# articles

feed_id: https://krebsonsecurity.com/?p=48710
title: Breach at Hy-Vee Supermarket Chain Tied to Sale of 5M+ Stolen Credit, Debit Cards
uri: Breach-at-Hy-Vee-Supermarket-Chain-Tied-to-Sale-of-5M-Stolen-Credit
url:
https://krebsonsecurity.com/2019/08/breach-at-hy-vee-supermarket-chain-tied-to-sale-of-5m-stolen-credit-debit-cards/

content:
<p>On Tuesday of this week, one of the more popular underground stores peddling credit and debit card data stolen from hacked merchants announced a blockbuster new sale: More than 5.3 million new accounts belonging to cardholders from 35 U.S. states. Multiple sources now tell KrebsOnSecurity that the card data came from compromised gas pumps, coffee shops and restaurants operated by <strong>Hy-Vee</strong>, an Iowa-based company that operates a chain of more than 245 supermarkets throughout the Midwestern United States.</p>
<p><img class="aligncenter wp-image-48714" src="media/4724b26d.hyvee.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/hyvee.png" alt="" width="596" height="285" /></p>
<p>Hy-Vee, based in Des Moines, <a href="https://www.hy-vee.com/corporate/news-events/announcements/notice-of-payment-card-data-incident/" target="_blank" rel="noopener">announced</a> on Aug. 14 it was investigating a data breach involving payment processing systems that handle transactions at some Hy-Vee fuel pumps, drive-thru coffee shops and restaurants.</p>
<p>The restaurants affected include Hy-Vee <a href="https://marketgrille.hy-vee.com/locations/" target="_blank" rel="noopener">Market Grilles</a>, Market Grille Expresses and <a href="https://wahlburgers.com/all-locations" target="_blank" rel="noopener">Wahlburgers</a> locations that the company owns and operates. Hy-Vee said it was too early to tell when the breach initially began or for how long intruders were inside their payment systems.</p>
<p>But typically, such breaches occur when cybercriminals manage to remotely install malicious software on a retailer&#8217;s card-processing systems. This type of point-of-sale malware is capable of copying data stored on a credit or debit card&#8217;s magnetic stripe when those cards are swiped at compromised payment terminals. This data can then be used to create counterfeit copies of the cards.</p>
<p>Hy-Vee said it believes the breach does not affect payment card terminals used at its grocery store checkout lanes, pharmacies or convenience stores, as these systems rely on a security technology designed to defeat card-skimming malware.</p>
<p>&#8220;These locations have different point-of-sale systems than those located at our grocery stores, drugstores and inside our convenience stores, which utilize point-to-point encryption technology for processing payment card transactions,&#8221; Hy-Vee said. &#8220;This encryption technology protects card data by making it unreadable. Based on our preliminary investigation, we believe payment card transactions that were swiped or inserted on these systems, which are utilized at our front-end checkout lanes, pharmacies, customer service counters, wine &amp; spirits locations, floral departments, clinics and all other food service areas, as well as transactions processed through Aisles Online, are not involved.&#8221;</p>
<p>According to two sources who asked not to be identified for this story &#8212; including one at a major U.S. financial institution &#8212; the card data stolen from Hy-Vee is now being sold under the code name &#8220;Solar Energy,&#8221; at <a href="https://krebsonsecurity.com/?s=joker%27s+stash&amp;x=0&amp;y=0" target="_blank" rel="noopener">the infamous Joker&#8217;s Stash carding bazaar</a>.</p>
<div id="attachment_48715" style="width: 604px" class="wp-caption aligncenter"><img class=" wp-image-48715" src="media/f94c153a.jstash-solar1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/jstash-solar1.png" alt="" width="594" height="401" /><p class="wp-caption-text">An ad at the Joker&#8217;s Stash carding site for &#8220;Solar Energy,&#8221; a batch of more than 5 million credit and debit cards sources say was stolen from customers of supermarket chain Hy-Vee.</p></div>
<p>Hy-Vee said the company&#8217;s investigation is continuing.</p>
<p>&#8220;We are aware of reports from payment processors and the card networks of payment data being offered for sale and are working with the payment card networks so that they can identify the cards and work with issuing banks to initiate heightened monitoring on accounts,&#8221; Hy-Vee spokesperson Tina Pothoff said.<span id="more-48710"></span></p>
<p>The card account records sold by Joker&#8217;s Stash, known as &#8220;dumps,&#8221; apparently stolen from Hy-Vee are being sold for prices ranging from $17 to $35 apiece. Buyers typically receive a text file that includes all of their dumps. Those individual dumps records — when encoded onto a new magnetic stripe on virtually anything the size of a credit card — can be used to purchase stolen merchandise in big box stores.</p>
<p>As noted in <a href="https://krebsonsecurity.com/2017/12/4-years-after-target-the-little-guy-is-the-target/" target="_blank" rel="noopener">previous stories here</a>, the organized cyberthieves involved in stealing card data from main street merchants have gradually moved down the food chain from big box retailers like Target and Home Deport to smaller but far more plentiful and probably less secure merchants (either by choice or because the larger stores became a harder target).</p>
<p>It’s really not worth spending time worrying about where your card number may have been breached, <a href="https://krebsonsecurity.com/2015/01/how-was-your-credit-card-stolen/" target="_blank" rel="noopener">since it’s almost always impossible to say for sure</a> and because it’s common for the same card to be breached at multiple establishments during the same time period.</p>
<p>Just remember that while consumers are not liable for fraudulent charges, it may still fall to you the consumer to spot and report any suspicious charges. So keep a close eye on your statements, and consider signing up for text message notifications of new charges if your card issuer offers this service. Most of these services also can be set to alert you if you’re about to miss an upcoming payment, so they can also be handy for avoiding late fees and other costly charges.</p>


feed_id: https://krebsonsecurity.com/?p=48736
title: Cybersecurity Firm Imperva Discloses Breach
uri: Cybersecurity-Firm-Imperva-Discloses-Breach
url: https://krebsonsecurity.com/2019/08/cybersecurity-firm-imperva-discloses-breach/
content:
<p><strong>Imperva</strong>, a leading provider of Internet firewall services that help Web sites block malicious cyberattacks, alerted customers on Tuesday that a recent data breach exposed email addresses, scrambled passwords, <a href="https://en.wikipedia.org/wiki/Application_programming_interface" target="_blank" rel="noopener">API keys</a> and <a href="https://en.wikipedia.org/wiki/Transport_Layer_Security" target="_blank" rel="noopener">SSL certificates</a> for a subset of its firewall users.</p>
<p>Redwood Shores, Calif.-based Imperva sells technology and services designed to detect and block various types of malicious Web traffic, from denial-of-service attacks to digital probes aimed at undermining the security of Web-based software applications.</p>
<div id="attachment_48740" style="width: 606px" class="wp-caption aligncenter"><img class=" wp-image-48740" src="media/6fbb871d.incapcloud.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/incapcloud.png" alt="" width="596" height="343" /><p class="wp-caption-text">Image: Imperva</p></div>
<p>Earlier today, Imperva told customers that it learned on Aug. 20 about a security incident that exposed sensitive information for some users of <strong>Incapsula</strong>, the company&#8217;s cloud-based <strong>Web Application Firewall</strong> (WAF) product.</p>
<p>&#8220;On August 20, 2019, we learned from a third party of a data exposure that impacts a subset of customers of our Cloud WAF product who had accounts through September 15, 2017,&#8221; wrote <strong>Heli Erickson</strong>, director of analyst relations at Imperva.</p>
<p>&#8220;We want to be very clear that this data exposure is limited to our Cloud WAF product,&#8221; Erickson&#8217;s message continued. &#8220;While the situation remains under investigation, what we know today is that elements of our Incapsula customer database from 2017, including email addresses and hashed and salted passwords, and, for a subset of the Incapsula customers from 2017, API keys and customer-provided SSL certificates, were exposed.&#8221;</p>
<p>Companies that use the Incapsula WAF route all of their Web site traffic through the service, which scrubs the communications for any suspicious activity or attacks and then forwards the benign traffic on to its intended destination.</p>
<p><strong>Rich Mogull</strong>, founder and vice president of product at Kansas City-based cloud security firm <a href="https://disruptops.com/" target="_blank" rel="noopener">DisruptOps</a>, said Imperva is among the top three Web-based firewall providers in business today.</p>
<p>According to Mogull, an attacker in possession of a customer&#8217;s API keys and SSL certificates could use that access to significantly undermine the security of traffic flowing to and from a customer&#8217;s various Web sites.</p>
<p>At a minimum, he said, an attacker in possession of these key assets could reduce the security of the WAF settings and exempt or &#8220;whitelist&#8221; from the WAF&#8217;s scrubbing technology any traffic coming from the attacker. A worst-case scenario could allow an attacker to intercept, view or modify traffic destined for an Incapsula client Web site, and even to divert all traffic for that site to or through a site owned by the attacker.<span id="more-48736"></span></p>
<p>&#8220;Attackers could whitelist themselves and begin attacking the site without the WAF&#8217;s protection,&#8221; Mogull told KrebsOnSecurity. &#8220;They could modify any of the security Incapsula security settings, and if they got [the target&#8217;s SSL] certificate, that can potentially expose traffic. <span class="pullquote pqleft">For a security-as-a-service provider like Imperva, this is the kind of mistake that&#8217;s up their with their worst nightmare.&#8221;</span></p>
<p>Imperva urged all of its customers to take several steps that might mitigate the threat from the data exposure, such as changing passwords for user accounts at Incapsula, enabling multi-factor authentication, resetting API keys, and generating/uploading new SSL certificates.</p>
<p><strong>Alissa Knight</strong>, a senior analyst at <a href="https://www.aitegroup.com/" target="_blank" rel="noopener">Aite Group</a>, said the exposure of Incapsula users&#8217; scrambled passwords and email addresses was almost incidental given that the intruders also made off with customer API keys and SSL certificates.</p>
<p>Knight said although we don&#8217;t yet know the cause of this incident, such breaches at cloud-based firms often come down to small but ultimately significant security failures on the part of the provider.</p>
<p>&#8220;The moral of the story here is that people need to be asking tough questions of software-as-a-service firms they rely upon, because those vendors are being trusted with the keys to the kingdom,&#8221; Knight said. &#8220;Even if the vendor in question is a cybersecurity company, it doesn&#8217;t necessarily mean they&#8217;re eating their own dog food.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=48773
title: Ransomware Bites Dental Data Backup Firm
uri: Ransomware-Bites-Dental-Data-Backup-Firm
url: https://krebsonsecurity.com/2019/08/ransomware-bites-dental-data-backup-firm/
content:
<p><strong>PerCSoft</strong>, a Wisconsin-based company that manages a remote data backup service relied upon by hundreds of dental offices across the country, is struggling to restore access to client systems after falling victim to a ransomware attack.</p>
<p><img class="aligncenter  wp-image-48776" src="media/b1cefd86.dds-home.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/dds-home.png" alt="" width="593" height="271" /></p>
<p>West Allis, Wis.-based <a href="http://www.percsoft.com/" target="_blank" rel="noopener">PerCSoft</a> is a cloud management provider for <a href="https://www.dentalrecord.com/" target="_blank" rel="noopener">Digital Dental Record</a> (DDR), which operates an online data backup service called <strong>DDS Safe</strong> that archives medical records, charts, insurance documents and other personal information for various dental offices across the United States.</p>
<p>The ransomware attack hit PerCSoft on the morning of Monday, Aug. 26, and encrypted dental records for some &#8212; but not all &#8212; of the practices that rely on DDS Safe.</p>
<p>PercSoft did not respond to requests for comment. But <strong>Brenna Sadler</strong>, director of  communications for the <strong>Wisconsin Dental Association</strong>, said the ransomware encrypted files for approximate 400 dental practices, and that somewhere between 80-100 of those clients have now had their files restored.</p>
<p>Sadler said she did not know whether PerCSoft and/or DDR had paid the ransom demand, what ransomware strain was involved, or how much the attackers had demanded.</p>
<p>But updates to <a href="https://www.facebook.com/percsoft/" target="_blank" rel="noopener">PerCSoft&#8217;s Facebook page</a> and <a href="media/b3da7007.UpdateDDSSafe7.pdf" data-original-source="https://www.dentalrecord.com/assets/images/UpdateDDSSafe7.pdf" target="_blank" rel="noopener">statements published by both PerCSoft and DDR</a> suggest someone may have paid up: The statements note that both companies worked with a third party software company and were able to obtain a decryptor to help clients regain access to files that were locked by the ransomware.</p>
<p>However, some affected dental offices have reported that the decryptor did not work to unlock at least some of the files encrypted by the ransomware. Meanwhile, several affected dentistry practices said they feared they might be unable to process payroll payments this week as a result of the attack.<span id="more-48773"></span></p>
<p>Cloud data and backup services are a prime target of cybercriminals who deploy ransomware. In July, attackers <a href="https://krebsonsecurity.com/?s=insynq&amp;x=0&amp;y=0" target="_blank" rel="noopener">hit QuickBooks cloud hosting firm iNSYNQ</a>, holding data hostage for many of the company&#8217;s clients. In February, cloud payroll data provider <strong>Apex Human Capital Management</strong> was <a href="https://krebsonsecurity.com/2019/02/payroll-provider-gives-extortionists-a-payday/" target="_blank" rel="noopener">knocked offline for three days</a> following a ransomware infestation.</p>
<p>On Christmas Eve 2018, cloud hosting provider <strong>Dataresolution.net</strong> <a href="https://krebsonsecurity.com/2019/01/cloud-hosting-provider-dataresolution-net-battling-christmas-eve-ransomware-attack/" target="_blank" rel="noopener">took its systems offline</a> in response to a ransomware outbreak on its internal networks. The company was adamant that it would not pay the ransom demand, but it ended up taking several weeks for customers to fully regain access to their data.</p>
<p>The FBI and multiple <a href="https://us.norton.com/internetsecurity-malware-7-tips-to-prevent-ransomware.html" target="_blank" rel="noopener">security firms</a> have advised victims not to pay any ransom demands, as doing so just encourages the attackers and in any case may not result in actually regaining access to encrypted files. In practice, however, many cybersecurity consulting firms are quietly urging their customers that paying up is the fastest route back to business-as-usual.</p>
<p>It remains unclear if either PerCSoft or DDR &#8212; or perhaps their insurance provider &#8212; paid the ransom demand in this attack. But new reporting from independent news outlet <em>ProPublica</em> this week sheds light on another possible explanation why so many victims are simply coughing up the ransom demands: Their insurance providers will cover the cost &#8212; minus a deductible that is usually far less than the total ransom demanded by the attackers.</p>
<p>More to the point, ProPublica found, such attacks may be great for business if you&#8217;re in the insurance industry.</p>
<p>&#8220;More often than not, paying the ransom is a lot cheaper for insurers than the loss of revenue they have to cover otherwise,&#8221; said <strong>Minhee Cho</strong>, public relations director of ProPublica, in an email to KrebsOnSecurity. &#8220;But, by rewarding hackers, these companies have created a perverted cycle that encourages more ransomware attacks, which in turn frighten more businesses and government agencies into buying policies.&#8221;</p>
<p>&#8220;In fact, it seems hackers are specifically extorting American companies that they know have cyber insurance,&#8221; Cho continued. &#8220;After one small insurer highlighted the names of some of its cyber policyholders on its website, three of them were attacked by ransomware.&#8221;</p>
<p>Read the full ProPublica piece <a href="https://www.propublica.org/article/the-extortion-economy-how-insurance-companies-are-fueling-a-rise-in-ransomware-attacks" target="_blank" rel="noopener">here</a>. And if you haven&#8217;t already done so, check out <a href="https://features.propublica.org/ransomware/ransomware-attack-data-recovery-firms-paying-hackers/" target="_blank" rel="noopener">this outstanding related reporting</a> by <em>ProPublica</em> from earlier this year on how security firms that help companies respond to ransomware attacks also may be enabling and emboldening attackers.</p>


feed_id: https://krebsonsecurity.com/?p=48768
title: Phishers are Angling for Your Cloud Providers
uri: Phishers-are-Angling-for-Your-Cloud-Providers
url: https://krebsonsecurity.com/2019/08/phishers-are-angling-for-your-cloud-providers/
content:
<p>Many companies are now outsourcing their marketing efforts to cloud-based Customer Relationship Management (CRM) providers. But when accounts at those CRM providers get hacked or phished, the results can be damaging for both the client&#8217;s brand and their customers. Here&#8217;s a look at a recent CRM-based phishing campaign that targeted customers of Fortune 500 construction equipment vendor <strong>United Rentals</strong>.</p>
<p>Stamford, Ct.-based United Rentals [<a href="https://www.marketwatch.com/investing/stock/uri" target="_blank" rel="noopener">NYSE:URI</a>] is the world&#8217;s largest equipment rental company, with some 18,000 employees and earnings of approximately $4 billion in 2018. On August 21, multiple United Rental customers reported receiving invoice emails with booby-trapped links that led to a malware download for anyone who clicked.</p>
<p>While phony invoices are a common malware lure, this particular campaign sent users to a page on United Rentals&#8217; own Web site (unitedrentals.com).</p>
<div id="attachment_48770" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/ac2d6d89.unitedrentalsphish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/unitedrentalsphish.png"><img class="wp-image-48770" src="media/ac2d6d89.unitedrentalsphish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/unitedrentalsphish.png" alt="" width="595" height="406" /></a><p class="wp-caption-text">A screen shot of the malicious email that spoofed United Rentals.</p></div>
<p>In a notice to customers, the company said the unauthorized messages were not sent by United Rentals. One source who had at least two employees fall for the scheme forwarded KrebsOnSecurity a response from UR&#8217;s privacy division, which blamed the incident on a third-party advertising partner.</p>
<p>&#8220;Based on current knowledge, we believe that an unauthorized party gained access to a vendor platform United Rentals uses in connection with designing and executing email campaigns,&#8221; the response read.</p>
<p>&#8220;The unauthorized party was able to send a phishing email that appears to be from United Rentals through this platform,&#8221; the reply continued. &#8220;The phishing email contained links to a purported invoice that, if clicked on, could deliver malware to the recipient&#8217;s system. While our investigation is continuing, we currently have no reason to believe that there was unauthorized access to the United Rentals systems used by customers, or to any internal United Rentals systems.&#8221;</p>
<p>United Rentals told KrebsOnSecurity that its investigation so far reveals no compromise of its internal systems.</p>
<p>&#8220;At this point, we believe this to be an email phishing incident in which an unauthorized third party used a third-party system to generate an email campaign to deliver what we believe to be a banking trojan,&#8221; said <strong>Dan Higgins</strong>, UR&#8217;s chief information officer.</p>
<p>United Rentals would not name the third party marketing firm thought to be involved, but <a href="media/2633c4c6.ur-pdns.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/ur-pdns.png" target="_blank" rel="noopener">passive DNS lookups</a> on the UR subdomain referenced in the phishing email (used by UL for marketing since 2014 and visible in the screenshot above as &#8220;wVw.unitedrentals.com&#8221;) points to <a href="https://www.pardot.com" target="_blank" rel="noopener">Pardot</a>, an email marketing division of cloud CRM giant <a href="https://en.wikipedia.org/wiki/Salesforce.com" target="_blank" rel="noopener">Salesforce</a>.<span id="more-48768"></span></p>
<p>Companies that use cloud-based CRMs sometimes will dedicate a domain or subdomain they own specifically for use by their CRM provider, allowing the CRM to send emails that appear to come directly from the client&#8217;s own domains. However, in such setups the content that gets promoted through the client&#8217;s domain is actually hosted on the cloud CRM provider&#8217;s systems.</p>
<p>Salesforce did not respond to multiple requests for comment. But it seems likely that someone at Pardot with access to United Rental&#8217;s account was phished, hacked, or perhaps guilty of <a href="https://krebsonsecurity.com/2019/08/forced-password-reset-check-your-assumptions/" target="_blank" rel="noopener">password re-use</a>.</p>
<p>This attack comes on the heels of another targeted phishing campaign leveraging Pardot that was documented earlier this month by <strong>Netskope</strong>, a cloud security firm. Netskope&#8217;s <strong>Ashwin Vamshi</strong> said users of cloud CRM platforms have a high level of trust in the software because they view the data and associated links as internal, even though they are hosted in the cloud.</p>
<p>&#8220;A large number of enterprises provide their vendors and partners access to their CRM for uploading documents such as invoices, purchase orders, etc. (and often these happen as automated workflows),&#8221; Vamshi <a href="https://www.netskope.com/blog/pardot-crm-attack" target="_blank" rel="noopener">wrote</a>. &#8220;The enterprise has no control over the vendor or partner device and, more importantly, over the files being uploaded from them. In many cases, vendor- or partner-uploaded files carry with them a high level of implicit trust.&#8221;</p>
<p>Cybercriminals increasingly are targeting cloud CRM providers because compromised accounts on these systems can be leveraged to conduct extremely targeted and convincing phishing attacks. According to <a href="media/77921cf0.apwg_trends_report_q1_2019.pdf" data-original-source="https://docs.apwg.org//reports/apwg_trends_report_q1_2019.pdf" target="_blank" rel="noopener">the most recent stats</a> (PDF) from the <strong>Anti-Phishing Working Group</strong>, software-as-a-service providers (including CRM and Webmail providers) were the most-targeted industry sector in the first quarter of 2019, accounting for 36 percent of all phishing attacks.</p>
<div id="attachment_48790" style="width: 595px" class="wp-caption aligncenter"><img class=" wp-image-48790" src="media/f687a615.apwg-q12019.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/apwg-q12019.png" alt="" width="585" height="510" /><p class="wp-caption-text">Image: APWG</p></div>


feed_id: https://krebsonsecurity.com/?p=48805
title: Feds Allege Adconion Employees Hijacked IP Addresses for Spamming
uri: Feds-Allege-Adconion-Employees-Hijacked-IP-Addresses-for-Spamming
url:
https://krebsonsecurity.com/2019/09/feds-allege-adconion-employees-hijacked-ip-addresses-for-spamming/

