According to <a href="https://gwillem.gitlab.io/2016/10/04/how-republicans-send-your-credit-card-to-russia/" target="_blank">the researcher&#8217;s analysis</a>, many of the hacked sites are running outdated e-commerce software or content management software. In other cases, it appears the attackers simply brute-forced or guessed passwords needed to administer the sites.</p>
<p>Further, he said, the attackers appear to have inserted their malware into the e-commerce sites&#8217; databases, rather than into the portion of the Web server used to store HTML and other components that make up how the site looks to visitors</p>
<p>&#8220;That’s why I think this has remained under the radar for a while now,&#8221; De Groot said. &#8220;Because some companies use filesystem checkers so that if some file changes on the system they will get a notice that alerts them something is wrong.&#8221;</p>
<p>Unfortunately, those same checking systems generally aren&#8217;t configured to look for changes in the site&#8217;s database files, he explained, since those are expected to change constantly &#8212; such as when a new customer order for merchandise is added.<!--more--></p>
<p>De Groot said he was amazed at how many e-commerce merchants he approached about the hack dismissed the intrusion, reasoning that they employed secure sockets layer (SSL) technology that encrypted the customers&#8217; information end-to-end.</p>
<p>What many Webmaster fail to realize is that just as PC-baed trojan horse programs can steal data from Web browsers of infected victims, Web-based keylogging programs can do the same, except they&#8217;re designed to steal data from Web server applications.</p>
<p>PC Trojans siphon information using two major techniques: snarfing passwords stored in the browser, and conducting “form grabbing” — capturing any data entered into a form field in the browser before it can be encrypted in the Web session and sent to whatever site the victim is visiting.</p>
<p>Web-based keyloggers also can do form grabbing, ripping out form data submitted by visitors — including names, addresses, phone numbers, credit card numbers and card verification code — as customers are submitting the data during the online checkout process.</p>
<p>These attacks drive home one immutable point about malware’s role in subverting secure connections: Whether resident on a Web server or on an end-user computer, if either endpoint is compromised, it’s ‘game over’ for the security of that Web session.</p>
<p>With PC banking trojans, it’s all about surveillance on the client side pre-encryption, whereas what the bad guys are doing with these Web site attacks involves sucking down customer data post- or pre-encryption (depending on whether the data was incoming or outgoing).</p>