content:
<p>Federal prosecutors in California have filed criminal charges against four employees of <strong>Adconion Direct</strong>, an email advertising firm, alleging they unlawfully hijacked vast swaths of Internet addresses and used them in large-scale spam campaigns. KrebsOnSecurity has learned that the charges are likely just the opening salvo in a much larger, ongoing federal investigation into the company&#8217;s commercial email practices.</p>
<p><img class="aligncenter size-full wp-image-48810" src="media/dca6af6a.adconion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/adconion.png" alt="" width="439" height="135" /></p>
<p>Prior to its acquisition, Adconion offered digital advertising solutions to some of the world&#8217;s biggest companies, including Adidas, AT&amp;T, Fidelity, Honda, Kohl&#8217;s and T-Mobile. <a href="https://www.amobee.com" target="_blank" rel="noopener">Amobee</a>, the Redwood City, Calif. online ad firm that acquired Adconion in 2014, bills itself as the world&#8217;s leading independent advertising platform. The CEO of Amobee is <strong>Kim Perell</strong>, formerly CEO of Adconion.</p>
<p>In October 2018, prosecutors in the Southern District of California named four Adconion employees &#8212; <strong>Jacob Bychak</strong>, <strong>Mark Manoogian</strong>, <strong>Petr Pacas</strong>, and <strong>Mohammed Abdul Qayyum</strong> &#8212;  in <a href="media/c504941e.71-1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/71-1.pdf" target="_blank" rel="noopener">a ten-count indictment</a> on charges of conspiracy, wire fraud, and electronic mail fraud. All four men have pleaded not guilty to the charges, which stem from a grand jury indictment handed down in June 2017.</p>
<p><img class="aligncenter wp-image-48879" src="media/2971ebce.companya-indictment.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/companya-indictment.png" alt="" width="595" height="672" /></p>
<h4>&#8216;COMPANY A&#8217;</h4>
<p>The indictment and other court filings in this case refer to the employer of the four men only as &#8220;Company A.&#8221; However, LinkedIn profiles under the names of three of the accused show they each work(ed) for Adconion and/or Amobee.</p>
<p>Mark Manoogian is an attorney whose <a href="https://www.linkedin.com/in/markmanoogian/" target="_blank" rel="noopener">LinkedIn profile</a> states that he is director of legal and business affairs at Amobee, and formerly was senior business development manager at Adconion Direct; Bychak <a href="https://www.linkedin.com/in/jacobbychak/" target="_blank" rel="noopener">is listed</a> as director of operations at Adconion Direct; <a href="https://www.linkedin.com/in/mohammed-abdul-qayyum-888a559/" target="_blank" rel="noopener">Quayyum&#8217;s LinkedIn page</a> lists him as manager of technical operations at Adconion. A statement of facts filed by the government indicates <a href="https://www.linkedin.com/in/petrpacas/" target="_blank" rel="noopener">Petr Pacas</a> was at one point director of operations at Company A (Adconion).</p>
<p>According to the indictment, between December 2010 and September 2014 the defendants engaged in a conspiracy to identify or pay to identify blocks of Internet Protocol (IP) addresses that were registered to others but which were otherwise inactive.</p>
<p>The government alleges the men sent forged letters to an Internet hosting firm claiming they had been authorized by the registrants of the inactive IP addresses to use that space for their own purposes.</p>
<p>&#8220;Members of the conspiracy would use the fraudulently acquired IP addresses to send commercial email (&#8216;spam&#8217;) messages,&#8221; the government charged.</p>
<h4>HOSTING IN THE WIND</h4>
<p>Prosecutors say the accused were able to spam from the purloined IP address blocks after tricking the owner of <strong>Hostwinds</strong>, an Oklahoma-based Internet hosting firm, into routing the fraudulently obtained IP addresses on their behalf.</p>
<p>Hostwinds owner <strong>Peter Holden</strong> was the subject of a 2015 KrebsOnSecurity story titled, &#8220;<a href="https://krebsonsecurity.com/2015/08/like-cutting-off-a-limb-to-save-the-body/" target="_blank" rel="noopener">Like Cutting Off a Limb to Save the Body</a>,&#8221; which described how he&#8217;d initially built a lucrative business catering mainly to spammers, only to later have a change of heart and aggressively work to keep spammers off of his network.</p>
<p>Most of the spammers Hostswinds terminated were sending messages for marketing programs that sign consumers up for various products or services which bill monthly and can be very difficult for consumers to cancel. Others were involved in sending spam to people who&#8217;d given away their email addresses and other personal information in response to various &#8220;free gift&#8221; offers.</p>
<p>That a case of such potential import for the digital marketing industry has escaped any media attention for so long is unusual but not surprising given what&#8217;s at stake for the companies involved and for the government&#8217;s ongoing investigations.</p>
<p>Adconion&#8217;s parent Amobee manages ad campaigns for some of the world&#8217;s top brands, and has every reason not to call attention to charges that some of its key employees may have been involved in criminal activity.</p>
<p>Meanwhile, prosecutors are busy following up on evidence supplied by several cooperating witnesses in this and a related grand jury investigation, including a confidential informant who received information from an Adconion employee about the company&#8217;s internal operations.<span id="more-48805"></span></p>
<h4>THE BIGGER PICTURE</h4>
<p>According to <a href="media/c504941e.71-1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/71-1.pdf" target="_blank" rel="noopener">a memo</a> jointly filed by the defendants, &#8220;this case spun off from a larger ongoing investigation into the commercial email practices of Company A.&#8221; Ironically, this memo appears to be the only one of several dozen documents related to the indictment that mentions Adconion by name (albeit only in a series of footnote references).</p>
<p>Prosecutors allege the four men bought hijacked IP address blocks from another man tied to this case who was charged separately. This individual, <strong>Daniel Dye</strong>, has a history of working with others to hijack IP addresses for use by spammers.</p>
<p>For many years, Dye was a system administrator for <strong>Optinrealbig</strong>, a Colorado company that relentlessly pimped all manner of junk email, from mortgage leads and adult-related services to counterfeit products and Viagra.</p>
<p>Optinrealbig&#8217;s CEO was the spam king <a href="https://en.wikipedia.org/wiki/Scott_Richter" target="_blank" rel="noopener">Scott Richter</a>, who later changed the name of the company to <a href="https://krebsonsecurity.com/?s=media+breakaway&amp;x=0&amp;y=0" target="_blank" rel="noopener">Media Breakaway</a> after being successfully sued for spamming by <strong>AOL,</strong> <strong>Microsoft</strong>, <strong>MySpace</strong>, and the New York Attorney General Office, among others. In 2008, this author <a href="http://voices.washingtonpost.com/securityfix/2008/04/a_case_of_network_identity_the_1.html" target="_blank" rel="noopener">penned a column for The Washington Post</a> detailing how Media Breakaway had hijacked tens of thousands of IP addresses from a defunct San Francisco company for use in its spamming operations.</p>
<p>Dye has been <a href="media/a5640ab0.Dye-complaint.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/Dye-complaint.pdf" target="_blank" rel="noopener">charged</a> with violations of the <a href="https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003" target="_blank" rel="noopener">CAN-SPAM Act</a>. A review of the documents in his case suggest Dye accepted a guilty plea agreement in connection with the IP address thefts and is cooperating with the government&#8217;s ongoing investigation into Adconion&#8217;s email marketing practices, although the plea agreement itself remains under seal.</p>
<p>Lawyers for the four defendants in this case have asserted in court filings that the government&#8217;s confidential informant is an employee of <a href="https://www.spamhaus.org/" target="_blank" rel="noopener">Spamhaus.org</a>, an organization that many Internet service providers around the world rely upon to help identify and block sources of malware and spam.</p>
<p>Interestingly, in 2014 Spamhaus was sued by <strong>Blackstar Media LLC</strong>, a bulk email marketing company and subsidiary of Adconion. Blackstar&#8217;s owners sued Spamhaus for defamation after Spamhaus included them at the top of its list of the <a href="https://www.spamhaus.org/statistics/spammers/" target="_blank" rel="noopener">Top 10 world&#8217;s worst spammers</a>. Blackstar later dropped the lawsuit and agreed to paid Spamhaus&#8217; legal costs.</p>
<p>Representatives for Spamhaus declined to comment for this story. Responding to questions about the indictment of Adconion employees, Amobee&#8217;s parent company SingTel referred comments to Amobee, which issued a brief statement saying, &#8220;Amobee has fully cooperated with the government&#8217;s investigation of this 2017 matter which pertains to alleged activities that occurred years prior to Amobee&#8217;s acquisition of the company.&#8221;</p>
<h4>ONE OF THE LARGEST SPAMMERS IN HISTORY?</h4>
<p>It appears the government has been investigating Adconion&#8217;s email practices since at least 2015, and possibly as early as 2013. The very first result in an online search for the words &#8220;Adconion&#8221; and &#8220;spam&#8221; returns a Microsoft Powerpoint document that was presented alongside <a href="https://www.youtube.com/watch?v=M5ETpNsWewc" target="_blank" rel="noopener">this talk</a> at an ARIN meeting in October 2016. ARIN stands for the <a href="https://www.arin.net" target="_blank" rel="noopener">American Registry for Internet Numbers</a>, and it handles IP addresses allocations for entities in the United States, Canada and parts of the Caribbean.</p>
<p><img class="aligncenter wp-image-48876" src="media/8a5810a5.adconion-spam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/adconion-spam.png" alt="" width="597" height="361" /></p>
<p>As the screenshot above shows, that Powerpoint deck was originally named &#8220;Adconion &#8211; Arin,&#8221; but the file has since been renamed. That is, unless one downloads the file and looks at <a href="media/7e3ea36c.adconion-waldenwhois.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/adconion-waldenwhois.png" target="_blank" rel="noopener">the metadata attached to it</a>, which shows the original filename and that it was created in 2015 by someone at the U.S. Department of Justice.</p>
<p>Slide #8 in that Powerpoint document references a case example of an unnamed company (again, &#8220;Company A&#8221;), which the presenter said was &#8220;alleged to be one of the largest spammers in history,&#8221; that had hijacked &#8220;hundreds of thousands of IP addresses.&#8221;</p>
<div id="attachment_48861" style="width: 605px" class="wp-caption aligncenter"><img class=" wp-image-48861" src="media/a4972b2d.whois-arin-companya.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/whois-arin-companya.png" alt="" width="595" height="404" /><p class="wp-caption-text">A slide from an ARIN presentation in 2016 that referenced Adconion.</p></div>
<p>There are fewer than four billion IPv4 addresses available for use, but the vast majority of them have already been allocated. In recent years, this global shortage has turned IP addresses into a commodity wherein each IP can fetch between $15-$25 on the open market.</p>
<p>The dearth of available IP addresses has created boom times for those engaged in the acquisition and sale of IP address blocks. It also has emboldened scammers and spammers who specialize in absconding with and spamming from dormant IP address blocks without permission from the rightful owners.</p>
<p>In May, KrebsOnSecurity broke the news that <strong>Amir Golestan</strong> &#8212; the owner of a prominent Charleston, S.C. tech company called <strong>Micfo LLC</strong> &#8212; had been <a href="https://krebsonsecurity.com/2019/05/a-tough-week-for-ip-address-scammers/" target="_blank" rel="noopener">indicted on criminal charges of fraudulently obtaining more than 735,000 IP addresses</a> from ARIN and reselling the space to others.</p>
<p>KrebsOnSecurity has since learned that for several years prior to 2014, Adconion was one of Golestan&#8217;s biggest clients. More on that in an upcoming story.</p>


feed_id: https://krebsonsecurity.com/?p=48915
title: ‘Satori’ IoT Botnet Operator Pleads Guilty
uri: Satori-IoT-Botnet-Operator-Pleads-Guilty
url: https://krebsonsecurity.com/2019/09/satori-iot-botnet-operator-pleads-guilty/
content:
<p>A 21-year-old man from Vancouver, Wash. has pleaded guilty to federal hacking charges tied to his role in operating the &#8220;<strong>Satori</strong>&#8221; botnet, a crime machine powered by hacked Internet of Things (IoT) devices that was built to conduct massive denial-of-service attacks targeting Internet service providers, online gaming platforms and Web hosting companies.</p>
<div id="attachment_44948" style="width: 278px" class="wp-caption alignright"><img class=" wp-image-44948" src="media/bb642a44.schuchman.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/schuchman.png" alt="" width="268" height="237" /><p class="wp-caption-text">Kenneth &#8220;Nexus-Zeta&#8221; Schuchman, in an undated photo.</p></div>
<p><strong>Kenneth Currin Schuchman</strong> pleaded guilty to one count of aiding and abetting computer intrusions. Between July 2017 and October 2018, Schuchman was part of a conspiracy with at least two other unnamed individuals to develop and use Satori in large scale online attacks designed to flood their targets with so much junk Internet traffic that the targets became unreachable by legitimate visitors.</p>
<p>According to his plea agreement, Schuchman &#8212; who went by the online aliases &#8220;<strong>Nexus</strong>&#8221; and &#8220;<strong>Nexus-Zeta</strong>&#8221; &#8212; worked with at least two other individuals to build and use the Satori botnet, which harnessed the collective bandwidth of approximately 100,000 hacked IoT devices by exploiting vulnerabilities in various wireless routers, digital video recorders, Internet-connected security cameras, and fiber-optic networking devices.</p>
<p>Satori was originally based on <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank" rel="noopener">the leaked source code</a> for <a href="https://krebsonsecurity.com/?s=mirai&amp;x=0&amp;y=0" target="_blank" rel="noopener">Mirai</a>, a powerful IoT botnet that first appeared in the summer of 2016 and was responsible for some of the largest denial-of-service attacks ever recorded (including <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank" rel="noopener">a 620 Gbps attack</a> that <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank" rel="noopener">took KrebsOnSecurity offline for almost four days</a>).</p>
<p>Throughout 2017 and into 2018, Schuchman worked with his co-conspirators &#8212; who used the nicknames &#8220;<strong>Vamp</strong>&#8221; and &#8220;<strong>Drake</strong>&#8221; &#8212; to further develop Satori by identifying and exploiting additional security flaws in other IoT systems.</p>
<p>Schuchman and his accomplices gave new monikers to their IoT botnets with almost each new improvement, rechristening their creations with names including &#8220;<strong>Okiru</strong>,&#8221; and &#8220;<strong>Masuta</strong>,&#8221; and infecting up to 700,000 compromised systems.</p>
<p>The plea agreement states that the object of the conspiracy was to sell access to their botnets to those who wished to rent them for launching attacks against others, although it&#8217;s not clear to what extent the Schuchman and his alleged co-conspirators succeeded in this regard.</p>
<p>Even after he was indicted in connection with his activities in August 2018, Schuchman created a new botnet variant while on supervised release. At the time, Schuchman and Drake had something of a falling out, and <span class="pullquote pqLeft">Schuchman later acknowledged using information gleaned by prosecutors to identify Drake&#8217;s home address for the purposes of &#8220;swatting&#8221; him.</span></p>
<p><a href="https://krebsonsecurity.com/?s=swatting&amp;x=0&amp;y=0" target="_blank" rel="noopener">Swatting</a> involves making false reports of a potentially violent incident &#8212; usually a phony hostage situation, bomb threat or murder &#8212; to prompt a heavily-armed police response to the target&#8217;s location. According to his plea agreement, the swatting that Schuchman set in motion in October 2018 resulted in &#8220;a substantial law enforcement response at Drake&#8217;s residence.&#8221;<span id="more-48915"></span></p>
<p>As noted in <a href="https://krebsonsecurity.com/2018/09/alleged-satori-iot-botnet-operator-sought-media-spotlight-got-indicted/" target="_blank" rel="noopener">a September 2018 story</a>, Schuchman was not exactly skilled in the art of obscuring his real identity online. For one thing, the domain name used as a control server to synchronize the activities of the Satori botnet was registered to the email address nexuczeta1337@gmail.com. That domain name was originally registered to a &#8220;ZetaSec Inc.&#8221; and to a &#8220;Kenny Schuchman&#8221; in Vancouver, Wash.</p>
<p>People who operate IoT-based botnets maintain and build up their pool of infected IoT systems by constantly scanning the Internet for other vulnerable systems. Schuchman&#8217;s plea agreement states that when he received abuse complaints related to his scanning activities, he responded in his father&#8217;s identity.</p>
<p>&#8220;Schuchman frequently used identification devices belonging to his father to further the criminal scheme,&#8221; the plea agreement explains.</p>
<p>While Schuchman may be the first person to plead guilty in connection with Satori and its progeny, he appears to be hardly the most culpable. Multiple sources tell KrebsOnSecurity that Schuchman&#8217;s co-conspirator Vamp is a U.K. resident who was principally responsible for coding the Satori botnet, and as a minor was involved in <a href="https://krebsonsecurity.com/2015/10/talktalk-hackers-demanded-80k-in-bitcoin/" target="_blank" rel="noopener">the 2015 hack against U.K. phone and broadband provider TalkTalk</a>.</p>
<p>Multiple sources also say Vamp was principally responsible for <a href="https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-reddit/" target="_blank" rel="noopener">the 2016 massive denial-of-service attack that swamped Dyn</a> &#8212; a company that provides core Internet services for a host of big-name Web sites. On October 21, 2016, an attack by a Mirai-based IoT botnet variant overwhelmed Dyn&#8217;s infrastructure, causing outages at a number of top Internet destinations, including Twitter, Spotify, Reddit and others.</p>
<p>The investigation into Schuchman and his alleged co-conspirators is being run out the FBI field office in Alaska, spearheaded by some of the same agents who helped track down and ultimately <a href="https://krebsonsecurity.com/2018/09/mirai-botnet-authors-avoid-jail-time/" target="_blank" rel="noopener">secure guilty pleas</a> from <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank" rel="noopener">the original co-authors of the Mirai botnet</a>.</p>
<p>It remains to be seen what kind of punishment a federal judge will hand down for Schuchman, who reportedly has been diagnosed with <a href="https://en.wikipedia.org/wiki/Asperger_syndrome" target="_blank" rel="noopener">Asperger Syndrome</a> and <a href="https://en.wikipedia.org/wiki/Autism_spectrum" target="_blank" rel="noopener">autism</a>. The maximum penalty for the single criminal count to which he&#8217;s pleaded guilty is 10 years in prison and fines of up to $250,000.</p>
<p>However, it seems likely his sentencing will fall well short of that maximum: Schuchman&#8217;s plea deal states that he agreed to a recommended sentence &#8220;at the low end of the guideline range as calculated and adopted by the court.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=48898
title: Spam In your Calendar? Here’s What to Do.
uri: Spam-In-your-Calendar-Here-s-What-to-Do
url: https://krebsonsecurity.com/2019/09/spam-in-your-calendar-heres-what-to-do/
content:
<p>Many spam trends are cyclical: Spammers tend to switch tactics when one method of hijacking your time and attention stops working. But periodically they circle back to old tricks, and few spam trends are as perennial as calendar spam, in which invitations to click on dodgy links show up unbidden in your digital calendar application from <strong>Apple</strong>, <strong>Google</strong> and Microsoft. Here&#8217;s a brief primer on what you can do about it.</p>
<div id="attachment_48911" style="width: 606px" class="wp-caption aligncenter"><img class=" wp-image-48911" src="media/7bdb5b76.calspam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/calspam.png" alt="" width="596" height="329" /><p class="wp-caption-text">Image: Reddit</p></div>
<p>Over the past few weeks, a good number of readers have written in to say they feared their calendar app or email account was hacked after noticing a spammy event had been added to their calendars.</p>
<p>The truth is, all that a spammer needs to add an unwelcome appointment to your calendar is the email address tied to your calendar account. That&#8217;s because the calendar applications from Apple, Google and Microsoft are set by default to accept calendar invites from anyone.</p>
<p>Calendar invites from spammers run the gamut from ads for porn or pharmacy sites, to claims of an unexpected financial windfall or &#8220;free&#8221; items of value, to outright phishing attacks and malware lures. The important thing is that you don&#8217;t click on any links embedded in these appointments. And resist the temptation to respond to such invitations by selecting &#8220;yes,&#8221; &#8220;no,&#8221; or &#8220;maybe,&#8221; as doing so may only serve to guarantee you more calendar spam.</p>
<p>Fortunately, the are a few simple steps you can take that should help minimize this nuisance. To stop events from being automatically added to your Google calendar:<span id="more-48898"></span></p>
<p>-Open the Calendar application, and click the gear icon to get to the Calendar Settings page.<br />
-Under &#8220;Event Settings,&#8221; change the default setting to &#8220;No, only show invitations to which I have responded.&#8221;</p>
<p><a class="lightbox" href="media/8551f970.googlecalendarspam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/googlecalendarspam.png"><img class="aligncenter wp-image-48901" src="media/8551f970.googlecalendarspam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/googlecalendarspam.png" alt="" width="595" height="245" /></a></p>
<p>To prevent events from automatically being added to your Microsoft Outlook calendar, click the gear icon in the upper right corner of Outlook to open the settings menu, and then scroll down and select &#8220;View all Outlook settings.&#8221; From there:</p>
<p>-Click &#8220;Calendar,&#8221; then &#8220;Events from email.&#8221;<br />
-Change the default setting for each type of reservation settings to &#8220;Only show event summaries in email.&#8221;</p>
<p><a class="lightbox" href="media/8b13553d.outlookcalendarspam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/outlookcalendarspam.png"><img class="aligncenter wp-image-48902" src="media/8b13553d.outlookcalendarspam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/outlookcalendarspam.png" alt="" width="595" height="324" /></a></p>
<p>For Apple calendar users, log in to your iCloud.com account, and select Calendar.</p>
<p>-Click the gear icon in the lower left corner of the Calendar application, and select &#8220;Preferences.&#8221;<br />
-Click the &#8220;Advanced&#8221; tab at the top of the box that appears.<br />
-Change the default setting to &#8220;Email to [your email here].&#8221;</p>
<p><img class="aligncenter  wp-image-48903" src="media/62f48515.applecalendarspam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/applecalendarspam.png" alt="" width="540" height="553" /></p>
<p>Making these changes will mean that any events your email provider previously added to your calendar automatically by scanning your inbox for certain types of messages from common events &#8212; such as making hotel, dining, plane or train reservations, or paying recurring bills &#8212; may no longer be added for you. Spammy calendar invitations may still show up via email; in the event they do, make sure to mark the missives as spam.</p>
<p>Have you experienced a spike in calendar spam of late? Or maybe you have another suggestion for blocking it? If so, sound off in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=48731
title: Secret Service Investigates Breach at U.S. Govt IT Contractor
uri: Secret-Service-Investigates-Breach-at-U-S-Govt-IT-Contractor
url: https://krebsonsecurity.com/2019/09/secret-service-investigates-breach-at-u-s-govt-it-contractor/
content:
<p>The <strong>U.S. Secret Service</strong> is investigating a breach at a Virginia-based government technology contractor that saw access to several of its systems put up for sale in the cybercrime underground, KrebsOnSecurity has learned. The contractor claims the access being auctioned off was to old test systems that do not have direct connections to its government partner networks.</p>
<p>In mid-August, a member of a popular Russian-language cybercrime forum offered to sell access to the internal network of a U.S. government IT contractor that does business with more than 20 federal agencies, including several branches of the military. The seller bragged that he had access to email correspondence and credentials needed to view databases of the client agencies, and set the opening price at six bitcoins (~USD $60,000).</p>
<p><img class="aligncenter wp-image-48936 " src="media/fd695ff8.miracle-clients.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/miracle-clients.png" alt="" width="592" height="605" /></p>
<p>A review of the screenshots posted to the cybercrime forum as evidence of the unauthorized access revealed several Internet addresses tied to systems at the <strong>U.S. </strong><strong>Department of Transportation</strong>, the <strong>National Institutes of Health </strong>(NIH), and <strong>U.S. Citizenship and Immigration Services</strong> (USCIS), a component of the <strong>U.S. Department of Homeland Security</strong> that manages the nation&#8217;s naturalization and immigration system.</p>
<p>Other domains and Internet addresses included in those screenshots pointed to <a href="https://www.miraclesystems.net" target="_blank" rel="noopener">Miracle Systems LLC</a>, an Arlington, Va. based IT contractor that <a href="https://www.miraclesystems.net/clients" target="_blank" rel="noopener">states on its site that it serves 20+ federal agencies</a> as a prime contractor, including the aforementioned agencies.</p>
<p>In an interview with KrebsOnSecurity, Miracle Systems CEO <strong>Sandesh Sharda</strong> confirmed that the auction concerned credentials and databases managed by his company, and that an investigating agent from the Secret Service was in his firm&#8217;s offices at that very moment looking into the matter.</p>
<p>But he maintained that the purloined data shown in the screenshots was years-old and mapped only to internal test systems that were never connected to its government agency clients.</p>
<p>&#8220;The Secret Service came to us and said they&#8217;re looking into the issue,&#8221; Sharda said. &#8220;But it was all old stuff [that was] in our own internal test environment, and it is no longer valid.&#8221;</p>
<p>Still, Sharda did acknowledge information shared by Wisconsin-based security firm <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>, which alerted KrebsOnSecurity to this incident, indicating that at least eight of its internal systems had been compromised on three separate occasions between November 2018 and July 2019 by <a href="https://www.us-cert.gov/ncas/alerts/TA18-201A" target="_blank" rel="noopener">Emotet</a>, a malware strain usually distributed via malware-laced email attachments that typically is used to deploy other malicious software.</p>
<p>The Department of Homeland Security did not respond to requests for comment, nor did the Department of Transportation. A spokesperson for the NIH said the agency had investigated the activity and found it was not compromised by the incident.</p>
<p style="font-weight: 400;">&#8220;As is the case for all agencies of the Federal Government, the NIH is constantly under threat of cyber-attack,&#8221; NIH spokesperson <strong>Julius Patterson</strong> said. &#8220;The NIH has a comprehensive security program that is continuously monitoring and responding to security events, and cyber-related incidents are reported to the Department of Homeland Security through the HHS Computer Security Incident Response Center.&#8221;</p>
<div id="attachment_48938" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/d8326019.miracle-jdbc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/miracle-jdbc.png"><img class="wp-image-48938" src="media/d8326019.miracle-jdbc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/miracle-jdbc.png" alt="" width="596" height="327" /></a><p class="wp-caption-text">One of several screenshots offered by the dark web seller as proof of access to a federal IT contractor later identified as Arlington, Va. based Miracle Systems.</p></div>
<p style="font-weight: 400;"><span id="more-48731"></span></p>
<p style="font-weight: 400;">The dust-up involving Miracle Systems comes amid much hand-wringing among U.S. federal agencies about how best to beef up and ensure security at a slew of private companies that manage federal IT contracts and handle government data.</p>
<p>For years, federal agencies had few options to hold private contractors to the same security standards to which they must adhere &#8212; beyond perhaps restricting how federal dollars are spent. But recent updates to federal acquisition regulations allow agencies to extend those same rules to vendors, enforce specific security requirements, and even kill contracts that are found to be in violation of specific security clauses.</p>
<p>In July, DHS&#8217;s Customs and Border Patrol (CPB) <a href="https://www.washingtonpost.com/technology/2019/07/02/border-surveillance-subcontractor-suspended-after-cyberattack-misuse-traveler-images/?arc404=true" target="_blank" rel="noopener">suspended all federal contracts</a> with <strong>Perceptics</strong>, a contractor which sells license-plate scanners and other border control equipment, after data collected by the company was <a href="https://www.theregister.co.uk/2019/05/23/perceptics_hacked_license_plate_recognition/" target="_blank" rel="noopener">made available for download on the dark web</a>. The CPB later said the breach was the result of a federal contractor copying data on its corporate network, which was subsequently compromised.</p>
<p style="font-weight: 400;">For its part, the Department of Defense <a href="https://www.fedscoop.com/dod-contractors-cybersecurity-standards-draft/" target="_blank" rel="noopener">recently issued long-awaited cybersecurity standards</a> for contractors who work with the Pentagon&#8217;s sensitive data.</p>
<p>“This problem is not necessarily a tier-one supply level,” DOD Chief Information Officer <strong>Dana Deasy </strong><a href="https://www.fedscoop.com/supply-chain-cybersecurity-dana-deasy-sasc-hearing/" target="_blank" rel="noopener">told</a> the Senate Armed Services Committee earlier this year. “It’s down when you get to the tier-three and the tier-four” subcontractors.</p>


feed_id: https://krebsonsecurity.com/?p=48952
title: Patch Tuesday, September 2019 Edition
uri: Patch-Tuesday-September-2019-Edition
url: https://krebsonsecurity.com/2019/09/patch-tuesday-september-2019-edition/
content:
<p><strong>Microsoft</strong> today issued security updates to plug some 80 security holes in various flavors of its <strong>Windows</strong> operating systems and related software. The software giant assigned a &#8220;critical&#8221; rating to almost a quarter of those vulnerabilities, meaning they could be used by malware or miscreants to hijack vulnerable systems with little or no interaction on the part of the user.</p>
<p><img class="alignright wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="219" height="230" />Two of the bugs quashed in this month&#8217;s patch batch (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1214" target="_blank" rel="noopener">CVE-2019-1214</a> and <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1215" target="_blank" rel="noopener">CVE-2019-1215</a>) involve vulnerabilities in all supported versions of Windows that have already been exploited in the wild. Both are known as &#8220;privilege escalation&#8221; flaws in that they allow an attacker to assume the all-powerful administrator status on a targeted system. Exploits for these types of weaknesses are often deployed along with other attacks that don&#8217;t require administrative rights.</p>
<p>September also marks the fourth time this year Microsoft has fixed critical bugs in its Remote Desktop Protocol (RDP) feature, with four critical flaws being patched in the service. According to security vendor <a href="https://blog.qualys.com/laws-of-vulnerabilities/2019/09/10/september-patch-tuesday-79-vulns-17-critical-remote-desktop-client-sharepoint-exploited-privesc" target="_blank" rel="noopener">Qualys</a>, these Remote Desktop flaws were discovered in a code review by Microsoft, and in order to exploit them an attacker would have to trick a user into connecting to a malicious or hacked RDP server.</p>
<p>Microsoft also fixed <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1280" target="_blank" rel="noopener">another critical vulnerability</a> in the way Windows handles link files ending in &#8220;.lnk&#8221; that could be used to launch malware on a vulnerable system if a user were open a removable drive or access a shared folder with a booby-trapped .lnk file on it.</p>
<p>Shortcut files — or those ending in the “.lnk” extension — are Windows files that link easy-to-recognize icons to specific executable programs, and are typically placed on the user’s Desktop or Start Menu. It&#8217;s perhaps worth noting that <a href="https://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/" target="_blank" rel="noopener">poisoned .lnk files</a> were one of the four known exploits bundled with <a href="https://en.wikipedia.org/wiki/Stuxnet" target="_blank" rel="noopener">Stuxnet</a>, a multi-million dollar cyber weapon that American and Israeli intelligence services <a href="https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp/0770436196" target="_blank" rel="noopener">used to derail Iran&#8217;s nuclear enrichment plans</a> roughly a decade ago.</p>
<p>In <a href="https://krebsonsecurity.com/2019/08/patch-tuesday-august-2019-edition/" target="_blank" rel="noopener">last month&#8217;s Microsoft patch dispatch</a>, I ruefully lamented the utter hose job inflicted on my <strong>Windows 10</strong> system by the July round of security updates from Redmond. Many readers responded by saying one or another updates released by Microsoft in August similarly caused reboot loops or issues with Windows repeatedly crashing.</p>
<p>As there do not appear to be any patch-now-or-be-compromised-tomorrow flaws in the September patch rollup, it&#8217;s probably safe to say most Windows end-users would benefit from waiting a few days to apply these fixes. <span id="more-48952"></span></p>
<p>Very often fixes released on Patch Tuesday have glitches that cause problems for an indeterminate number of Windows systems. When this happens, Microsoft then patches their patches to minimize the same problems for users who haven’t yet applied the updates, but it sometimes takes a few days for Redmond to iron out the kinks.</p>
<p>The trouble is, Windows 10 by default will install patches and reboot your computer whenever it likes. <a href="https://www.howtogeek.com/224471/how-to-prevent-windows-10-from-automatically-downloading-updates/" target="_blank" rel="noopener">Here’s a tutorial</a> on how to undo that. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in <strong>Windows Update</strong>.</p>
<p>Most importantly, please have some kind of system for backing up your files <em>before</em> applying any updates. You can use third-party software to do this, or just rely on the options built into Windows 10. At some level, it doesn’t matter. Just make sure you’re backing up your files, preferably following <a href="https://blog.malwarebytes.com/101/2017/04/3-2-1-go-make-backups-of-your-data/" target="_blank" rel="noopener">the 3-2-1 backup rule</a>.</p>
<p>Finally, <strong>Adobe</strong> fixed two critical bugs in its <strong>Flash Player</strong> browser plugin, which is bundled in Microsoft&#8217;s IE/Edge and Chrome (although now hobbled by default in Chrome). Firefox forces users with the Flash add-on installed to click in order to play Flash content; instructions for disabling or removing Flash from Firefox are <a href="https://support.mozilla.org/en-US/kb/disable-or-remove-add-ons" target="_blank" rel="noopener">here</a>. Adobe will stop supporting Flash at the end of 2020.</p>
<p>As always, if you experience any problems installing any of these patches this month, please feel free to leave a comment about it below; there’s a good chance other readers have experienced the same and may even chime in here with some helpful tips.</p>


feed_id: https://krebsonsecurity.com/?p=48961
title: NY Payroll Company Vanishes With $35 Million
uri: NY-Payroll-Company-Vanishes-With-35-Million
url: https://krebsonsecurity.com/2019/09/ny-payroll-company-vanishes-with-35-million/
content:
<p><strong>MyPayrollHR</strong>, a now defunct cloud-based payroll processing firm based in upstate New York, abruptly ceased operations this past week after stiffing employees at thousands of companies. The ongoing debacle, which allegedly involves malfeasance on the part of the payroll company&#8217;s CEO, resulted in countless people having money drained from their bank accounts and has left nearly $35 million worth of payroll and tax payments in legal limbo.</p>
<p>Unlike many stories here about <a href="https://krebsonsecurity.com/?s=cloud+ransomware&amp;x=0&amp;y=0" target="_blank" rel="noopener">cloud service providers being extorted by hackers for ransomware payouts</a>, this snafu appears to have been something of an inside job. Nevertheless, it is a story worth telling, in part because much of the media coverage of this incident so far has been somewhat disjointed, but also because it should serve as a warning to other payroll providers about how quickly and massively things can go wrong when a trusted partner unexpectedly turns rogue.</p>
<p>Clifton Park, NY-based <a href="https://www.mypayrollhr.com" target="_blank" rel="noopener">MyPayrollHR</a> &#8212; a subsidiary of <a href="http://www.valuewisecorporation.com" target="_blank" rel="noopener">ValueWise Corp.</a> &#8212; disclosed last week in a rather unceremonious message to some 4,000 clients that it would be shutting its virtual doors and that companies which relied upon it to process payroll payments should kindly look elsewhere for such services going forward.</p>
<p><a class="lightbox" href="media/1d44c075.mypayroll-message.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/mypayroll-message.png"><img class="aligncenter wp-image-48969" src="media/1d44c075.mypayroll-message.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/mypayroll-message.png" alt="" width="591" height="216" /></a></p>
<p>This communique came after employees at companies that depend on MyPayrollHR to receive direct deposits of their bi-weekly payroll payments discovered their bank accounts were instead debited for the amounts they would normally expect to accrue in a given pay period.</p>
<p>To make matters worse, many of those employees <em>found their accounts had been dinged for two payroll periods &#8212; a month&#8217;s worth of wages &#8212; </em>leaving their bank accounts dangerously in the red.</p>
<p>The remainder of this post is a deep-dive into what we know so far about what transpired, and how such an occurrence might be prevented in the future for other payroll processing firms.</p>
<h4>A $26 MILLION TEXT FILE</h4>
<p>To understand what&#8217;s at stake here requires a basic primer on how most of us get paid, which is a surprisingly convoluted process. In a typical scenario, our employer works with at least one third party company to make sure that on every other Friday what we&#8217;re owed gets deposited into our bank account.</p>
<p>The company that handled that process for MyPayrollHR is a California firm called <strong>Cachet Financial Services</strong>. Every other week for more than 12 years, MyPayrollHR has submitted a file to Cachet that told it which employee accounts at which banks should be credited and by how much.</p>
<p>According to interviews with Cachet, the way the process worked ran something like this: MyPayrollHR would send a digital file documenting deposits made by each of these client companies which laid out the amounts owed to each clients&#8217; employees. In turn, those funds from MyPayrollHR client firms then would be deposited into a settlement or holding account maintained by Cachet.</p>
<p>From there, Cachet would take those sums and disburse them into the bank accounts of people whose employers used MyPayrollHR to manage their bi-weekly payroll payments.</p>
<p>But according to Cachet, something odd happened with the instructions file MyPayrollHR submitted on the afternoon of Wednesday, Sept. 4 that had never before transpired: MyPayrollHR requested that all of its clients&#8217; payroll dollars be sent not to Cachet&#8217;s holding account but instead to an account at <strong>Pioneer Savings Bank</strong> that was operated and controlled by MyPayrollHR.</p>
<p>The total amount of this mass payroll deposit was approximately $26 million. <strong>Wendy Slavkin</strong>, general counsel for Cachet, told KrebsOnSecurity that her client then inquired with Pioneer Savings about the wayward deposit and was told MyPayrollHR&#8217;s bank account had been frozen.</p>
<p>Nevertheless, the payroll file submitted by MyPayrollHR instructed financial institutions for its various clients to pull $26 million from Cachet&#8217;s holding account &#8212; even though the usual deposits from MyPayrollHR&#8217;s client banks had not been made.<span id="more-48961"></span></p>
<h4>REVERSING THE REVERSAL</h4>
<p>In response, Cachet submitted a request to reverse that transaction. But according to Slavkin, that initial reversal request was improperly formatted, and so Cachet soon after submitted a correctly coded reversal request.</p>
<p>Financial institutions are supposed to ignore or reject payment instructions that don&#8217;t comport with precise formatting required by the <a href="https://en.wikipedia.org/wiki/NACHA" target="_blank" rel="noopener">National Automated Clearinghouse Association</a> (NACHA), the not-for-profit organization that provides the backbone for the electronic movement of money in the United States. But Slavkin said a number of financial institutions ended up processing both reversal requests, meaning a fair number of employees at companies that use MyPayrollHR suddenly saw a month&#8217;s worth of payroll payments withdrawn from their bank accounts.</p>
<p><strong>Dan L&#8217;Abbe</strong>, CEO of the San Francisco-based consultancy <a href="https://www.granitesolutionsgroupe.com/" target="_blank" rel="noopener">Granite Solutions Groupe</a>, said the mix-up has been massively disruptive for his 250 employees.</p>
<p>&#8220;This caused a lot of chaos for employers, but employees were the ones really affected,&#8221; L&#8217;Abbe said. &#8220;This is all very unusual because we don&#8217;t even have the ability to take money out of our employee accounts.&#8221;</p>
<p>Slavkin said Cachet managed to reach the CEO of MyPayrollHR &#8212; <strong>Michael T. Mann</strong> &#8212; via phone on the evening of Sept. 4, and that Mann said he would would call back in a few minutes. According to Slavkin, Mann never returned the call. Not long after that, MyPayrollHR told clients that it was going out of business and that they should find someone else to handle their payroll.</p>
<p>In short order, many people hit by one or both payroll reversals took to <a href="https://twitter.com/hashtag/mypayrollhr?src=hash" target="_blank" rel="noopener">Twitter</a> and Facebook to vent their anger and bewilderment at Cachet and at MyPayrollHR. But Slavkin said Cachet ultimately decided to cancel the previous payment reversals, leaving Cachet on the hook for $26 million.</p>
<p>&#8220;What we have since done is reached out to 100+ receiving banks to have them reject both reversals,&#8221; Slavkin said. &#8220;So most &#8212; if not all &#8212; employees affected by this will in the next day or two have all their money back.&#8221;</p>
<h4>THE VANISHING MANN</h4>
<p>Cachet has since been in touch with the FBI and with federal prosecutors in New York, and Slavkin said both are both now investigating MyPayrollHR and its CEO. On Monday, New York Governor <strong>Andrew Cuomo</strong> <a href="https://twitter.com/NYGovCuomo/status/1170099720804622340/photo/1" target="_blank" rel="noopener">called on</a> the state&#8217;s Department of Financial Services to investigate the company&#8217;s &#8220;sudden and disturbing shutdown.&#8221;</p>
<p>The $26 million hit against Cachet wasn&#8217;t the only fraud apparently perpetrated by MyPayrollHR and/or its parent firm: According to Slavkin, the now defunct New York company also stiffed <strong>National Payment Corporation</strong> (NatPay) &#8212; the Florida-based firm which handles tax withholdings for MyPayrollHR clients &#8212; to the tune of more than $9 million.</p>
<p>In a statement provided to KrebsOnSecurity, NatPay said it was alerted late last week that the bank accounts of MyPayrollHR and one of its affiliated companies were frozen, and that the notification came after payment files were processed.</p>
<p>&#8220;NatPay was provided information that MyPayrollHR and Cloud Payroll may have been the victims of fraud committed by their holding company ValueWise, whose CEO and owner is Michael Mann,&#8221; NatPay said. &#8220;NatPay immediately put in place steps to manage the orderly process of recovering funds [and] has more than sufficient insurance to cover actions of attempted or real fraud.&#8221;</p>
<p>Requests for comment from different executives at both MyPayrollHR and its parent firm ValueWise Corp. went unanswered, and the latter&#8217;s Web site is now offline. Several erstwhile MyPayrollHR employees reached via LinkedIn said none of them had seen or heard from Mr. Mann in days.</p>
<p>Meanwhile, Granite Solutions Groupe CEO L&#8217;Abbe said said some of his employees have seen their bank accounts credited back the money that was taken, while others are still waiting for those reversals to come through.</p>
<p>&#8220;It varies widely,&#8221; L&#8217;Abbe said. &#8220;Every bank processes differently, and everyone&#8217;s relationship with the bank is different. Others have absolutely no money right now and are having a helluva time with their bank believing this is all the result of fraud. Things are starting to settle down now, but a lot of employees are still in limbo with their bank.&#8221;</p>
<p>For its part, Cachet Financial Solutions says it will be looking at solutions to better detect when and if instructions from clients for funding its settlement accounts suddenly change.</p>
<p>&#8220;Our system is excellent at protecting against outside hackers,&#8221; Slavkin said. &#8220;But when it comes to something like this it takes everyone by complete surprise.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=49000
title: Man Who Hired Deadly Swatting Gets 15 Months
uri: Man-Who-Hired-Deadly-Swatting-Gets-15-Months
url: https://krebsonsecurity.com/2019/09/man-who-hired-deadly-swatting-gets-15-months/
content:
<p>An Ohio teen who recruited a convicted serial &#8220;swatter &#8220;to fake a distress call that ended in the police shooting an innocent Kansas man in 2017 has been sentenced to 15 months in prison.</p>
<div id="attachment_46397" style="width: 604px" class="wp-caption aligncenter"><img class=" wp-image-46397" src="media/9d86ccaa.swatting.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/swatting.jpg" alt="" width="594" height="287" /><p class="wp-caption-text">Image: FBI.gov</p></div>
<p>&#8220;Swatting&#8221; is a dangerous hoax that involves making false claims to emergency responders about phony hostage situations or bomb threats, with the intention of prompting a heavily-armed police response to the location of the claimed incident.</p>
<p>The tragic swatting hoax that unfolded on the night of Dec. 28, 2017 began with a dispute over a $1.50 wager in an online game “<a href="https://en.wikipedia.org/wiki/Call_of_Duty" target="_blank" rel="noopener">Call of Duty</a>” between <strong>Shane M. Gaskill</strong>, a 19-year-old Wichita, Kansas resident, and <strong>Casey S. Viner</strong>, 18, from the Cincinnati, OH area.</p>
<p>Viner wanted to get back at Gaskill in grudge over the Call of Duty match, and so enlisted the help of another man — <strong>Tyler R. Barriss</strong> — a serial swatter in California known by the alias “SWAuTistic” who’d <a href="https://krebsonsecurity.com/2018/01/serial-swatter-swautistic-bragged-he-hit-100-schools-10-homes/" target="_blank" rel="noopener">bragged of swatting hundreds of schools and dozens of private residences.</a></p>
<p>Chat transcripts presented by prosecutors showed Viner and Barriss both saying if Gaskill isn’t scared of getting swatted, he should give up his home address. But the address that Gaskill gave Viner to pass on to Barriss no longer belonged to him and was occupied by a new tenant.</p>
<p>Barriss&#8217;s fatal call to 911 emergency operators in Wichita was relayed from a local, non-emergency line. Barriss falsely claimed he was at the address provided by Viner, that he’d just shot his father in the head, was holding his mom and sister at gunpoint, and was thinking about burning down the home with everyone inside.</p>
<p>Wichita police quickly responded to the fake hostage report and surrounded the address given by Gaskill. Seconds later, 28-year-old <strong>Andrew Finch</strong> exited his mom’s home and was killed by a single shot from a Wichita police officer. Finch, a father of two, had no party to the gamers’ dispute and was simply in the wrong place at the wrong time.<span id="more-49000"></span></p>
<p>&#8220;Swatting is not a prank, and it is no way to resolve disputes among gamers,&#8221; U.S. Attorney Stephen McAllister, said in <a href="https://www.justice.gov/usao-ks/pr/ohio-gamer-sentenced-deadly-swatting-case" target="_blank" rel="noopener">a press statement</a>. &#8220;Once again, I call upon gamers to self-police their community to ensure that the practice of swatting is ended once and for all.”</p>
<p>In chat records presented by prosecutors, Viner admitted to his role in the deadly swatting attack:</p>
<blockquote><p>Defendant VINER: I literally said you’re gonna be swatted, and the guy who swatted him can easily say I convinced him or something when I said hey can you swat this guy and then gave him the address and he said yes and then said he’d do it for free because I said he doesn’t think anything will happen<br />
Defendant VINER: How can I not worry when I googled what happens when you’re involved and it said a eu [sic] kid and a US person got 20 years in prison min<br />
Defendant VINER: And he didn’t even give his address he gave a false address apparently<br />
J.D.: You didn’t call the hoax in…<br />
Defendant VINER: Does t [sic] even matter ?????? I was involved I asked him to do it in the first place<br />
Defendant VINER: I gave him the address to do it, but then again so did the other guy he gave him the address to do it as well and said do it pull up etc</p></blockquote>
<p>Barriss was <a href="https://krebsonsecurity.com/2019/03/man-behind-fatal-swatting-gets-20-years/" target="_blank" rel="noopener">sentenced earlier this year to 20 years in federal prison</a> for his role in the fatal swatting attack.</p>
<p>Barriss also pleaded guilty to making hoax bomb threats in phone calls to the headquarters of the FBI and the Federal Communications Commission in Washington, D.C. In addition, he made bomb threat and swatting calls from Los Angeles to emergency numbers in Ohio, New Hampshire, Nevada, Massachusetts, Illinois, Utah, Virginia, Texas, Arizona, Missouri, Maine, Pennsylvania, New Mexico, New York, Michigan, Florida and Canada.</p>
<p>Prosecutors for the county that encompasses Wichita decided in April 2018 that the officer who fired the shot that killed Andrew Finch would not face charges, and would not be named because he wasn&#8217;t being charged with a crime.</p>
<p>Viner was sentenced after pleading guilty to one count each of conspiracy and obstructing justice, the US attorney&#8217;s office for Kansas said. CNN <a href="https://www.cnn.com/2019/09/14/us/swatting-sentence-casey-viner" target="_blank" rel="noopener">reports</a> that Gaskill has been placed on <a href="https://en.wikipedia.org/wiki/Deferred_prosecution" target="_blank" rel="noopener">deferred prosecution</a>.</p>
<p>Viner&#8217;s obstruction charge stems from attempts to erase records of his communications with Barriss and the Wichita gamer, McAllister&#8217;s office said. In addition to his prison sentence, Viner was ordered to pay $2,500 in restitution and serve two years of supervised release.</p>


feed_id: https://krebsonsecurity.com/?p=49019
title: Before He Spammed You, this Sly Prince Stalked Your Mailbox
uri: Before-He-Spammed-You-this-Sly-Prince-Stalked-Your-Mailbox
url: https://krebsonsecurity.com/2019/09/before-he-spammed-you-this-sly-prince-stalked-your-mailbox/
content:
<p>A reader forwarded what he briefly imagined might be a bold, if potentially costly, innovation on the old <a href="https://www.fbi.gov/scams-and-safety/common-fraud-schemes/nigerian-letter-or-419-fraud" target="_blank" rel="noopener">Nigerian prince scam</a> that asks for help squirreling away millions in unclaimed fortune: It was sent via the U.S. Postal Service, with a postmarked stamp and everything.</p>
<p><a class="lightbox" href="media/5d381a59.lombardlure.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/lombardlure.png"><img class="aligncenter wp-image-49027" src="media/5d381a59.lombardlure.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/lombardlure.png" alt="" width="596" height="84" /></a></p>
<p>In truth these old fashioned <a href="https://en.wikipedia.org/wiki/Advance-fee_scam" target="_blank" rel="noopener">&#8220;advance fee&#8221; or &#8220;419&#8221; scams</a> predate email and have circulated via postal mail in various forms and countries over the years.</p>
<p>The recent one pictured below asks for help in laundering some $11.6 million from an important dead person that anyway has access to a secret stash of cash. Any suckers who bite are strung along for weeks while imaginary extortionists or crooked employees at these bureaucratic institutions demand licenses, bribes or other payments before disbursing any funds. Those funds never arrive, no matter how much money the sucker gives up.</p>
<div id="attachment_49023" style="width: 606px" class="wp-caption aligncenter"><img class=" wp-image-49023" src="media/7f19702a.charter419.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/charter419.png" alt="" width="596" height="800" /><p class="wp-caption-text">This type of &#8220;advance fee&#8221; or &#8220;419&#8221; scam letter is common in spam, probably less so via USPS.</p></div>
<p>It&#8217;s easy to laugh at this letter, because it&#8217;s sometimes funny when scammers try so hard. But then again, maybe the joke&#8217;s on us because sending these scams via USPS makes them even more appealing to the people most vulnerable: Older individuals with access to cash but maybe not all their marbles. <span id="more-49019"></span></p>
<p>Sure, the lure costs $.55 up front. But a handful of successful responses to thousands of mailers could net fortunes for these guys phishing it old school.</p>
<p>The losses from these types of scams are sometimes hard to track because so many go unreported. But they are often perpetrated by the same people involved in romance scams online and in so-called<a href="https://krebsonsecurity.com/?s=bec+fraud&amp;x=0&amp;y=0" target="_blank" rel="noopener"> &#8216;business email compromise&#8221; or BEC fraud</a>, wherein the scammers try to spoof the boss at a major company in a bid to get wire payment for an &#8220;urgent&#8221; (read: fraudulent) invoice.</p>
<p>These scam letters are sometimes called 419 scams in reference to the penal code for dealing with such crimes in Nigeria, a perennial source of 419 letter schemes. A recent <a href="https://qz.com/africa/1693540/fbi-bust-of-nigerian-email-fraud-shows-evolving-scam-tactics/" target="_blank" rel="noopener">bust</a> of a Nigerian gang targeted by the FBI gives some perspective on the money-making abilities of <a href="http://www.documentcloud.org/documents/6318484-BEC-Iro-Igbokwe-et-al-indictment.html" target="_blank" rel="noopener">a $10 million ring</a> that was running these scams all day long.</p>
<p>Reportedly, in the first seven months of 2019 alone the FBI received nearly 14,000 complaints reporting BEC scams with a total loss of around $1.1 billion—a figure that nearly matches losses reported for all of 2018.</p>


feed_id: https://krebsonsecurity.com/?p=48932
title: Interview With the Guy Who Tried to Frame Me for Heroin Possession
uri: Interview-With-the-Guy-Who-Tried-to-Frame-Me-for-Heroin-Possession
url:
https://krebsonsecurity.com/2019/09/interview-with-the-guy-who-tried-to-frame-me-for-heroin-possession/

content:
<p class="p1"><span class="s1">In April 2013, I received via U.S. mail more than a gram of pure heroin as part of a scheme to get me arrested for drug possession. But the plan failed and the Ukrainian mastermind behind it soon after was imprisoned for unrelated cybercrime offenses. That individual recently gave his first interview since finishing his jail time here in the states, and he&#8217;s shared some select (if often abrasive and coarse) details on how he got into cybercrime and why. Below are a few translated excerpts.</span></p>
<p class="p1"><span class="s1">When I first encountered now-31-year-old <b>Sergei &#8220;Fly,&#8221; &#8220;Flycracker,&#8221; &#8220;MUXACC&#8221; Vovnenko</b> in 2013, he was the administrator of the fraud forum “thecc[dot]bz,” an exclusive and closely guarded Russian language board dedicated to financial fraud and identity theft.</span></p>
<p class="p1"><span class="s1">Many of the heavy-hitters from other fraud forums had a presence on Fly&#8217;s forum, and collectively the group financed and ran a soup-to-nuts network for turning hacked credit card data into mounds of cash.</span></p>
<p class="p1"><span class="s1">Vovnenko first came onto my radar after his alter ego Fly published a blog entry that led with an image of my bloodied, severed head and included my credit report, copies of identification documents, pictures of our front door, information about family members, and so on. Fly had invited all of his cybercriminal friends to ruin my financial identity and that of my family.</span></p>
<p class="p1"><span class="s1">Somewhat curious about what might have precipitated this outburst, I was secretly given access to Fly&#8217;s cybercrime forum and learned he’d freshly hatched a plot to have heroin sent to my home. The plan was to have one of his forum lackeys spoof a call from one of my neighbors to the police when the drugs arrived, complaining that drugs were being delivered to our house and being sold out of our home by Yours Truly. </span></p>
<p class="p1"><span class="s1">Thankfully, someone on Fly&#8217;s forum also posted a link to the tracking number for the drug shipment. Before the smack arrived, I had a police officer come out and take a report. </span><span class="s1">After the heroin showed up, I gave the drugs to the local police and wrote about the experience in <a href="http://krebsonsecurity.com/2013/07/mail-from-the-velvet-cybercrime-underground/"><span class="s2">Mail From the Velvet Cybercrime Underground</span></a>. </span></p>
<p class="p1"><span class="s1">A</span><span class="s1">ngry that I’d foiled the plan to have me arrested for being a smack dealer, Fly or someone on his forum had a local florist send a gaudy floral arrangement in the shape of a giant cross to my home, complete with a menacing message that addressed my wife and was signed, “Velvet Crabs.”</span></p>
<div id="attachment_26621" style="width: 604px" class="wp-caption aligncenter"><img class=" wp-image-26621" src="media/718f8596.fly-cross.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/06/fly-cross.jpg" alt="" width="594" height="792" srcset="https://krebsonsecurity.com/wp-content/uploads/2014/06/fly-cross.jpg 2448w, https://krebsonsecurity.com/wp-content/uploads/2014/06/fly-cross-285x380.jpg 285w, https://krebsonsecurity.com/wp-content/uploads/2014/06/fly-cross-600x800.jpg 600w" sizes="(max-width: 594px) 100vw, 594px" /><p class="wp-caption-text">The floral arrangement that Fly or one of his forum lackeys had delivered to my home in Virginia.</p></div>
<p class="p1"><span class="s1">Vovnenko was arrested in Italy in the summer of 2014 on identity theft and botnet charges, and spent some 15 months in arguably Italy&#8217;s worst prison contesting his extradition to the United States. Those efforts failed, and he soon pleaded guilty to aggravated identity theft and wire fraud, and spent several years bouncing around America&#8217;s prison system.</span></p>
<p class="p1"><span class="s1">Although Vovnenko sent me a total of three letters from prison in Naples (a hand-written apology letter and two friendly <a href="media/a71ac5c1.flypostcardback-580x503.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/10/flypostcardback-580x503.png"><span class="s2">postcards</span></a>), he never responded to my requests to meet him following his trial and conviction on cybercrime charges in the United States. I suppose that is fair: To my everlasting dismay, I never responded to his Italian dispatches (the first I asked to be professionally analyzed and translated before I would touch it).</span></p>
<div id="attachment_32576" style="width: 601px" class="wp-caption aligncenter"><img class=" wp-image-32576" src="media/ed77e799.flypostcardback.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/10/flypostcardback.png" alt="" width="591" height="513" srcset="https://krebsonsecurity.com/wp-content/uploads/2015/10/flypostcardback.png 952w, https://krebsonsecurity.com/wp-content/uploads/2015/10/flypostcardback-580x503.png 580w, https://krebsonsecurity.com/wp-content/uploads/2015/10/flypostcardback-940x816.png 940w" sizes="(max-width: 591px) 100vw, 591px" /><p class="wp-caption-text">Seasons greetings from my pen pal, Flycracker.</p></div>
<p class="p1"><span class="s1">After serving his 41 month sentence in the U.S., Vovnenko was deported, although it&#8217;s unclear where he currently resides (the interview excerpted here suggests he&#8217;s back in Italy, but Fly doesn&#8217;t exactly confirm that). </span></p>
<p class="p1"><span class="s1">In an interview published on the Russian-language security blog Krober[.]biz, Vovnenko said he began stealing early in life, and by 13 was already getting picked up for petty robberies and thefts. </span></p>
<p class="p1"><span class="s1">A translated English version of the interview was produced and shared with KrebsOnSecurity by analysts at New York City-based cyber intelligence firm <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a>.</span><span id="more-48932"></span></p>
<p>Sometime in the mid-aughts, Vovnenko settled with his mother in Naples, Italy, but he had trouble keeping a job for more than a few days. Until a chance encounter led to a front job at a den of thieves.</p>
<blockquote><p>&#8220;When I came to my Mom in Naples, I could not find a permanent job. Having settled down somewhere at a new job, I would either get kicked out or leave in the first two days. I somehow didn&#8217;t succeed with employment until I was invited to work in a wine shop in the historical center of Naples, where I kinda had to wipe the dust from the bottles. But in fact, the wine shop turned out to be a real den and a sales outlet of hashish and crack. So my job was to be on the lookout and whenever the cops showed up, take a bag of goods and leave under the guise of a tourist.&#8221;</p></blockquote>
<p>Cocaine and hash were plentiful at his employer&#8217;s place of work, and Vovnenko said he availed himself of both abundantly. After he&#8217;d saved enough to buy a computer, Fly started teaching himself how to write programs and hack stuff. He quickly became enthralled with the romanticized side of cybercrime &#8212; the allure of instant cash &#8212; and decided this was his true vocation.</p>
<blockquote><p>&#8220;After watching movies and reading books about hackers, I really wanted to become a sort of virtual bandit who robs banks without leaving home,&#8221; Vovnenko recalled. &#8220;Once, out of curiosity, I wrote an SMS bomber that used a registration form on a dating site, bypassing the captcha through some kind of rookie mistake in the shitty code. The bomber would launch from the terminal and was written in Perl, and upon completion of its work, it gave out my phone number and email. I shared the bomber somewhere on one of my many awkward sites.&#8221;</p>
<p>&#8220;And a couple of weeks later they called me. Nah, not the cops, but some guy who comes from Sri Lanka who called himself Enrico. He told me that he used my program and earned a lot of money, and now he wants to share some of it with me and hire me. By a happy coincidence, the guy also lived in Naples.&#8221;</p>
<p>&#8220;When we met in person, he told me that he used my bomber to fuck with a telephone company called Wind. This telephone company had such a bonus service: for each incoming SMS you received two cents on the balance. Well, of course, this guy bought a bunch of SIM cards and began to bomb them, getting credits and loading them into his paid lines, similar to how phone sex works.&#8221;</p></blockquote>
<p>But his job soon interfered with his drug habit, and he was let go.</p>
<blockquote><p>&#8220;At the meeting, Enrico gave me 2K euros, and this was the first money I’ve earned, as it is fashionable to say these days, on &#8216;cybercrime&#8217;. I left my previous job and began to work closely with Enrico. But always stoned out of my mind, I didn&#8217;t do a good job and struggled with drug addiction at that time. I was addicted to cocaine, as a result, I was pulling a lot more money out of Enrico than my work brought him. And he kicked me out.&#8221;</p></blockquote>
<p>After striking out on his own, Vovnenko says he began getting into carding big time, and was introduced to several other big players on the scene. One of those was a cigarette smuggler who used the nickname Ponchik (&#8220;Doughnut&#8221;).</p>
<p>I wonder if this is the <a href="https://krebsonsecurity.com/2013/12/who-is-paunch/"><span class="s2">same Ponchik who was arrested in 2013</span></a> as being the mastermind behind the <a href="https://krebsonsecurity.com/?s=blackhole&amp;x=0&amp;y=0" target="_blank" rel="noopener">Blackhole exploit kit</a>, a crimeware package that fueled an overnight explosion in malware attacks via Web browser vulnerabilities.</p>
<p>In any case, Vovnenko had settled on some schemes that were generating reliably large amounts of cash.</p>
<blockquote>
<p class="p1"><span class="s1">&#8220;I’ve never stood still and was not focusing on carding only, with the money I earned, I started buying dumps and testing them at friends’ stores,&#8221; Vovnenko said. &#8220;Mules, to whom I signed the hotlines, were also signed up for cashing out the loads, giving them a mere 10 percent for their work. Things seemed to be going well.&#8221;</span></p>
</blockquote>
<p>FAN MAIL</p>
<p>There is a large chronological gap in Vovnenko&#8217;s account of his cybercrime life story from that point on until the time he and his forum friends started sending heroin, large bags of feces and other nasty stuff to our Northern Virginia home in 2013.</p>
<p>Vovnenko claims he never sent anything and that it was all done by members of his forum.</p>
<blockquote><p><b>-Tell me about the packages to Krebs.</b><br />
&#8220;That ain’t me. Suitcase filled with sketchy money, dildoes, and a bouquet of coffin wildflowers. They sent all sorts of crazy shit. Forty or so guys would send. When I was already doing time, one of the dudes sent it. By the way, Krebs wanted to see me. But the lawyer suggested this was a bad idea. Maybe he wanted to look into my eyes.&#8221;</p></blockquote>
<p>In one part of the interview, Fly is asked about but only briefly touches on how he was caught. I wanted to add some context here because this part of the story is richly ironic, and perhaps a tad cathartic.</p>
<p>Around the same time Fly was taking bitcoin donations for a fund to purchase heroin on my behalf, he was also engaged to be married to a nice young woman. But Fly apparently did not fully trust his bride-to-be, so he had malware installed on her system that forwarded him copies of all email that she sent and received.</p>
<div id="attachment_22059" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/f6d98033.heroin1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/07/heroin1.png"><img class="wp-image-22059" src="media/f6d98033.heroin1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/07/heroin1.png" alt="" width="594" height="352" srcset="https://krebsonsecurity.com/wp-content/uploads/2013/07/heroin1.png 1002w, https://krebsonsecurity.com/wp-content/uploads/2013/07/heroin1-285x168.png 285w, https://krebsonsecurity.com/wp-content/uploads/2013/07/heroin1-600x355.png 600w" sizes="(max-width: 594px) 100vw, 594px" /></a><p class="wp-caption-text">Fly,/Flycracker discussing the purchase of a gram of heroin from Silk Road seller &#8220;10toes.&#8221;</p></div>
<p>But Fly would make at least two big operational security mistakes in this spying effort: First, he had his fiancée&#8217;s messages forwarded to an email account he&#8217;d used for plenty of cybercriminal stuff related to his various &#8220;Fly&#8221; identities.</p>
<p>Mistake number two was the password for his email account was the same as one of his cybercrime forum admin accounts. And unbeknownst to him at the time, that forum was hacked, with all email addresses and hashed passwords exposed.</p>
<p>Soon enough, investigators were reading Fly&#8217;s email, including the messages forwarded from his wife&#8217;s account that had details about their upcoming nuptials, such as shipping addresses for their wedding-related items and the full name of Fly&#8217;s fiancée. It didn&#8217;t take long to zero in on Fly&#8217;s location in Naples.</p>
<p>While it may sound unlikely that a guy so immeshed in the cybercrime space could make such rookie security mistakes, I have found that a great many cybercriminals actually have worse operational security than the average Internet user.</p>
<p>I suspect this may be because the nature of their activities requires them to create vast numbers of single- or brief-use accounts, and in general they tend to re-use credentials across multiple sites, or else pick very poor passwords &#8212; even for critical resources.</p>
<p>In addition to elaborating on his hacking career, Fly talks a great deal about his time in various prisons (including their culinary habits), and an apparent longing or at least lingering fondness for the whole carding scene in general.</p>
<p>Towards the end, Fly says he&#8217;s considering going back to school, and that he may even take up information security as a study. I wish him luck in that whatever that endeavor is as long as he can also avoid stealing from people.</p>
<p>I don&#8217;t know what I would have written many years ago to Fly had I not been already so traumatized by receiving postal mail from him. Perhaps it would go something like this:</p>
<blockquote><p>&#8220;Dear Fly: Thank you for your letters. I am very sorry to hear about the delays in your travel plans. I wish you luck in all your endeavors &#8212; and I sincerely wish the next hopeful opportunity you alight upon does not turn out to be a pile of shit.&#8221;</p></blockquote>
<p>The entire translated interview is <a href="media/c6433732.Interview-with-Mukha-aka-Fly-1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/Interview-with-Mukha-aka-Fly-1.pdf" target="_blank" rel="noopener">here</a> (PDF). Fair warning: Many readers may find some of the language and topics discussed in the interview disturbing or offensive.</p>


feed_id: https://krebsonsecurity.com/?p=49067
title: MyPayrollHR CEO Arrested, Admits to $70M Fraud
uri: MyPayrollHR-CEO-Arrested-Admits-to-70M-Fraud
url: https://krebsonsecurity.com/2019/09/mypayrollhr-ceo-arrested-admits-to-70m-fraud/
content:
<p>Earlier this month, employees at more than 1,000 companies saw one or two paycheck&#8217;s worth of funds deducted from their bank accounts after the CEO of their cloud payroll provider <a href="https://krebsonsecurity.com/2019/09/ny-payroll-company-vanishes-with-35-million/" target="_blank" rel="noopener">absconded with $35 million in payroll and tax deposits from customers</a>. On Monday, the CEO was arrested and allegedly confessed that the diversion was the last desperate gasp of a financial shell game that earned him $70 million over several years.</p>
<p><strong>Michael T. Mann</strong>, the 49-year-old CEO of Clifton Park, NY-based <strong>MyPayrollHR</strong>, was <a href="https://www.nbcnews.com/news/us-news/fbi-agents-raid-home-ceo-connected-payroll-processing-fraud-n1055591" target="_blank" rel="noopener">arrested this week</a> and charged with bank fraud. In court filings, FBI investigators said Mann admitted under questioning that in early September &#8212; on the eve of a big payroll day &#8212; he diverted to his own bank account some $35 million in funds sent by his clients to cover their employee payroll deposits and tax withholdings.</p>
<p><img class="aligncenter wp-image-48969" src="media/1d44c075.mypayroll-message.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/mypayroll-message.png" alt="" width="596" height="218" /></p>
<p>After that stunt, two different banks that work with Mann&#8217;s various companies froze those corporate accounts to keep the funds from being moved or withdrawn. That action set off a chain of events that led another financial institution that helps MyPayrollHR process payments to briefly pull almost $26 million out of checking accounts belonging to employees at more than 1,000 companies that use MyPayrollHR.</p>
<p>At the same time, MyPayrollHR sent a message (see screenshot above) to clients saying it was shutting down and that customers should find alternative methods for paying employees and for processing payroll going forward.</p>
<p>In <a href="media/728ebb6f.manncomplain.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/manncomplain.pdf" target="_blank" rel="noopener">the criminal complaint against Mann</a> (PDF), a New York FBI agent said the CEO admitted that starting in 2010 or 2011 he began borrowing large sums of money from banks and financing companies under false pretenses.</p>
<blockquote><p>&#8220;While stating that MyPayroll was legitimate, he admitted to creating other companies that had no purpose other than to be used in the fraud; fraudulently representing to banks and financing companies that his fake businesses had certain receivables that they did not have; and obtaining loans and lines of credit by borrowing against these non-existent receivables.&#8221;</p>
<p>&#8220;Mann estimated that he fraudulently obtained about $70 million that he has not paid back. He claimed that he committed the fraud in response to business and financial pressures, and that he used almost all of the fraudulently obtained funds to sustain certain businesses, and purchase and start new ones. He also admitted to kiting checks between Bank of America and Pioneer [Savings Bank], as part of the fraudulent scheme.&#8221;</p></blockquote>
<p>Check-kiting is the illegal act of writing a check from a bank account without sufficient funds and depositing it into another bank account, <a href="https://www.magnifymoney.com/blog/banking/check-kiting/" target="_blank" rel="noopener">explains</a> MagnifyMoney.com. &#8220;Then, you withdraw the money from that second account before the original check has been cleared.&#8221;</p>
<p>Kiting also is known as taking advantage of the &#8220;float,&#8221; which is the amount of time between when an individual submits a check as payment and when the individual’s bank is instructed to move the funds from the account.<span id="more-49067"></span></p>
<p>Magnify Money explains more:</p>
<blockquote><p>&#8220;Say, for example, that you write yourself a check for $500 from checking account A, and deposit that check into checking account B — but the balance in checking account A is only $75. Then, you promptly withdraw the $500 from checking account B. This is check-kiting, a form of check fraud that uses non-existent funds in a checking account or other type of bank account. Some check-kiting schemes use multiple accounts at a single bank, and more complicated schemes involve multiple financial institutions.&#8221;</p>
<p>&#8220;In a more complex scenario, a person could open checking accounts at bank A and bank B, at first depositing $500 into bank A and nothing in bank B. Then, they could write a check for $10,000 with account A and deposit it into account B. Bank B immediately credits the account, and in the time it might take for bank B to clear the check (generally about three business days), the scammer writes a $10,000 check with bank B, which gets deposited into bank A to cover the first check. This could keep going, with someone writing checks between banks where there’s no actual funds, yet the bank believes the money is real and continues to credit the accounts.&#8221;</p></blockquote>
<p>The government alleges Mann was kiting millions of dollars in checks between his accounts at Bank of American and Pioneer from Aug. 1, 2019 to Aug. 30, 2019.</p>
<p>For more than a decade, MyPayrollHR worked with California-based Cachet Financial Services to process payroll deposits for MyPayrollHR client employees. Every other week, MyPayrollHR&#8217;s customers would deposit their payroll funds into a holding account run by Cachet, which would then disburse the payments into MyPayrollHR client employee bank accounts.</p>
<p>But when Mann diverted $26 million in client payroll deposits from Cachet to his account at Pioneer Bank, Cachet&#8217;s emptied holding account was debited for the payroll payments. Cachet quickly reversed those deposits, causing one or two pay periods worth of salary to be deducted from bank accounts for employees of companies that used MyPayrollHR.</p>
<p>That action caused so much uproar from affected companies and their employees that Cachet ultimately decided to cancel all of those reversals and absorb that $26 million hit, which it is now trying to recover through the courts.</p>
<p>According to prosecutors in New York, Pioneer was Mann&#8217;s largest creditor.</p>
<p>&#8220;Mann stated that the payroll issue was precipitated by his decision to route MyPayroll&#8217;s clients&#8217; payroll payments to an account at Pioneer instead of directly to Cachet,&#8221; wrote <strong>FBI Special Agent Matthew J. Wabby</strong>. &#8220;He did this in order to temporarily reduce the amount of money he owed to Pioneer. When Pioneer froze Mann&#8217;s accounts, it&#8217;s also (inadvertently) stopped movement of MyPayroll&#8217;s clients&#8217; payroll payments to Cachet.&#8221;</p>
<p>Approximately $9 million of the $35 million diverted by Mann was supposed to go to accounts at the <strong>National Payment Corporation</strong> (NatPay) — the Florida-based firm which handles tax withholdings for MyPayrollHR clients. NatPay said its insurance should help cover the losses it incurred when MyPayrollHR&#8217;s banks froze the company&#8217;s accounts.</p>
<p>Court records indicate Mann hasn&#8217;t yet entered a plea, but that he was ordered to be released today under a $200,000 bond secured by a family home and two vehicles. His passport also was seized.</p>


feed_id: https://krebsonsecurity.com/?p=49087
title: German Cops Raid “Cyberbunker 2.0,” Arrest 7 in Child Porn, Dark Web Market Sting
uri: German-Cops-Raid-Cyberbunker-2-0-Arrest-7-in-Child-Porn-Dark-W
url:
https://krebsonsecurity.com/2019/09/german-cops-raid-cyberbunker-2-0-arrest-7-in-child-porn-dark-web-market-sting/

content:
<p>German authorities said Friday they&#8217;d arrested seven people and were investigating six more in connection with the raid of a Dark Web hosting operation that allegedly supported multiple child porn, cybercrime and drug markets with hundreds of servers buried inside a heavily fortified military bunker. Incredibly, for at least two of the men accused in the scheme, this was their second bunker-based hosting business that was raided by cops and shut down for courting and supporting illegal activity online.</p>
<p>The latest busted cybercrime bunker is in Traben-Trarbach, a town on the Mosel River in western Germany. <em>The Associated Press</em> <a href="https://www.apnews.com/be9947471fb74360b6cf9d1d2b535927" target="_blank" rel="noopener">says</a> investigators believe the 13-acre former military facility served a number of dark web sites, including: the &#8220;Wall Street Market,&#8221; a sprawling, online bazaar for drugs, hacking tools and financial-theft wares before it was taken down earlier this year; the drug portal &#8220;Cannabis Road;&#8221; and the synthetic drug market &#8220;Orange Chemicals.&#8221;</p>
<p>German police reportedly seized $41 million worth of funds allegedly tied to these markets, and more than 200 servers that were operating throughout the underground temperature-controlled, ventilated and closely guarded facility.</p>
<div id="attachment_49090" style="width: 601px" class="wp-caption aligncenter"><img class=" wp-image-49090" src="media/8e6eb081.germanbunker.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/germanbunker.png" alt="" width="591" height="653" /><p class="wp-caption-text">The former military bunker in Germany that housed CyberBunker 2.0 and, according to authorities, plenty of very bad web sites.</p></div>
<p>The authorities in Germany haven&#8217;t named any of the people arrested or under investigation in connection with CyberBunker&#8217;s alleged activities, but said those arrested were apprehended outside of the bunker. Still, there are clues in the details released so far, and those clues have been corroborated by sources who know two of the key men allegedly involved.</p>
<p>We know the owner of the bunker hosting business has been described in media reports as a 59-year-old Dutchman who allegedly set it up as a &#8220;bulletproof&#8221; hosting provider that would provide Web site hosting to any business, no matter how illegal or unsavory.</p>
<p>We also know the German authorities seized at least two Web site domains in the raid, including the domain for <a href="https://www.spamhaus.org/rokso/evidence/ROK10624/zyztm-research-division/main-info" target="_blank" rel="noopener">ZYZTM Research</a> in The Netherlands (<a href="https://web.archive.org/web/20181105012216/http://www.zyztm.com/" target="_blank" rel="noopener">zyztm[.]com</a>), and <a href="https://web.archive.org/web/20190115054527/http://www.cb3rob.org/" target="_blank" rel="noopener">cb3rob[.]org</a>.</p>
<div id="attachment_49106" style="width: 609px" class="wp-caption aligncenter"><img class=" wp-image-49106" src="media/4ae8634e.cb3rob-seizure.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/cb3rob-seizure.png" alt="" width="599" height="364" /><p class="wp-caption-text">A &#8220;seizure&#8221; placeholder page left behind by German law enforcement agents after they seized cb3rob.org, an affiliate of the the CyberBunker bulletproof hosting facility owned by convicted Dutch cybercriminal Sven Kamphuis.</p></div>
<p>According to historic whois records maintained by <a href="https://www.domaintools.com" target="_blank" rel="noopener">Domaintools.com</a>, Zyztm[.]com was originally registered to a <strong>Herman Johan Xennt</strong> in the Netherlands. Cb3rob[.]org was an organization hosted at CyberBunker registered to<strong> Sven Kamphuis</strong>, a self-described anarchist who was convicted several years ago for participating in <a href="https://krebsonsecurity.com/2016/08/inside-the-attack-that-almost-broke-the-internet/" target="_blank" rel="noopener">a large-scale attack that briefly impaired the global Internet</a> in some places.</p>
<p>Both 59-year-old Xennt and Mr. Kamphuis worked together on a previous bunker-based project &#8212; a bulletproof hosting business they sold as &#8220;CyberBunker&#8221; and ran out of a five-story military bunker in The Netherlands.</p>
<p>That&#8217;s according to <a href="https://twitter.com/envirosec" target="_blank" rel="noopener"><strong>Guido Blaauw</strong></a>, director of <a href="https://www.disaster-proof.com" target="_blank" rel="noopener">Disaster-Proof Solutions</a>, a company that renovates and resells old military bunkers and underground shelters. Blaauw&#8217;s company bought the 12,500 square-meter Netherlands bunker from Mr. Xennt in 2011 for $700,000.</p>
<div id="attachment_49091" style="width: 607px" class="wp-caption aligncenter"><img class=" wp-image-49091" src="media/8c8123a4.guido-cyberbunker.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/guido-cyberbunker.png" alt="" width="597" height="392" /><p class="wp-caption-text">Guido Blaauw, in front of the original CyberBunker facility in the Netherlands, which he bought from Mr. Xennt in 2011. Image: Blaauw.</p></div>
<p>Media reports indicate that in 2002 a fire inside the CyberBunker 1.0 facility in The Netherlands summoned emergency responders, who discovered a lab hidden inside the bunker that was being used to produce the drug <a href="https://en.wikipedia.org/wiki/Ecstasy" target="_blank" rel="noopener">ecstasy/XTC</a>.</p>
<p>Blaauw said nobody was ever charged for the drug lab, which was blamed on another tenant in the building. Blauuw said Xennt and others in 2003 were then denied a business license to continue operating in the bunker, and they were forced to resell servers from a different location &#8212; even though they bragged to clients for years to come about hosting their operations from an ultra-secure underground bunker.</p>
<p>&#8220;After the fire in 2002, there was never any data or servers stored in the bunker,&#8221; in The Netherlands, Blaauw recalled. &#8220;For 11 years they told everyone [the hosting servers where] in this ultra-secure bunker, but it was all in Amsterdam, and for 11 years they scammed all their clients.&#8221;</p>
<div id="attachment_49097" style="width: 476px" class="wp-caption aligncenter"><img class="wp-image-49097 size-full" src="media/fad8c472.bunkerfire.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/bunkerfire.png" alt="" width="466" height="606" /><p class="wp-caption-text">Firefighters investigating the source of a 2002 fire at the CyberBunker&#8217;s first military bunker in The Netherlands discovered a drug lab amid the Web servers. Image: Blaauw.</p></div>
<p>Blaauw said sometime between 2012 and 2013, Xennt purchased the bunker in Traben-Trarbach, Germany &#8212; a much more modern structure that was built in 1997. CyberBunker was reborn, and it began offering many of the same amenities and courted the same customers as CyberBunker 1.0 in The Netherlands.</p>
<p>&#8220;They&#8217;re known for hosting scammers, fraudsters, pedophiles, phishers, everyone,&#8221; Blaauw said. &#8220;That&#8217;s something they&#8217;ve done for ages and they&#8217;re known for it.&#8221;</p>
<div id="attachment_20102" style="width: 606px" class="wp-caption aligncenter"><img class=" wp-image-20102" src="media/6d79da33.cyberbunkerfb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/04/cyberbunkerfb.png" alt="" width="596" height="389" srcset="https://krebsonsecurity.com/wp-content/uploads/2013/04/cyberbunkerfb.png 774w, https://krebsonsecurity.com/wp-content/uploads/2013/04/cyberbunkerfb-285x185.png 285w, https://krebsonsecurity.com/wp-content/uploads/2013/04/cyberbunkerfb-600x391.png 600w" sizes="(max-width: 596px) 100vw, 596px" /><p class="wp-caption-text">The former Facebook profile picture of Sven Olaf Kamphuis, shown here standing in front of Cyberbunker 1.0 in The Netherlands.</p></div>
<p><span id="more-49087"></span>About the time Xennt and company were settling into their new bunker in Germany, he and Kamphuis were engaged in a fairly lengthy and large series of distributed denial-of-service (DDoS) attacks aimed at sidelining a number of Web sites &#8212; particularly anti-spam organization Spamhaus. A chat record of that assault, detailed in my 2016 piece, <a href="https://krebsonsecurity.com/2016/08/inside-the-attack-that-almost-broke-the-internet/" target="_blank" rel="noopener">Inside the Attack that Almost Broke the Internet</a>, includes references to and quotes from both Xennt and Kamphuis.</p>
<p>Kamphuis was later <a href="https://krebsonsecurity.com/2013/04/dutchman-arrested-in-spamhaus-ddos/" target="_blank" rel="noopener">arrested in Spain on the DDoS attack charges</a>. He was <a href="https://krebsonsecurity.com/2016/11/adobe-fined-1m-in-multistate-suit-over-2013-breach-no-jail-for-spamhaus-attacker/" target="_blank" rel="noopener">convicted in The Netherlands</a> and sentenced to time served, which was approximately 55 days of detention prior to his extradition to the United States.</p>
<div id="attachment_49103" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/3a1f73e8.cyberbunker-servers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/cyberbunker-servers.png"><img class="wp-image-49103" src="media/3a1f73e8.cyberbunker-servers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/cyberbunker-servers.png" alt="" width="599" height="338" /></a><p class="wp-caption-text">Some of the 200 servers seized from CyberBunker 2.0, a &#8220;bulletproof&#8221; web hosting facility buried inside a German military bunker. Image: swr.de.</p></div>
<p>The AP story mentioned above quoted German prosecutor<strong> Juergen Bauer</strong> saying the 59-year-old main suspect in the case was believed to have links to organized crime.</p>
<p>A <a href="media/aa37cf61.Nicola-Tallant-Crime.pdf" data-original-source="http://journalismawards.ie/ja/wp-content/uploads/2016/10/Nicola-Tallant-Crime.pdf" target="_blank" rel="noopener">2015 expose&#8217;</a> (PDF) by the Irish newspaper <em>The Sunday World</em> compared Mr. Xennt (pictured below) to a villain from a James Bond movie, and said he has been seen frequently associating with another man: an Irish mobster named <a href="https://www.irishmirror.ie/news/irish-news/irish-gangster-george-the-penguin-11035412" target="_blank" rel="noopener">George &#8220;the Penguin&#8221; Mitchell</a>, listed by Europol as one of the top-20 drug traffickers in Europe and thought to be involved in smuggling heroin, cocaine and ecstasy.</p>
<div id="attachment_49096" style="width: 604px" class="wp-caption aligncenter"><img class="wp-image-49096" src="media/6120a90c.hideaway.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/hideaway.png" alt="" width="594" height="309" /><p class="wp-caption-text">Cyberbunkers 1.0 and 2.0 owner and operator Mr. Xennt, top left, has been compared to a &#8220;Bond villain.&#8221; Image: The Sunday World, July 26, 2015.</p></div>
<p>Blaauw said he doesn&#8217;t know whether Kamphuis was arrested or named in the investigation, but added that people who know him and can usually reach him have not heard from Kamphuis over several days.</p>
<p>Here&#8217;s what the CyberBunker in The Netherlands looked like back in the early aughts when Xennt still ran it:</p>
<p><img class="aligncenter size-full wp-image-49101" src="media/19c44b7a.oldbunker.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/oldbunker.png" alt="" width="504" height="376" /></p>
<p>Here&#8217;s what it looks like now after being renovated by Blaauw&#8217;s company and designed as a security operations center (SOC):</p>
<div id="attachment_49100" style="width: 609px" class="wp-caption aligncenter"><img class=" wp-image-49100" src="media/210ae8b8.cyberbunker1-0-SOC.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/cyberbunker1-0-SOC.png" alt="" width="599" height="451" /><p class="wp-caption-text">The former CyberBunker in the Netherlands, since redesigned as a security operations center by its current owner. Image: Blaauw.</p></div>
<p>I&#8217;m glad when truly bad guys doing bad stuff like facilitating child porn are taken down. The truth is, almost anyone trafficking in the kinds of commerce these guys courted also is building networks of money laundering business that become very tempting to use or lease out for other nefarious purposes, including human trafficking, and drug trafficking.</p>


feed_id: https://krebsonsecurity.com/?p=49124
title: Mariposa Botnet Author, Darkcode Crime Forum Admin Arrested in Germany
uri: Mariposa-Botnet-Author-Darkcode-Crime-Forum-Admin-Arrested-in-Germany
url:
https://krebsonsecurity.com/2019/10/mariposa-botnet-author-darkcode-crime-forum-admin-arrested-in-germany/

content:
<p>A Slovenian man convicted of authoring the destructive and once-prolific <a href="https://en.wikipedia.org/wiki/Mariposa_botnet" target="_blank" rel="noopener">Mariposa botnet</a> and running the infamous <a href="https://krebsonsecurity.com/2015/07/the-darkode-cybercrime-forum-up-close/" target="_blank" rel="noopener">Darkode cybercrime forum</a> has been arrested in Germany on request from prosecutors in the United States, who&#8217;ve recently re-indicted him on related charges.</p>
<div id="attachment_49132" style="width: 603px" class="wp-caption aligncenter"><img class="wp-image-49132 " src="media/de15f783.nicehash.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/nicehash.png" alt="" width="593" height="464" /><p class="wp-caption-text">NiceHash CTO Matjaž &#8220;Iserdo&#8221; Škorjanc, as pictured on the front page of a recent edition of the Slovenian daily Delo.si, is being held by German authorities on a US arrest warrant for operating the destructive &#8220;Mariposa&#8221; botnet and founding the infamous Darkode cybercrime forum.</p></div>
<p>The Slovenian Press Agency <a href="https://www.sta.si/2682188/nemci-po-nalogu-zda-prijeli-programerja-skorjanca" target="_blank" rel="noopener">reported today</a> that German police arrested <strong>Matjaž &#8220;Iserdo&#8221; Škorjanc </strong>last week, in response to a U.S.-issued international arrest warrant for his extradition.</p>
<p>In December 2013, a Slovenian court sentenced Škorjanc to four years and ten months in prison for creating the malware that powered the ‘<strong>Mariposa</strong>‘ botnet. Spanish for “Butterfly,” Mariposa was a potent crime machine first spotted in 2008. Very soon after its inception, Mariposa was estimated to have infected <a href="https://krebsonsecurity.com/2010/03/mariposa-botnet-authors-may-avoid-jail-time/" target="_blank" rel="noopener">more than 1 million hacked computers</a> — making it one of the largest botnets ever created.</p>
<div id="attachment_1451" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/93b3e31f.Screen-shot-2010-03-03-at-7.08.09-PM.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2010/03/Screen-shot-2010-03-03-at-7.08.09-PM.png"><img class="wp-image-1451" src="media/93b3e31f.Screen-shot-2010-03-03-at-7.08.09-PM.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2010/03/Screen-shot-2010-03-03-at-7.08.09-PM.png" alt="" width="595" height="328" srcset="https://krebsonsecurity.com/wp-content/uploads/2010/03/Screen-shot-2010-03-03-at-7.08.09-PM.png 962w, https://krebsonsecurity.com/wp-content/uploads/2010/03/Screen-shot-2010-03-03-at-7.08.09-PM-300x165.png 300w" sizes="(max-width: 595px) 100vw, 595px" /></a><p class="wp-caption-text">An advertisement for the ButterFly Bot.</p></div>
<p>Škorjanc and his hacker handle Iserdo were initially named in a <a href="media/6821673d.2011-Skorjanc-Indictment.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/2011-Skorjanc-Indictment.pdf" target="_blank" rel="noopener">Justice Department indictment from 2011</a> (PDF) along with two other men who allegedly wrote and sold the Mariposa botnet code. But in June 2019, the DOJ unsealed <a href="media/5a05af4c.newdarkodecharges.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/newdarkodecharges.pdf" target="_blank" rel="noopener">an updated indictment</a> (PDF) naming Škorjanc, the original two other defendants, and a fourth man (from the United States) in a conspiracy to make and market Mariposa and to run the Darkode crime forum.</p>
<p>More recently, Škorjanc served as chief technology officer at <strong>NiceHash</strong>, a Slovenian company that lets users sell their computing power to help others mine virtual currencies like bitcoin. In December 2017, approximately USD $52 million worth of bitcoin <a href="https://krebsonsecurity.com/2017/12/former-botmaster-darkode-founder-is-cto-of-hacked-bitcoin-mining-firm-nicehash/" target="_blank" rel="noopener">mysteriously disappeared from the coffers of NiceHash</a>. Slovenian police are reportedly <a href="https://news.bitcoin.com/nicehash-returns-60-of-coins-stolen-in-the-hack/" target="_blank" rel="noopener">still investigating</a> that incident.</p>
<div id="attachment_31625" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/381a15d4.dkhome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/07/dkhome.png"><img class="wp-image-31625" src="media/381a15d4.dkhome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/07/dkhome.png" alt="" width="594" height="633" srcset="https://krebsonsecurity.com/wp-content/uploads/2015/07/dkhome.png 690w, https://krebsonsecurity.com/wp-content/uploads/2015/07/dkhome-580x618.png 580w" sizes="(max-width: 594px) 100vw, 594px" /></a><p class="wp-caption-text">The &#8220;sellers&#8221; page on the Darkode cybercrime forum, circa 2013.</p></div>
<p><span id="more-49124"></span>It will be interesting to see what happens with the fourth and sole U.S.-based defendant added in the latest DOJ charges &#8212; <strong>Thomas K. McCormick</strong>, a.k.a &#8220;<strong>fubar</strong>&#8221; &#8212; allegedly one of the last administrators of Darkode. Prosecutors say McCormick also was a reseller of the Mariposa botnet, the <a href="https://krebsonsecurity.com/?s=zeus&amp;x=0&amp;y=0" target="_blank" rel="noopener">ZeuS banking trojan</a>, and a bot malware he allegedly helped create called &#8220;Ngrbot.&#8221;</p>
<p>Between 2010 and 2013, Fubar would randomly chat me up on instant messenger apropos of nothing to trade information about the latest goings-on in the malware and cybercrime forum scene.</p>
<p>Fubar frequently knew before anyone else about upcoming improvements to or new features of ZeuS, and discussed at length his interactions with Iserdo/Škorjanc. Every so often, I would reach out to Fubar to see if he could convince one of his forum members to call off an attack against KrebsOnSecurity.com, an activity that had become something of a rite of passage for new Darkode members.</p>
<p>On Dec. 5, 2013, federal investigators visited McCormick at his University of Massachusetts dorm room. According to a memo filed by FBI agents investigating the case, in that interview McCormick acknowledged using the &#8220;fubar&#8221; identity on Darkode, but said he&#8217;d quit the whole forum scene years ago, <em>and that he&#8217;d even interned at Microsoft for several summers and at Cisco for one summer</em>.</p>
<p>A subsequent search warrant executed on his dorm room revealed multiple removable drives that held tens of thousands of stolen credit card records. For whatever reason, however, McCormick wasn&#8217;t arrested or charged until December 2018.</p>
<p>According to the FBI, back in that December 2013 interview McCormick voluntarily told them a great deal about his various businesses and online personas. He also apparently told investigators he talked with KrebsOnSecurity quite a bit, and that he&#8217;d tipped me off to some important developments in the malware scene. For example:</p>
<p>&#8220;TM had found the email address of the Spyeye author in an old fake antivirus affiliate program database and that TM was able to find the true name of the Spyeye author from searching online for an individual that used the email address,&#8221; the memo states. &#8220;TM passed this information on to Brian Krebs.&#8221;</p>
<p>Read more of the FBI&#8217;s interview with McCormick <a href="media/9a97aa15.McCormickInterview.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/McCormickInterview.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=49146
title: Patch Tuesday Lowdown, October 2019 Edition
uri: Patch-Tuesday-Lowdown-October-2019-Edition
url: https://krebsonsecurity.com/2019/10/patch-tuesday-lowdown-october-2019-edition/
content:
<p>On Tuesday <strong>Microsoft</strong> issued software updates to fix almost five dozen security problems in <strong>Windows</strong> and software designed to run on top of it. By most accounts, it&#8217;s a relatively light patch batch this month. Here&#8217;s a look at the highlights.</p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />Happily, only about 15 percent of the bugs patched this week earned Microsoft&#8217;s most dire &#8220;critical&#8221; rating. Microsoft labels flaws critical when they could be exploited by miscreants or malware to seize control over a vulnerable system without any help from the user.</p>
<p>Also, <strong>Adobe</strong> has kindly granted us another month&#8217;s respite from patching security holes in its <strong>Flash Player </strong>browser plugin.</p>
<p>Included in this month&#8217;s roundup is something Microsoft actually first started shipping in the third week of September, when it released an emergency update to fix a critical <strong>Internet Explorer</strong> zero-day flaw (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1367" target="_blank" rel="noopener">CVE-2019-1367</a>) that was being exploited in the wild.<span id="more-49146"></span></p>
<p>That out-of-band security update for IE caused printer errors for many Microsoft users whose computers applied the emergency update early on, according to Windows update expert <a href="https://www.computerworld.com/article/3444177/microsoft-releases-even-more-patches-for-the-cve-2019-1367-ie-zero-day-and-the-bugs-are-having-a-fi.html" target="_blank" rel="noopener">Woody Leonhard</a>. Apparently, the fix available through this month&#8217;s roundup addresses those issues.</p>
<p>Security firm <strong>Ivanti </strong>notes that the patch for the IE zero day flaw was released prior to today for Windows 10 through cumulative updates, but that an IE rollup for any pre-Windows 10 systems needs to be manually downloaded and installed.</p>
<p>Once again, Microsoft is fixing dangerous bugs in its <strong>Remote Desktop Client</strong>, the Windows feature that lets a user interact with a remote desktop as if they were sitting in front of the other PC. On the bright side, this critical bug can only be exploited by tricking a user into connecting to a malicious Remote Desktop server &#8212; not exactly the most likely attack scenario.</p>
<p>Other notable vulnerabilities addressed this month include a pair of critical security holes in Microsoft Excel versions <strong>2010-2019</strong> for Mac and Windows, as well as <strong>Office 365</strong>. These flaws would allow an attacker to install malware just by getting a user to open a booby-trapped Office file.</p>
<p>Windows 10 likes to install patches all in one go and reboot your computer on its own schedule. Microsoft doesn’t make it easy for Windows 10 users to change this setting, <a href="https://www.howtogeek.com/224471/how-to-prevent-windows-10-from-automatically-downloading-updates/" target="_blank" rel="noopener">but it is possible</a>. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in Windows Update. To get there, click the Windows key on your keyboard and type “windows update” into the box that pops up.</p>
<p>Staying up-to-date on Windows patches is good. Updating only after you’ve backed up your important data and files is even better. A reliable backup means you’re not pulling your hair out if the odd buggy patch causes problems booting the system. So do yourself a favor and backup your files before installing any patches.</p>
<p>As always, if you experience any problems installing any of the patches this month, please feel free to leave a comment about it below; there’s a decent chance other readers have experienced the same and may even chime in here with some helpful tips.</p>


feed_id: https://krebsonsecurity.com/?p=49161
title: “BriansClub” Hack Rescues 26M Stolen Cards
uri: BriansClub-Hack-Rescues-26M-Stolen-Cards
url: https://krebsonsecurity.com/2019/10/briansclub-hack-rescues-26m-stolen-cards/
content:
<p>&#8220;<strong>BriansClub</strong>,&#8221; one of the largest underground stores for buying stolen credit card data, has itself been hacked. The data stolen from BriansClub encompasses more than 26 million credit and debit card records taken from hacked online and brick-and-mortar retailers over the past four years, including almost eight million records uploaded to the shop in 2019 alone.</p>
<div id="attachment_49240" style="width: 599px" class="wp-caption aligncenter"><img class="wp-image-49240" src="media/5981cd16.briansdump.gif" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/briansdump.gif" alt="" width="589" height="38" /><p class="wp-caption-text">An ad for BriansClub has been using my name and likeness for years to peddle millions of stolen credit cards.</p></div>
<p>Last month, KrebsOnSecurity was contacted by a source who shared a plain text file containing what was claimed to be the full database of cards for sale both currently and historically through <strong>BriansClub[.]at</strong>, a thriving fraud bazaar named after this author. Imitating my site, likeness and namesake, BriansClub even dubiously claims a copyright with a reference at the bottom of each page: &#8220;© 2019 Crabs on Security.&#8221;</p>
<p>Multiple people who reviewed the database shared by my source confirmed that the same credit card records also could be found in a more redacted form simply by searching the BriansClub Web site with a valid, properly-funded account.</p>
<p>All of the card data stolen from BriansClub was shared with multiple sources who work closely with financial institutions to identify and monitor or reissue cards that show up for sale in the cybercrime underground.</p>
<p>The leaked data shows that in 2015, BriansClub added just 1.7 million card records for sale. But business would pick up in each of the years that followed: In 2016, BriansClub uploaded 2.89 million stolen cards; 2017 saw some 4.9 million cards added; 2018 brought in 9.2 million more.</p>
<p>Between January and August 2019 (when this database snapshot was apparently taken), BriansClub added roughly 7.6 million cards.</p>
<p>Most of what&#8217;s on offer at BriansClub are &#8220;dumps,&#8221; strings of ones and zeros that &#8212; when encoded onto anything with a magnetic stripe the size of a credit card &#8212; can be used by thieves to purchase electronics, gift cards and other high-priced items at big box stores.</p>
<p>As shown in the table below (taken from <a href="https://krebsonsecurity.com/2019/08/meet-bluetana-the-scourge-of-pump-skimmers/" target="_blank" rel="noopener">this story</a>), many federal hacking prosecutions involving stolen credit cards will for sentencing purposes value each stolen card record at $500, which is intended to represent the average loss per compromised cardholder.</p>
<div id="attachment_48614" style="width: 600px" class="wp-caption aligncenter"><img class="wp-image-48614 " src="media/b8ee179b.pumpskimvalue.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/pumpskimvalue.png" alt="" width="590" height="636" /><p class="wp-caption-text">The black market value, impact to consumers and banks, and liability associated with different types of card fraud.</p></div>
<h4>STOLEN BACK FAIR AND SQUARE</h4>
<p>An extensive analysis of the database indicates BriansClub holds approximately $414 million worth of stolen credit cards for sale, based on the pricing tiers listed on the site. That&#8217;s according to an analysis by <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a>, a security intelligence firm based in New York City.</p>
<p><strong>Allison Nixon</strong>, the company&#8217;s director of security research, said Flashpoint had help from numerous parties in crunching the numbers from the massive leaked database.</p>
<p>Nixon said the data suggests that between 2015 and August 2019, <span class="pullquote pqright">BriansClub sold roughly 9.1 million stolen credit cards, earning the site $126 million in sales</span> (all sales are transacted in bitcoin).</p>
<p>If we take just the 9.1 million cards that were confirmed sold through BriansClub, we&#8217;re talking about $2.27 billion in likely losses at the $500 average loss per card figure from the Justice Department.</p>
<p>Also, it seems likely the total number of stolen credit cards for sale on BriansClub and related sites vastly exceeds the number of criminals who will buy such data. Shame on them for not investing more in marketing!</p>
<p>There&#8217;s no easy way to tell how many of the 26 million or so cards for sale at BriansClub are still valid, but the closest approximation of that &#8212; how many unsold cards have expiration dates in the future &#8212; <em>indicates more than 14 million of them could still be valid.</em></p>
<p>The archive also reveals the proprietor(s) of BriansClub frequently uploaded new batches of stolen cards &#8212; some just a few thousand records, and others tens of thousands.</p>
<p>That&#8217;s because like many other carding sites, BriansClub mostly resells cards stolen by other cybercriminals &#8212; known as resellers or affiliates &#8212; who earn a percentage from each sale. It&#8217;s not yet clear how that revenue is shared in this case, but perhaps this information will be revealed in further analysis of the purloined database.<span id="more-49161"></span></p>
<h4>BRIANS CHAT</h4>
<p>In a message titled &#8220;Your site is hacked,&#8217; KrebsOnSecurity requested comment from BriansClub via the &#8220;Support Tickets&#8221; page on the carding shop&#8217;s site, informing its operators that all of their card data had been shared with the card-issuing banks.</p>
<p>I was surprised and delighted to receive a polite reply a few hours later from the site&#8217;s administrator (&#8220;admin&#8221;):</p>
<blockquote><p>&#8220;No. I&#8217;m the real Brian Krebs here <img src="media/e68d9d70.1f642.png" data-original-source="https://s.w.org/images/core/emoji/11/72x72/1f642.png" alt="🙂" class="wp-smiley" style="height: 1em; max-height: 1em;" /></p>
<p>Correct subject would be the data center was hacked.</p>
<p>Will get in touch with you on jabber. Should I mention that all information affected by the data-center breach has been since taken off sales, so no worries about the issuing banks.&#8221;</p></blockquote>
<p>Flashpoint&#8217;s Nixon said a spot check comparison between the stolen card database and the card data advertised at BriansClub suggests the administrator is not being truthful in his claims of having removed the leaked stolen card data from his online shop.</p>
<p>The admin hasn&#8217;t yet responded to follow-up questions, such as why BriansClub chose to use my name and likeness to peddle millions of stolen credit cards.</p>
<p>Almost certainly, at least part of the appeal is that my surname means &#8220;crab&#8221; (or <a href="https://krebsonsecurity.com/2018/03/coinhive-expose-prompts-cancer-research-fundraiser/" target="_blank" rel="noopener">cancer</a>), and crab is Russian hacker slang for &#8220;carder,&#8221; a person who engages in credit card fraud.</p>
<div id="attachment_49185" style="width: 583px" class="wp-caption aligncenter"><img class=" wp-image-49185" src="media/7376e651.crabrating.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/crabrating.png" alt="" width="573" height="428" /><p class="wp-caption-text">Many of the cards for sale on BriansClub are not visible to all customers. Those who wish to see the &#8220;best&#8221; cards in the shop need to maintain certain minimum balances, as shown in this screenshot.</p></div>
<h4>HACKING BACK?</h4>
<p>Nixon said breaches of criminal website databases often lead not just to prevented cybercrimes, but also to arrests and prosecutions.</p>
<p>&#8220;When people talk about &#8216;hacking back,&#8217; they’re talking about stuff like this,&#8221; Nixon said. &#8220;As long as our government is hacking into all these foreign government resources, they should be hacking into these carding sites as well. There’s a lot of attention being paid to this data now and people are remediating and working on it.&#8221;</p>
<p>By way of example on hacking back, she pointed to <a href="https://krebsonsecurity.com/2017/08/alleged-vdos-operators-arrested-charged/" target="_blank" rel="noopener">the 2016 breach of vDOS</a> &#8212; at the time the largest and most powerful service for knocking Web sites offline in large-scale cyberattacks.</p>
<p>Soon after vDOS&#8217;s database was stolen and leaked to this author, its two main proprietors were arrested. Also, the database <a href="https://krebsonsecurity.com/?s=vdos&amp;x=0&amp;y=0" target="_blank" rel="noopener">added to evidence of criminal activity</a> for several other individuals who were persons of interest in unrelated cybercrime investigations, Nixon said.</p>
<p>&#8220;When vDOS got breached, that basically reopened cases that were cold because [the leak of the vDOS database] supplied the final piece of evidence needed,&#8221; she said.</p>
<h4>THE TARGET BREACH OF THE UNDERGROUND?</h4>
<p>After many hours spent poring over this data, it became clear I needed some perspective on the scope and impact of this breach. As a major event in the cybercrime underground, was it somehow the reverse analog of the <a href="https://krebsonsecurity.com/?s=%22target+breach%22&amp;x=0&amp;y=0" target="_blank" rel="noopener">Target breach</a> &#8212; which negatively impacted tens of millions of consumers and greatly enriched a large number of bad guys? Or was it more prosaic, like a <a href="https://krebsonsecurity.com/2014/09/jimmy-johns-confirms-breach-at-216-stores/" target="_blank" rel="noopener">Jimmy Johns</a>-sized debacle?</p>
<p>For that insight, I spoke with <a href="https://geminiadvisory.io/" target="_blank" rel="noopener">Gemini Advisory</a>, a New York-based company that works with financial institutions to monitor dozens of underground markets trafficking in stolen card data.</p>
<p><strong>Andrei Barysevich</strong>, co-founder and CEO at Gemini, said the breach at BriansClub is certainly significant, given that Gemini currently tracks a total of 87 million credit and debit card records for sale across the cybercrime underground.</p>
<p>Gemini is monitoring most underground stores that peddle stolen card data — including such heavy hitters as <a href="https://krebsonsecurity.com/?s=joker%27s+stash&amp;x=0&amp;y=0" target="_blank" rel="noopener">Joker’s Stash</a>, <a href="https://krebsonsecurity.com/2017/05/trumps-dumps-making-dumps-great-again/" target="_blank" rel="noopener">Trump’s Dumps</a>, and BriansDump.</p>
<p>Contrary to popular belief, when these shops sell a stolen credit card record, that record is then removed from the inventory of items for sale. This allows companies like Gemini to determine roughly how many new cards are put up for sale and how many have sold.</p>
<p>Barysevich said the loss of so many valid cards may well impact how other carding stores compete and price their products.</p>
<p>&#8220;With over 78% of the illicit trade of stolen cards attributed to only a dozen of dark web markets, a breach of this magnitude will undoubtedly disturb the underground trade in the short term,&#8221; he said. &#8220;However, since the demand for stolen credit cards is on the rise, other vendors will undoubtedly attempt to capitalize on the disappearance of the top player.&#8221;</p>
<p>Liked this story and want to learn more about how carding shops operate? Check out <a href="https://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/" target="_blank" rel="noopener">Peek Inside a Professional Carding Shop</a>. Want to help this site continue to produce useful, impactful journalism? <a href="https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&amp;hosted_button_id=MCCRKHWRX57HS" target="_blank" rel="noopener">Consider donating</a>!</p>


feed_id: https://krebsonsecurity.com/?p=49267
title: When Card Shops Play Dirty, Consumers Win
uri: When-Card-Shops-Play-Dirty-Consumers-Win
url: https://krebsonsecurity.com/2019/10/when-card-shops-play-dirty-consumers-win/
content:
<p>Cybercrime forums have been abuzz this week over news that <strong>BriansClub</strong> &#8212; one of the underground&#8217;s largest shops for stolen credit and debit cards &#8212; has been hacked, and its <a href="https://krebsonsecurity.com/2019/10/briansclub-hack-rescues-26m-stolen-cards/" target="_blank" rel="noopener">inventory of 26 million cards </a>shared with security contacts in the banking industry. Now it appears this brazen heist may have been the result of one of BriansClub&#8217;s longtime competitors trying to knock out a rival.</p>
<div id="attachment_49240" style="width: 599px" class="wp-caption aligncenter"><img class="wp-image-49240 " src="media/5981cd16.briansdump.gif" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/briansdump.gif" alt="" width="589" height="38" /><p class="wp-caption-text">And advertisement for BriansClub that for years has used my name and likeness to peddle stolen cards.</p></div>
<p>Last month, KrebsOnSecurity was contacted by an anonymous source who said he had the full database of 26M cards stolen from BriansClub, a carding site that has long used this author&#8217;s name and likeness in its advertising. The stolen database included cards added to the site between mid-2015 and August 2019.</p>
<p>This was a major event in the underground, as experts estimate the total number of stolen cards leaked from BriansClub represent almost 30 percent of the cards on the black market today.</p>
<p>The purloined database revealed BriansClub sold roughly 9.1 million stolen credit cards, <em>earning the site and its resellers a cool $126 million in sales over four years</em>.</p>
<p>In response to questions from KrebsOnSecurity, the administrator of BriansClub acknowledged that the data center serving his site had been hacked earlier in the year (BriansClub claims this happened in February), but insisted that all of the cards stolen by the hacker had been removed from BriansClub store inventories.</p>
<p>However, as I noted in Tuesday&#8217;s story, multiple sources confirmed they were able to find plenty of card data included in the leaked database that was still being offered for sale at BriansClub.</p>
<p>Perhaps inevitably, the admin of BriansClub took to the cybercrime forums this week to <a href="media/289aaaef.om-bc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/om-bc.png" target="_blank" rel="noopener">defend his business and reputation</a>, re-stating his claim that all cards included in the leaked dump had been cleared from store shelves.</p>
<div id="attachment_49271" style="width: 591px" class="wp-caption aligncenter"><a class="lightbox" href="media/c02bd7df.bk-bd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/bk-bd.png"><img class="wp-image-49271" src="media/c02bd7df.bk-bd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/bk-bd.png" alt="" width="581" height="127" /></a><p class="wp-caption-text">The administrator of BriansClub, who&#8217;s appropriated the name and likeness of Yours Truly for his advertising, fights to keep his business alive.</p></div>
<p>Meanwhile, some of BriansClub&#8217;s competitors gloated about the break-in. According to the administrator of <strong>Verified</strong>, one of the longest running Russian language cybercrime forums, the hack of BriansClub was perpetrated by a fairly established ne&#8217;er-do-well who uses the nickname &#8220;MrGreen&#8221; and runs a competing card shop by the same name.<span id="more-49267"></span></p>
<p>The Verified site admin said MrGreen had been banned from the forum, and added that &#8220;sending anything to Krebs is the lowest of all lows&#8221; among accomplished and self-respecting cybercriminals. I&#8217;ll take that as a compliment.</p>
<p>This would hardly be the first time some cybercriminal has used me to take down one of his rivals. In most cases, I&#8217;m less interested in the drama and more keen on validating the data and getting it into the proper hands to do some good.</p>
<p>That said, if the remainder of BriansClub&#8217;s competitors want to use me to take down the rest of the carding market, I&#8217;m totally fine with that.</p>
<div id="attachment_49278" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/3a8b364c.om-bcsmaller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/om-bcsmaller.png"><img class="wp-image-49278" src="media/3a8b364c.om-bcsmaller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/om-bcsmaller.png" alt="" width="598" height="282" /></a><p class="wp-caption-text">The BriansClub admin, defending the honor of his stolen cards shop after a major breach.</p></div>


feed_id: https://krebsonsecurity.com/?p=49296
title: Avast, NordVPN Breaches Tied to Phantom User Accounts
uri: Avast-NordVPN-Breaches-Tied-to-Phantom-User-Accounts
url: https://krebsonsecurity.com/2019/10/avast-nordvpn-breaches-tied-to-phantom-user-accounts/
content:
<p>Antivirus and security giant <strong>Avast</strong> and virtual private networking (VPN) software provider <strong>NordVPN</strong> each today disclosed months-long network intrusions that &#8212; while otherwise unrelated &#8212; shared a common cause: Forgotten or unknown user accounts that granted remote access to internal systems with little more than a password.</p>
<p><img class="alignright size-full wp-image-49302" src="media/33749797.avast.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/avast.png" alt="" width="188" height="229" />Based in the Czech Republic, Avast bills itself as the most popular antivirus vendor on the market, with over 435 million users. In <a href="https://blog.avast.com/ccleaner-fights-off-cyberespionage-attempt-abiss" target="_blank" rel="noopener">a blog post</a> today, Avast said it detected and addressed a breach lasting between May and October 2019 that appeared to target users of its <a href="https://en.wikipedia.org/wiki/CCleaner" target="_blank" rel="noopener">CCleaner</a> application, a popular Microsoft Windows cleanup and repair utility.</p>
<p>Avast said it took CCleaner downloads offline in September to check the integrity of the code and ensure it hadn&#8217;t been injected with malware. The company also said it invalidated the certificates used to sign previous versions of the software and pushed out a re-signed clean update of the product via automatic update on October 15. It then disabled and reset all internal user credentials.</p>
<p>&#8220;Having taken all these precautions, we are confident to say that our CCleaner users are protected and unaffected,&#8221; Avast&#8217;s <strong>Jaya Baloo</strong> wrote.</p>
<p>This is not the first so-called &#8220;supply chain&#8221; attack on Avast: In September 2018, researchers at <strong>Cisco Talos</strong> and <strong>Morphisec</strong> <a href="https://www.wired.com/story/ccleaner-malware-supply-chain-software-security/" target="_blank" rel="noopener">disclosed</a> that hackers had compromised the computer cleanup tool for more than a month, <a href="https://www.wired.com/story/inside-the-unnerving-supply-chain-attack-that-corrupted-ccleaner/" target="_blank" rel="noopener">leading to some 2.27 million downloads</a> of the corrupt CCleaner version.</p>
<p>Avast said the intrusion began when attackers used stolen credentials for a VPN service that was configured to connect to its internal network, and that the attackers were not challenged with any sort of multi-factor authentication &#8212; such as a one-time code generated by a mobile app.</p>
<p>&#8220;We found that the internal network was successfully accessed with compromised credentials through a temporary VPN profile that had erroneously been kept enabled and did not require 2FA,&#8221; Baloo wrote.<span id="more-49296"></span></p>
<h4>THE NORDVPN BREACH</h4>
<p>Separately, NordVPN, a virtual private networking services that promises to &#8220;protect your privacy online,&#8221; confirmed <a href="https://twitter.com/hexdefined/status/1186106695073726466?s=21" target="_blank" rel="noopener">reports that it had been hacked</a>. Today&#8217;s acknowledgment and blog post mortem from Nord comes just hours after it emerged that NordVPN had an expired internal private key exposed, potentially allowing anyone to spin out their own servers imitating NordVPN,&#8221; <a href="https://techcrunch.com/2019/10/21/nordvpn-confirms-it-was-hacked/" target="_blank" rel="noopener">writes</a> <a href="https://twitter.com/zackwhittaker" target="_blank" rel="noopener">Zack Whittaker</a> at <em>TechCrunch</em>.</p>
<p><img class="aligncenter size-full wp-image-49303" src="media/9c603cbf.nordvpn.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/nordvpn.png" alt="" width="460" height="152" /></p>
<p>VPN software creates an encrypted tunnel between your computer and the VPN provider, effectively blocking your ISP or anyone else on the network (aside from you and the VPN provider) from being able to tell which sites you are visiting or viewing the contents of your communications. This can offer a measure of anonymity, but the user also is placing a great deal of trust in that VPN service not to get hacked and expose this sensitive browsing data.</p>
<p>NordVPN&#8217;s account seems to downplay the intrusion, saying while the attackers could have used the private keys to intercept and view traffic for some of its customers&#8217; traffic, the attackers would have been limited to eavesdropping on communications routing through just one of the company&#8217;s more than 3,000 servers.</p>
<p>&#8220;The server itself did not contain any user activity logs; none of our applications send user-created credentials for authentication, so usernames and passwords couldn’t have been intercepted either,&#8221; reads the NordVPN blog post. &#8220;On the same note, the only possible way to abuse the website traffic was by performing a personalized and complicated man-in-the-middle attack to intercept a single connection that tried to access NordVPN.&#8221;</p>
<p>NordVPN said the intrusion happened in March 2018 at one of its datacenters in Finland, noting that &#8220;the attacker gained access to the server by exploiting an insecure remote management system left by the datacenter provider while we were unaware that such a system existed.&#8221; NordVPN declined to name the datacenter provider, but said the provider removed the remote management account without notifying them on March 20, 2018.</p>
<p>&#8220;When we learned about the vulnerability the datacenter had a few months back, we immediately terminated the contract with the server provider and shredded all the servers we had been renting from them,&#8221; the company said. &#8220;We did not disclose the exploit immediately because we had to make sure that none of our infrastructure could be prone to similar issues. This couldn’t be done quickly due to the huge amount of servers and the complexity of our infrastructure.&#8221;</p>
<div id="attachment_49301" style="width: 606px" class="wp-caption aligncenter"><img class="wp-image-49301" src="media/3a6e5fdc.nordwarrant.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/nordwarrant.png" alt="" width="596" height="221" /><p class="wp-caption-text">This page might need to be updated.</p></div>
<p>TechCrunch took NordVPN to task on the somewhat dismissive tone of its breach disclosure, noting that the company suffered a significant breach that went undetected for more than a year.</p>
<p><strong>Kenneth White</strong>, director of the <a href="https://opencryptoaudit.org/" target="_blank" rel="noopener">Open Crypto Audit Project</a>, <a href="https://twitter.com/kennwhite/status/1186369692694405120" target="_blank" rel="noopener">said on Twitter</a> that based on <a href="https://www.documentcloud.org/documents/6506133-NordVPN-output.html" target="_blank" rel="noopener">the dumped Pastebin logs</a> detailing the extent of the intrusion, &#8220;the attacker had full remote admin on their Finland node containers.&#8221;</p>
<p>&#8220;That&#8217;s God Mode folks,&#8221; White wrote. &#8220;And they didn&#8217;t log and didn&#8217;t detect it. I&#8217;d treat all their claims with great skepticism.&#8221;</p>
<h4>ANALYSIS</h4>
<p>Many readers are curious about whether they should enshroud all of their online communications by using a VPN. However, it’s important to understand the limitations of this technology, and to take the time to research providers before entrusting them with virtually all your browsing data — and possibly even compounding your privacy woes in the process. For a breakdown on what you should keep in mind when considering a VPN service, <a href="https://krebsonsecurity.com/2017/03/post-fcc-privacy-rules-should-you-vpn/" target="_blank" rel="noopener">see this post</a>.</p>
<p>Forgotten user accounts that provide remote access to internal systems &#8212; such as VPN and <a href="https://krebsonsecurity.com/?s=rdp&amp;x=0&amp;y=0" target="_blank" rel="noopener">Remote Desktop services (RDP)</a> &#8212; have been a persistent source of data breaches for years. Thousands of small to mid-sized brick-and-mortar businesses have been relieved of millions of customer payment card records over the years when their hacked IT contractors used the same remote access credentials at each client location.</p>
<p>Almost all of these breaches could have been stopped by requiring a second form of authentication in addition to a password, which can easily be stolen or phished.</p>
<p>The persistent supply chain attack against Avast brings to mind something I was considering the other day about the wisdom of allowing certain software to auto-update itself whenever it pleases. I&#8217;d heard from a reader who was lamenting the demise of programs like <a href="https://krebsonsecurity.com/2012/06/secunias-auto-patching-tool-gets-makeover/" target="_blank" rel="noopener">Secunia&#8217;s Personal Software Inspector</a> and <a href="https://community.norton.com/en/forums/has-filehippocom-become-zombie-website" target="_blank" rel="noopener">FileHippo</a>, which allowed users to automatically download and install available updates for a broad range of third-party Windows programs.</p>
<p>These days, I find myself seeking out and turning off any auto-update functions in software that I install. I&#8217;d rather be alerted to new updates when I launch the program and have the ability to review what&#8217;s changing and whether anyone has experienced issues with the new version. I guess you could say years of dealing with unexpected surprises on Microsoft Patch Tuesdays has cured me of any sort of affinity I may have once had for auto-update features.</p>


feed_id: https://krebsonsecurity.com/?p=49311
title: Ransomware Hits B2B Payments Firm Billtrust
uri: Ransomware-Hits-B2B-Payments-Firm-Billtrust
url: https://krebsonsecurity.com/2019/10/ransomware-hits-b2b-payments-firm-billtrust/
content:
<p>Business-to-business payments provider <strong>Billtrust</strong> is still recovering from a ransomware attack that began last week.  The company said it is in the final stages of bringing all of its systems back online from backups.</p>
<p><img class="alignright wp-image-49314" src="media/c1ce166c.billtrust.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/billtrust.png" alt="" width="251" height="67" />With more than 550 employees, Lawrence Township, N.J.-based Billtrust is a cloud-based service that lets customers view invoices, pay, or request bills via email or fax. In an email sent to customers today, Billtrust said it was consulting with law enforcement officials and with an outside security firm to determine the extent of the breach.</p>
<p>&#8220;Our standard security and back-up procedures have been and remain instrumental in our ability to execute the ongoing restoration of services,&#8221; the email reads. &#8220;Out of an abundance of caution, we cannot disclose the precise ransomware strains but will do so as soon as prudently possible.</p>
<p>In an interview with KrebsOnSecurity on Monday evening, <strong>Billtrust CEO Steven Pinado</strong> said the company became aware of a malware intrusion on Thursday, Oct. 17.</p>
<p>&#8220;We&#8217;re aware of the malware and have been able to stop the activity within our systems,&#8221; Pinado said. &#8220;We immediately started focusing on control, remediation and protection. The impact of that was several systems were no longer available to our customers. We&#8217;ve been fighting the fight, working on restoring services and also digging into the root cause.&#8221;</p>
<p>A <a href="https://www.bleepingcomputer.com/news/security/billing-provider-billtrust-suffers-outage-after-malware-attack/" target="_blank" rel="noopener">report</a> from <em>BleepingComputer</em> cites an unnamed source saying the ransomware strain that hit Billtrust was the <a href="https://blog.trendmicro.com/trendlabs-security-intelligence/account-with-admin-privileges-abused-to-install-bitpaymer-ransomware-via-psexec/" target="_blank" rel="noopener">BitPaymer ransomware</a>, but that information could not be confirmed.</p>
<p>One of Billtrust&#8217;s customers has published a <a href="http://wittichen-supply.com/billtrust-service-interruption/" target="_blank" rel="noopener">day-by-day chronology of the attack</a> and communications from the company here (h/t <a href="https://twitter.com/GossiTheDog/status/1186590229328781318" target="_blank" rel="noopener">@gossithedog</a>).<span id="more-49311"></span></p>
<p>Pinado said Billtrust had restored most of its systems, and that it was in the process now of putting additional security measures in place. He declined to discuss anything related to the ransomware attack, such as whether the company paid a ransom demand in exchange for a key to unlock files scrambled by the malware, although he allowed Billtrust does have cybersecurity insurance for just such occasions.</p>
<p>Billtrust recently teamed up with Visa to launch the Billtrust Business Payments Network, an effort to digitize payments between businesses.</p>
<p>Cloud service providers are a favorite target of attackers who deal in ransomware. In August, Wisconsin-based <a href="https://krebsonsecurity.com/2019/08/ransomware-bites-dental-data-backup-firm/" target="_blank" rel="noopener">PerCSoft paid a hefty ransom</a> to get out from beneath an attack that separated hundreds of dental offices from their patient records.</p>
<p>In July, attackers <a href="https://krebsonsecurity.com/?s=insynq&amp;x=0&amp;y=0" target="_blank" rel="noopener">hit QuickBooks cloud hosting firm iNSYNQ</a>, holding data hostage for many of the company’s clients. In February, cloud payroll data provider <strong>Apex Human Capital Management</strong> was <a href="https://krebsonsecurity.com/2019/02/payroll-provider-gives-extortionists-a-payday/" target="_blank" rel="noopener">knocked offline for three days</a> following a ransomware infestation.</p>
<p>On Christmas Eve 2018, cloud hosting provider <strong>Dataresolution.net</strong> <a href="https://krebsonsecurity.com/2019/01/cloud-hosting-provider-dataresolution-net-battling-christmas-eve-ransomware-attack/" target="_blank" rel="noopener">took its systems offline</a> in response to a ransomware outbreak on its internal networks. The company was adamant that it would not pay the ransom demand, but it ended up taking several weeks for customers to fully regain access to their data.</p>


feed_id: https://krebsonsecurity.com/?p=49322
title: Cachet Financial Reeling from MyPayrollHR Fraud
uri: Cachet-Financial-Reeling-from-MyPayrollHR-Fraud
url: https://krebsonsecurity.com/2019/10/cachet-financial-reeling-from-mypayrollhr-fraud/
content:
<p>When New York-based cloud payroll provider <strong>MyPayrollHR</strong> unexpectedly shuttered its doors last month and <a href="https://krebsonsecurity.com/2019/09/mypayrollhr-ceo-arrested-admits-to-70m-fraud/" target="_blank" rel="noopener">disappeared with $26 million worth of customer payroll deposits</a>, its payment processor <strong>Cachet Financial Services</strong> ended up funding the bank accounts of MyPayrollHR client company employees anyway, graciously eating a $26 million loss which it is now suing to recover.</p>
<p>But on Oct. 23 &#8212; less than 24 hours before another weekly payroll rush &#8212; Pasadena, Calif.-based Cachet threw much of its customer base into disarray when it said its bank was no longer willing to risk another MyPayrollHR debacle, and that customers would need to wire payroll deposits instead of relying on the usual method of automated clearinghouse (ACH) payments (essentially bank-to-bank checks).</p>
<p><img class="aligncenter size-full wp-image-49331" src="media/5b3419f0.payroll.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/payroll.jpg" alt="" width="500" height="334" /></p>
<p>Cachet processes some $150 billion in payroll payments annually for more than 110,000 employers. But payroll experts say this week&#8217;s actions by Cachet&#8217;s bank may well soon put the 22-year-old company out of business.</p>
<p>&#8220;We apologize for the inconvenience of this message,&#8221; reads the communication from Cachet that went out to customers just after 6:30 PM ET on Oct. 23. It continued:</p>
<blockquote><p>&#8220;Due to ongoing fraud protocol with our bank, they are requiring pre-funding via Direct Wire for all batches that were uploaded this week, unless employees were already paid or tax payments were already transmitted. This includes all batch files moving forward.&#8221;</p>
<p>All files that were uploaded today for collection and disbursement will not be processed. In order to process disbursement, we will need to receive a wire first thing tomorrow in order to release the disbursements.</p>
<p>All collections that were processed prior to today will be reviewed by the bank and disbursements will be released once the funds are cleared. Credit trans</p>
<p>Deadline for wires is 1 P.M. PST.</p>
<p>This will be the process until further notice. If you need a backup processor, please contact us.</p>
<p>If you require wire instructions, please respond to this email and they will be sent to you.</p>
<p>We welcome and anticipate your phone calls and inquiries. We remain committed to our clients and are determined to see this through. We appreciate and thank you for your patience and understanding.&#8221;</p></blockquote>
<p>In a follow-up communication sent Thursday evening, Cachet said all debit transactions with a settlement date of Oct. 23 had been processed, but that any transactions uploaded after Oct. 23 were not being processed at all, and that wires are no longer being accepted.</p>
<p>&#8220;If they aren&#8217;t taking money, they&#8217;re out of business,&#8221; Friedl said of Cachet.</p>
<p>Cachet&#8217;s financial institution, Wilmington, Del. based <strong>The Bancorp Bank</strong> (<a href="https://www.nasdaq.com/market-activity/stocks/tbbk" target="_blank" rel="noopener">NASDAQ: TBBK</a>), did not respond to requests for comment.</p>
<p>Cachet also did not respond to requests for comment. But in an email Thursday evening, the company sought to offer customers a range of alternatives &#8212; including other providers &#8212; to help process payrolls this week.</p>
<p><img class="aligncenter wp-image-49326" src="media/5a801607.cachet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/cachet.png" alt="" width="596" height="456" /></p>
<p><strong>Steve Friedl</strong>, an IT consultant in the payroll service bureau industry, said the Cachet announcement has sent payroll providers scrambling to cut and mail or courier paper checks to client employees.  But he said many payroll providers also use Cachet to process tax withholdings for client employees, and that this, too, could be disrupted by the funding changes.</p>
<p>&#8220;There&#8217;s a lot of same day stuff that goes on in the payroll industry that depends on people being honest and having money available at certain times,&#8221; Friedl said. &#8220;When that&#8217;s not possible because a bank in that process says it doesn&#8217;t want to be stuck in the middle that can create problems for a lot of people who are then stuck in the middle.&#8221;</p>
<p>Another payroll expert at a company that uses Cachet but who asked not to be named said, &#8220;everyone I know at payroll providers is scrambling to get it done another way this week&#8221; as a result of the decision by Cachet&#8217;s bank.</p>
<p>&#8220;Those bureaus will do whatever they can to keep their clients happy because something like this can quickly put them out of business,&#8221; the source said. &#8220;Unlike what happened with MyPayrollHR &#8212; which harmed consumers directly &#8212; the payment service bureaus are the ones potentially getting hurt here.&#8221;<span id="more-49322"></span></p>
<p>Most corporate payroll is handled through ACH transactions, a system that allows financial institutions to push and pull funds to and from checking accounts between banks. ACH is essentially the same thing as writing a check for a good or service, and it typically involves an element of trust because there is a time delay (24-48h) between which the promised funds are released to the receiving bank and the funds are made available to the recipient.</p>
<p>In contrast, a wire transfer takes minutes and the funds are made available to the recipient almost immediately. Wires are also far more expensive for customers, and they earn banks hugely profitable processing fees, whereas ACH transaction fees are minuscule by comparison.</p>
<p>Ultimately, banks may decide that for certain clients they no longer wish to assume the risk of fraudsters exploiting the float period for ACH transactions to steal tens of millions of dollars, as was the case in the MyPayrollHR fiasco.</p>
<p>It&#8217;s worth noting that the MyPayrollHR fraud wasn&#8217;t the first time Cachet has been tripped up by the demise of a payroll company: In 2016, the collapse of Monterey, Calif. based payroll processor <strong>Pinnacle Workforce Solutions</strong> left Cachet <a href="https://www.montereycountyweekly.com/news/local_news/a-federal-lawsuit-outlines-how-pinnacle-workforce-solutions-lost-millions/article_02b069be-dddc-11e6-a364-b3cf222f5d72.html" target="_blank" rel="noopener">holding the bag for more than $1 million</a>. Cachet sued to recover the money stuck in Pinnacle&#8217;s frozen accounts. From <em>The Monetery County Weekly</em>:</p>
<blockquote><p>&#8220;Cachet’s lawyers also outline possible nefarious action by Pinnacle. ACH companies act as middlemen for processing payroll and other large transactions. Every pay period, Pinnacle would send Cachet a coded file to tell the ACH how to distribute funds. But, on Sept. 21 [2016] Pinnacle had manipulated the code sent to Cachet so the money collected from its clients went directly to Pinnacle instead of being held in the ACH account before being distributed to its clients’ employees, the suit alleges.&#8221;</p></blockquote>
<p>It will be interesting to see how long the fallout from the MyPayrollHR episode will last and how many other firms may get wiped because of it. Shortly after MyPayrollHR closed its doors last month and disappeared with $35 million in payroll and tax payments, the company&#8217;s 49-year-old CEO Michael Mann was <a href="https://krebsonsecurity.com/2019/09/mypayrollhr-ceo-arrested-admits-to-70m-fraud/" target="_blank" rel="noopener">arrested and charged with bank fraud</a>.</p>
<p>The government alleges Mann was kiting millions of dollars in checks between his accounts at Bank of American and Pioneer from Aug. 1, 2019 to Aug. 30, 2019. <em>The Times Union</em> <a href="https://www.timesunion.com/business/article/MyPayrollHR-debacle-Insurance-company-sues-14549935.php" target="_blank" rel="noopener">reports</a> that Mann and his company are now being sued by Pioneer Bank and a large insurance company over a $42 million loan it gave to Mann and his companies just a month before his payroll business closed up shop.</p>


feed_id: https://krebsonsecurity.com/?p=49342
title: Takeaways from the $566M BriansClub Breach
uri: Takeaways-from-the-566M-BriansClub-Breach
url: https://krebsonsecurity.com/2019/10/takeaways-from-the-566m-briansclub-breach/
content:
<p>Reporting on the exposure of some <a href="https://krebsonsecurity.com/2019/10/briansclub-hack-rescues-26m-stolen-cards/" target="_blank" rel="noopener">26 million stolen credit cards leaked from a top underground cybercrime store</a> highlighted some persistent and hard truths. Most notably, that the world&#8217;s largest financial institutions tend to have a much better idea of which merchants and bank cards have been breached than do the thousands of smaller banks and credit unions across the United States. Also, a great deal of cybercrime seems to be perpetrated by a relatively small number of people.</p>
<p><img class="aligncenter wp-image-49240" src="media/5981cd16.briansdump.gif" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/briansdump.gif" alt="" width="592" height="38" /></p>
<p>In September, an anonymous source sent KrebsOnSecurity a link to a nearly 10 gb set of files that included data for approximately 26 million credit and debit cards stolen from hundreds &#8212; if not thousands &#8212; of hacked online and brick-and-mortar businesses over the past four years.</p>
<p>The data was taken from BriansClub, an underground &#8220;carding&#8221; store that has (ab)used this author&#8217;s name, likeness and reputation in its advertising since 2015. The card accounts were stolen by hackers or &#8220;resellers&#8221; who make a living breaking into payment card systems online and in the real world. Those resellers then share the revenue from any cards sold through BriansClub.</p>
<p>KrebsOnSecurity shared a copy of the BriansClub card database with <a href="https://www.geminiadvisory.io" target="_blank" rel="noopener">Gemini Advisory</a>, a New York-based company that monitors BriansClub and dozens of other carding shops to learn when new cards are added and when existing inventory is removed (sold).</p>
<p>Gemini estimates that the 26 million cards &#8212; 46 percent credit cards and 54 percent debit cards &#8212; <em>representing almost one-third of the existing 87 million credit and debit card accounts currently for sale in the underground.</em></p>
<p>&#8220;While many of these cards were added in previous years, more than 21.6 million will not expire until after October 2019, offering cybercriminal buyers ample opportunity to cash out these records,&#8221; Gemini wrote in an analysis of the BriansClub data shared with this author.</p>
<p>Cards stolen from U.S. residents made up the bulk of the data set (~24 million of the 26+ million cards), and as a result these far more plentiful cards were priced much lower than cards from banks outside the U.S. Between 2016 and 2019, cards stolen from U.S.-based bank customers fetched between $12.76 and $16.80 apiece, while non-U.S. cards were priced between $17.04 and $35.70 during the same period.</p>
<div id="attachment_49359" style="width: 606px" class="wp-caption aligncenter"><img class=" wp-image-49359" src="media/2797f127.bc-cardpricedata15-19.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/bc-cardpricedata15-19.png" alt="" width="596" height="421" /><p class="wp-caption-text">Image: Gemini Advisory.</p></div>
<p>Unfortunately for cybercrime investigators, the person who hacked BriansClub has not released (at least not to this author) any information about the BriansClub users, payments, vendors or resellers. [Side note: This hasn&#8217;t stopped an unscrupulous huckster from approaching several of my financial industry sources with unlikely offers of said data in exchange for bitcoin].</p>
<p>But the database does have records of which cards were sold and which resellers (identified only by a unique number) supplied those cards, Gemini found.</p>
<p>&#8220;While neither the vendor nor the buyer usernames appeared in this database, they were each assigned ID numbers,&#8221; Gemini wrote. &#8220;This allowed analysts to determine how prolific certain threat actors were on BriansClub and derive relevant metrics from this data.&#8221;</p>
<p>According to Gemini, there were 142 resellers and more than 50,000 buyers of the card data sold through BriansClub. These buyers purchased at least 9 million of the 27.2 million cards available.<span id="more-49342"></span></p>
<div id="attachment_49360" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/88de3ff7.bc-top20buyers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/bc-top20buyers.png"><img class="wp-image-49360" src="media/88de3ff7.bc-top20buyers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/bc-top20buyers.png" alt="" width="596" height="352" /></a><p class="wp-caption-text">Image: Gemini Advisory</p></div>
<p>One reseller in particular (ID: 174,829) offered just shy of 6 million records, posted for $106 million. Of those, almost 940,000 were sold, grossing over $16 million in profits shared between BriansClub and the reseller. In the quote below, a &#8220;base&#8221; refers to a distinct batch of freshly-stolen card data uploaded to BriansClub.</p>
<p>&#8220;For context, the collective price for the entirety of exposed BriansClub records was $566 million, while the total dollar amount of all sold records exceeded $162 million,&#8221; Gemini noted. &#8220;The top 20 buyers bought 5% of the entire set of records in this shop, while the top 100 buyers accounted for 11%. The shop had a total of 11,000 bases, with most vendors uploading multiple bases.&#8221;</p>
<div id="attachment_49361" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/373c91bd.bc-top20sellers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/bc-top20sellers.png"><img class="wp-image-49361" src="media/373c91bd.bc-top20sellers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/bc-top20sellers.png" alt="" width="595" height="199" /></a><p class="wp-caption-text">Image: Gemini Advisory</p></div>
<p>All the 26 million+ card records leaked from BriansClub were shared with multiple trusted sources that work directly with financial institutions to inform them when their customers&#8217; cards go up for sale in the cybercrime underground.</p>
<p>Banks at this point basically have three options. Ignore the report and hope for the best. Cancel the card and reissue. Or monitor the card more closely and place tighter fraud controls on that account.</p>
<p>But here&#8217;s the thing: Not all banks got the data at the same time. The larger banks got it first and largely shrugged. At least according to anti-fraud sources at two large U.S.-based financial institutions: Their anti-fraud teams had already identified 90-95 percent of the cards as potentially compromised in one of hundreds of breaches since 2015, mostly those involving malware inside point-of-sale payment terminals.</p>
<p>The sources I spoke with at smaller financial institutions found out about the cards they&#8217;d issued to customers that wound up in the BriansClub database by receiving alerts last week from <strong>Visa</strong> and <strong>MasterCard</strong>. Most of those sources seemed genuinely surprised at the number of cards exposed, and two sources at different credit unions each estimated they were previously unaware of about 80 percent of the cards listed in the alerts from the credit card companies.</p>
<p>Also, smaller financial institutions are far more likely to eat the cost of re-issuing cards at risk of fraudulent use than are larger institutions, which typically have much a higher tolerance for financial losses from counterfeit card fraud. So far, however, there is no evidence this flood of card data intelligence to the banking sector is causing much of stampede for re-issuing cards.</p>
<p>Visa maintains that smaller financial institutions receive the same alerts sent to larger banks about cards thought to be exposed in specific breaches. The alerts include cards specific to each bank, but smaller banks are often limited in the resources they have available to do much with the reported card data, aside from re-issuing the card.</p>
<p>Gemini CEO and co-founder <strong>Andrei Barysevich</strong> said so far the feedback from the banks has been all over the place.</p>
<p>&#8220;While the larger US banks told us that most of the cards have been previously flagged as compromised, the mid and small size financial institutions were caught completely off-guard,&#8221; he said. &#8220;As to the European and Asian banks, to them the data was mostly new, in some cases upwards of 60% of cards were still open and active.&#8221;</p>
<p>I thought perhaps the card associations could provide some meta-statistics on the BriansClub dump, but also those hopes were dashed. MasterCard did not respond to requests for comment. Visa declined to share any information related to the BriansClub database (even though they got it indirectly courtesy of Yours Truly), but issued the following statement:</p>
<p>“As part of our core mission to ensure security across the payment system, we are very aware of carder forums and other criminal enterprises. Visa continuously invests in intelligence and technology to detect cyber threats and works with law enforcement, clients and other partners, to mitigate and disrupt such threats.</p>
<p>“Whenever we discover compromised account information, Visa uses its payment intelligence and investigative capabilities to determine the source. We also work with our financial institution clients to provide card issuers with the compromised account numbers so they can take steps to protect consumers through independent fraud monitoring and, if needed, by reissuing cards. Incidents such as these reinforce the need for secure technologies such as chip and tokenization to devalue account information so that even if stolen, data cannot be leveraged for fraud.”&#8221;</p>
<p>Gemini found that exactly two-thirds of the stolen cards (66.6 percent) siphoned from BriansClub were Visa-branded, and 23 percent MasterCard. A full 85% of the total records were EMV (chip) enabled, with the remaining 15% using only a magnetic stripe.</p>
<p>One final note: Gemini report also challenges <a href="https://krebsonsecurity.com/2019/10/when-card-shops-play-dirty-consumers-win/" target="_blank" rel="noopener">claims made by the administrator of BriansClub</a>, namely that he removed the breached cards from his online store and that the data leak stemmed from a breach in February as his site&#8217;s data center.</p>
<div id="attachment_49278" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/3a8b364c.om-bcsmaller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/om-bcsmaller.png"><img class="wp-image-49278" src="media/3a8b364c.om-bcsmaller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/om-bcsmaller.png" alt="" width="596" height="282" /></a><p class="wp-caption-text">The BriansClub admin, defending the honor of his stolen cards shop after a major breach.</p></div>
<p>&#8220;While the administrator of BriansClub, operating under the moniker &#8216;Brian Krebs,&#8217; claimed that the breach took place in February 2019, this appears to be false,&#8221; Gemini observed in its report. &#8220;The number of records from South Korea corresponds to a previous spike in South Korean records that occurred from March 2019 through July 2019. If BriansClub were breached in February, the South Korean-issued cards would number under 10,000 rather than over 1 million.&#8221;</p>
<p>The report continues:</p>
<p>&#8220;This threat actor also claimed to have removed the compromised records from the shop. Gemini has found this claim to be false as well. Since BriansClub offers a &#8216;checker service&#8217; for all purchased records to determine whether compromised payment cards are still open, it may be unnecessary to remove the cards. The shop likely assumes that even if the banks received the compromised card data from this breach, they are unlikely to close down and reissue every single card.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=49386
title: Breaches at NetworkSolutions, Register.com, and Web.com
uri: Breaches-at-NetworkSolutions-Register-com-and-Web-com
url: https://krebsonsecurity.com/2019/10/breaches-at-networksolutions-register-com-and-web-com/
content:
<p>Top domain name registrars <strong>NetworkSolutions.com</strong>, <strong>Register.com</strong> and <strong>Web.com</strong> are asking customers to reset their passwords after discovering an intrusion in August 2019 in which customer account information was accessed.</p>
<div id="attachment_49389" style="width: 603px" class="wp-caption aligncenter"><a class="lightbox" href="media/bc32e152.webcom.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/webcom.png"><img class="wp-image-49389" src="media/bc32e152.webcom.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/webcom.png" alt="" width="593" height="348" /></a><p class="wp-caption-text">A notice to customers at notice.web.com.</p></div>
<p>&#8220;On October 16, 2019, Web.com determined that a third-party gained unauthorized access to a limited number of its computer systems in late August 2019, and as a result, account information may have been accessed,&#8221; Web.com said in a written statement. &#8220;No credit card data was compromised as a result of this incident.&#8221;</p>
<p>The Jacksonville, Fla.-based Web.com said the information exposed includes &#8220;contact details such as name, address, phone numbers, email address and information about the services that we offer to a given account holder.&#8221;</p>
<p>The &#8220;such as&#8221; wording made me ask whether the company has any reason to believe passwords &#8212; scrambled or otherwise &#8212; were accessed.</p>
<p>A spokesperson for Web.com later clarified that the company does not believe customer passwords were accessed.</p>
<blockquote><p>&#8220;We encrypt account passwords and do not believe this information is vulnerable as a specific result of this incident. As an added precautionary measure, customers will be required to reset passwords the next time they log in to their accounts. As with any online service or platform, it is also good security practice to change passwords often and use a unique password for each service.&#8221;</p></blockquote>
<p>Both Network Solutions and Register.com are owned by Web.com. Network Solutions is now the world&#8217;s fifth-largest domain name registrar, with almost seven million domains in its stable, according to <a href="https://www.domainstate.com/registrar-stats.html" target="_blank" rel="noopener">domainstate.com</a>; Register.com listed at #17 with 1.7 million domains.<span id="more-49386"></span></p>
<div id="attachment_49391" style="width: 604px" class="wp-caption aligncenter"><img class=" wp-image-49391" src="media/9fe0ba54.webcomsite.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/webcomsite.png" alt="" width="594" height="347" /><p class="wp-caption-text">Web.com&#8217;s homepage currently makes no mention of the breach notification.</p></div>
<p>NetworkSolutions.com does not appear to currently link to any information about the incident on its homepage, nor does Web.com. To get to the advisory, one needs to visit <a href="https://notice.web.com" target="_blank" rel="noopener">notice.web.com</a>.</p>
<p>Web.com said it has reported the incident to law enforcement and hired an outside security firm to investigate further, and is in the process of notifying affected customers through email and <a href="https://notice.web.com/" target="_blank" rel="noopener">via its website</a>.</p>
<p>The company says it plans to circle back with customers when it learns the results of its investigation, but I wonder whether we&#8217;ll ever hear more about this breach.</p>
<p>Web.com wasn&#8217;t clear how long the intrusion lasted, but if the breach wasn&#8217;t detected until mid-October that means the intruders potentially had about six weeks inside unnoticed. That&#8217;s a long time for an adversary to wander about one&#8217;s network, and plenty of time to steal a great deal more information than just names, addresses and phone numbers.</p>
<p>H/T to <a href="https://domaininvesting.com/web-com-reports-security-incident-at-registrars/" target="_blank" rel="noopener">domaininvesting.com</a>&#8216;s <strong>Elliot Silver </strong>for the heads up on this notification.</p>


feed_id: https://krebsonsecurity.com/?p=49409
title: NCR Barred Mint, QuickBooks from Banking Platform During Account Takeover Storm
uri: NCR-Barred-Mint-QuickBooks-from-Banking-Platform-During-Account-Takeo
url:
https://krebsonsecurity.com/2019/11/ncr-barred-mint-quickbooks-from-banking-platform-during-account-takeover-storm/

content:
<p>Banking industry giant <strong>NCR Corp.</strong> [<a href="https://www.google.com/search?rlz=1C1SQJL_enUS858US858&amp;sxsrf=ACYBGNTT8RakelvmicXkMqpkUldtImdgMg:1572815817512&amp;q=NYSE:+NCR&amp;stick=H4sIAAAAAAAAAONgecRowS3w8sc9YSn9SWtOXmPU5OIKzsgvd80rySypFJLmYoOyBKX4uXj10_UNDZPNCouKTcpyeRaxcvpFBrtaKfg5BwEA0iv3ekkAAAA&amp;sa=X&amp;ved=2ahUKEwik_-XA-87lAhVkvFkKHfwDCXQQsRUwHnoECAgQAw&amp;biw=1920&amp;bih=937" target="_blank" rel="noopener">NYSE: NCR</a>] late last month took the unusual step of temporarily blocking third-party financial data aggregators <strong>Mint</strong> and <strong>QuicBooks Online</strong> from accessing <strong>Digital Insight</strong>, an online banking platform used by hundreds of financial institutions. That ban, which came in response to a series of bank account takeovers in which cybercriminals used aggregation sites to surveil and drain consumer accounts, has since been rescinded. But the incident raises fresh questions about the proper role of digital banking platforms in fighting password abuse.</p>
<div id="attachment_49418" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/d3f1a9f9.ncr3rd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/ncr3rd.png"><img class="wp-image-49418" src="media/d3f1a9f9.ncr3rd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/ncr3rd.png" alt="" width="596" height="406" /></a><p class="wp-caption-text">Part of a communication NCR sent Oct. 25 to banks on its Digital Insight online banking platform.</p></div>
<p>On Oct. 29, KrebsOnSecurity heard from a chief security officer at a U.S.-based credit union and Digital Insight customer who said his institution just had several dozen customer accounts hacked over the previous week. The source, who asked to remain anonymous, said the unauthorized activity came from accounts at both Mint and QuickBooks &#8212; services that let consumers aggregate account and transaction data from multiple financial institutions.</p>
<p>My banking source said the attackers appeared to automate the unauthorized logins, which took place over a week in several distinct 12-hour periods in which a new account was accessed every five to ten minutes.</p>
<p>Most concerning, the source said, was that in many cases the aggregator service did not pass through prompts sent by the credit union&#8217;s site for multi-factor authentication, meaning the attackers could access customer accounts with nothing more than a username and password.</p>
<p>&#8220;The weird part is sometimes the attackers are getting the multi-factor challenge, and sometimes they aren&#8217;t,&#8221; said the source, who added that he suspected a breach at Mint and/QuickBooks because NCR had just blocked the two companies from accessing bank Web sites on its platform.</p>
<p>In a statement provided to KrebsOnSecurity, NCR said that on Friday, Oct. 25, NCR notified Digital Insight customers &#8220;that the aggregation capabilities of certain third-party product were being temporarily suspended.&#8221;</p>
<p>&#8220;The notification was sent while we investigated a report involving a single user and a third-party product that aggregates bank data,&#8221; reads their statement, which was sent to customers on Oct. 29. After confirming that the incident was contained, NCR restored connectivity that is used for account aggregation. As criminals deploy more sophisticated methods and tools to access online information, NCR continues to evaluate and proactively defend against these activities.&#8221;</p>
<p>What were these sophisticated methods? NCR wouldn&#8217;t say, but it seems clear the hacked accounts are tied to customers re-using their online banking passwords at other sites that got hacked.</p>
<p>As I noted earlier this year in <a href="https://krebsonsecurity.com/2019/08/the-risk-of-weak-online-banking-passwords/" target="_blank" rel="noopener">The Risk of Weak Online Banking Passwords</a>, if you bank online and choose weak or re-used passwords, there’s a decent chance your account could be pilfered by cyberthieves — even if your bank offers multi-factor authentication as part of its login process.<span id="more-49409"></span></p>
<p>Crooks are constantly probing bank Web sites for customer accounts protected by weak or recycled passwords. Most often, the attacker will use lists of email addresses and passwords stolen en masse from hacked sites and then try those same credentials to see if they permit online access to accounts at a range of banks.</p>
<div id="attachment_48470" style="width: 510px" class="wp-caption aligncenter"><img class="size-full wp-image-48470" src="media/ecb9675f.chasebrute-ed2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/chasebrute-ed2.png" alt="" width="500" height="294" /><p class="wp-caption-text">A screenshot of a password-checking tool that can be used to target Chase Bank customers who re-use passwords. There are tools like this one for just about every other major U.S. bank.</p></div>
<p>From there, thieves can take the list of successful logins and feed them into apps that rely on application programming interfaces (API)s from one of several personal financial data aggregators, including <a href="https://www.mint.com/" target="_blank" rel="noopener">Mint</a>, <a href="https://www.plaid.com" target="_blank" rel="noopener">Plaid</a>, QuickBooks,  <a href="https://www.plaid.com/" target="_blank" rel="noopener">Plaid</a>, <a href="https://www.yodlee.com/" target="_blank" rel="noopener">Yodlee</a>, and<strong> </strong><a href="https://www.youneedabudget.com/" target="_blank" rel="noopener">YNAB</a>.</p>
<p>A number of banks that do offer customers multi-factor authentication — such as a one-time code sent via text message or an app — have chosen to allow these aggregators the ability to view balances and recent transactions without requiring that the aggregator service supply that second factor.</p>
<p>If the thieves are able to access a bank account via an aggregator service or API, they can view the customer’s balance(s) and decide which customers are worthy of further targeting.</p>
<p>But beyond targeting customers for outright account takeovers, the data available via financial aggregators enables a far more insidious type of fraud: <em>The ability to link the target’s bank account(s) to other accounts that the attackers control.</em></p>
<p>That’s because <strong>PayPal</strong>, <strong>Zelle</strong>, and a number of other pure-play online financial institutions allow customers to link accounts by verifying the value of microdeposits. For example, if you wish to be able to transfer funds between PayPal and a bank account, the company will first send a couple of tiny deposits  — a few cents, usually — to the account you wish to link. Only after verifying those exact amounts will the account-linking request be granted.</p>
<p>The temporary blocking of data aggregators by NCR brings up a point worthy of discussion by regulators: Namely, in the absence of additional security measures put in place by the aggregators, do the digital banking platform providers like NCR, <a href="https://krebsonsecurity.com/?s=fiserv&amp;x=0&amp;y=0" target="_blank" rel="noopener">Fiserv</a>, <strong>Jack Henry</strong>, and <strong>FIS</strong> have an obligation to help block or mitigate these large-scale credential exploitation attacks?</p>
<p>KrebsOnSecurity would argue they do, and that the crooks who attacked the customers of my source&#8217;s credit union have probably already moved on <a href="https://ofx-prod-filist.intuit.com/qb1800/data/fidir.txt" target="_blank" rel="noopener">to using the same attack against one of several thousand other dinky banks across the country</a>.</p>
<p><strong>Intuit Inc.</strong>, which owns both Mint and QuickBooks, has not responded to requests for comment.</p>
<p>NCR declined to discuss specifics about how it plans to respond to similar attacks going forward.</p>
<p>&#8220;NCR does not make public comment on methods and tactics of malicious actors,&#8221; the company&#8217;s statement read. &#8220;As we noted, the criminals are getting aggressive and creative in accessing tools to access online information, NCR continues to evaluate and proactively defend against these activities.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=49338
title: Study: Ransomware, Data Breaches at Hospitals tied to Uptick in Fatal Heart Attacks
uri: Study-Ransomware-Data-Breaches-at-Hospitals-tied-to-Uptick-in-Fatal
url:
https://krebsonsecurity.com/2019/11/study-ransomware-data-breaches-at-hospitals-tied-to-uptick-in-fatal-heart-attacks/

content:
<p>Hospitals that have been hit by a data breach or ransomware attack can expect to see an increase in the death rate among heart patients in the following months or years because of cybersecurity remediation efforts, a new study posits. Health industry experts say the findings should prompt a larger review of how security &#8212; or the lack thereof &#8212; may be impacting patient outcomes.</p>
<p><img class="aligncenter size-full wp-image-49443" src="media/034bc289.ekg-fl.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/ekg-fl.jpg" alt="" width="500" height="375" /></p>
<p>Researchers at <strong>Vanderbilt University</strong>&#8216;s Owen Graduate School of Management took the <strong>Department of Health and Human Services</strong> (HHS) list of healthcare data breaches and used it to drill down on data about patient mortality rates at more than 3,000 Medicare-certified hospitals, about 10 percent of which had experienced a data breach.</p>
<p>As <strong>PBS</strong> <a href="https://www.pbs.org/newshour/science/ransomware-and-other-data-breaches-linked-to-uptick-in-fatal-heart-attacks" target="_blank" rel="noopener">noted in its coverage</a> of the Vanderbilt study, after data breaches as many as 36 additional deaths per 10,000 heart attacks occurred annually at the hundreds of hospitals examined.</p>
<p>The researchers found that for care centers that experienced a breach, it took an additional 2.7 minutes for suspected heart attack patients to receive an electrocardiogram.</p>
<p>&#8220;Breach remediation efforts were associated with deterioration in timeliness of care and patient outcomes,&#8221; the authors found. &#8220;Remediation activity may introduce changes that delay, complicate or disrupt health IT and patient care processes.&#8221;</p>
<p><strong>Leo Scanlon</strong>, former deputy chief information security officer at the HHS, said the findings in this report practically beg for a similar study to be done in the United Kingdom, whose healthcare system was particularly disrupted by the Wannacry virus, a global contagion in May 2017 that spread through a Microsoft Windows vulnerability prevalent in older healthcare systems.</p>
<p>&#8220;The exploitation of cybersecurity vulnerabilities is killing people,&#8221; Scanlon told KrebsOnSecurity. &#8220;There is a lot of possible research that might be unleashed by this study. I believe that nothing less than a congressional investigation will give the subject the attention it deserves.&#8221;</p>
<p>A <a href="media/7b3105d4.Investigation-WannaCry-cyber-attack-and-the-NHS.pdf" data-original-source="https://www.nao.org.uk/wp-content/uploads/2017/10/Investigation-WannaCry-cyber-attack-and-the-NHS.pdf" target="_blank" rel="noopener">post-mortem on the impact of WannaCry</a> found the outbreak cost U.K. hospitals almost $100 million pounds and caused significant disruption to patient care, such as the cancellation of some 19,000 appointments &#8212; including operations &#8212; and the disruption of IT systems for at least a third of all <strong>U.K. National Health Service</strong> (NHS) hospitals and eight percent of general practitioners. In several cases, hospitals in the U.K. were forced to divert emergency room visitors to other hospitals.</p>
<p>But what isn’t yet known is how Wannacry affected mortality rates among heart attack and stroke patients whose ambulances were diverted to other hospitals because of IT system outages related to the malware. Or how many hospitals and practices experienced delays in getting test results back needed to make critical healthcare decisions.</p>
<p>Scanlon said although he&#8217;s asked around quite a bit over the years to see if any researchers have taken up the challenge of finding out, and that so far he hasn&#8217;t found anyone doing that analysis.</p>
<p>&#8220;A colleague who is familiar with large scale healthcare data sets told me that unless you are associated with a research institution, it would be almost impossible to pry that kind of data out of the institutions that have it,&#8221; Scanlon said. &#8220;The problem is this data is hard to come by &#8212; nobody likes to admit that death can be attributable to a non-natural cause like this &#8212; and is otherwise considered sensitive at a very high and proprietary level by the institutions that have the facts.&#8221;</p>
<p>A study published <a href="https://www.nejm.org/doi/full/10.1056/NEJMsa1614073" target="_blank" rel="noopener">in the April 2017 edition</a> of <em>The New England Journal of Medicine</em> would seem to suggest applying the approach used by the Vanderbilt researchers to measuring patient outcomes at U.K. hospitals in the wake of Wannacry might be worth carrying out.</p>
<p>In the NEJM study, morbidity and mortality data was used to show that there is a measurable impact when ambulances and emergency response teams are removed from normal service and redirected to standby during public events like marathons and other potential targets of terrorism.</p>
<p>The study found that &#8220;medicare beneficiaries who were admitted to marathon-affected hospitals with acute myocardial infarction or cardiac arrest on marathon dates had longer ambulance transport times before noon (4.4 minutes longer) and higher 30-day mortality than beneficiaries who were hospitalized on nonmarathon dates.&#8221;<span id="more-49338"></span></p>
<p>&#8220;Several colleagues and I are convinced that the same can be shown about WannaCry, on the large scale, and also at the small scale when ransomware attacks impact a regional hospital,&#8221; Scanlon said.</p>
<p>In November 2018, I was honored to give the keynote at a conference held by the <a href="https://h-isac.org/" target="_blank" rel="noopener">Health Information Sharing and Analysis Center (H-ISAC)</a>, a non-profit that promotes the sharing of cyber threat information and best practices in the healthcare sector.</p>
<p>In the weeks leading up to that speech, I interviewed more than a dozen experts in healthcare security to find out what was top of mind for these folks. Incredibly, one response I heard from multiple healthcare industry experts was that there is currently no data available to support the finding of a negative patient outcome as a result of a cybersecurity vulnerability or attack.</p>
<p><span style="font-weight: 400;">As I kept talking to experts, it occurred to me that if smart people in this industry could say something like that with a straight face, it was probably because not a lot of people were looking too hard for evidence to the contrary. </span></p>
<p>With this Vanderbilt study, that&#8217;s demonstrably no longer true.</p>
<p>A copy of the new study is available <a href="https://onlinelibrary.wiley.com/doi/pdf/10.1111/1475-6773.13203" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=49405
title: Retailer Orvis.com Leaked Hundreds of Internal Passwords on Pastebin
uri: Retailer-Orvis-com-Leaked-Hundreds-of-Internal-Passwords-on-Pastebin
url:
https://krebsonsecurity.com/2019/11/retailer-orvis-com-leaked-hundreds-of-internal-passwords-on-pastebin/

content:
<p><strong><a href="https://www.orvis.com" target="_blank" rel="noopener">Orvis</a></strong>, a Vermont-based retailer that specializes in high-end fly fishing equipment and other sporting goods, leaked hundreds of internal passwords on <strong>Pastebin.com</strong> for several weeks last month, exposing credentials the company used to manage everything from firewalls and routers to administrator accounts and database servers, KrebsOnSecurity has learned. Orvis says the exposure was inadvertent, and that many of the credentials were already expired.</p>
<p><img class="aligncenter wp-image-49459" src="media/21b2e9fb.orvis.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/orvis.png" alt="" width="594" height="445" /></p>
<p>Based in Sunderland, VT. and founded in 1856, privately-held Orvis is the oldest mail-order retailer in the United States. The company has approximately 1,700 employees, 69 retail stores and 10 outlets in the US, and 18 retail stores in the UK.</p>
<p>In late October, this author received a tip from Wisconsin-based security firm <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a> that a file containing a staggering number of internal usernames and passwords for Orvis had been posted to Pastebin. </p>
<p>Reached for comment about the source of the document, Orvis spokesperson <strong>Tucker Kimball</strong> said it was only available for a day before the company had it removed from Pastebin.</p>
<p>&#8220;The file contains old credentials, so many of the devices associated with the credentials are decommissioned and we took steps to address the remaining ones,&#8221; Kimball said. &#8220;We are leveraging our existing security tools to conduct an investigation to determine how this occurred.&#8221;</p>
<p>However, according to Hold Security founder <strong>Alex Holden</strong>, this enormous passwords file was actually posted to Pastebin <em>on two separate occasions last month</em>, the first being on Oct. 4, and the second Oct. 22. That finding was corroborated by <a href="https://www.4iq.com" target="_blank" rel="noopener">4iq.com</a>, a company that aggregates information from leaked databases online.</p>
<p>Orvis did not respond to follow-up requests for comment via phone and email; the last two email messages sent by KrebsOnSecurity to Orvis were returned simply as &#8220;blocked.&#8221;</p>
<p>It&#8217;s not unusual for employees or contractors to post bits of sensitive data to public sites like Pastebin and <a href="https://www.github.com" target="_blank" rel="noopener">Github</a>, but the credentials file apparently published by someone working at or for Orvis is by far the most extreme example I&#8217;ve ever witnessed.</p>
<p>For instance, included in the Pastebin files from Orvis were plaintext usernames and passwords for just about every kind of online service or security product the company has used, including:</p>
<p>-Antivirus engines<br />
-Data backup services<br />
-Multiple firewall products<br />
-Linux servers<br />
-Cisco routers<br />
-Netflow data<br />
-Call recording services<br />
-DNS controls<br />
-Orvis wireless networks (public and private)<br />
-Employee wireless phone services<br />
-Oracle database servers<br />
-Microsoft 365 services<br />
-Microsoft Active Directory accounts and passwords<br />
-Battery backup systems<br />
-Security cameras<br />
-Encryption certificates<br />
-Mobile payment services<br />
-Door and Alarm Codes<br />
-FTP credentials<br />
-Apple ID credentials<br />
-Door controllers</p>
<p>By all accounts, this was a comprehensive goof: <em>The Orvis credentials file even contained the combination to a locked safe in the company&#8217; server room.</em><span id="more-49405"></span></p>
<p>The only clue about the source of the Orvis password file is a notation at the top of the document that reads &#8220;VT Technical Services.&#8221;</p>
<p>Holden said this particular exposure also highlights the issue with third parties, as the issue most likely originated not from Orvis staff itself.</p>
<p>&#8220;This is a continuously growing trend of exposures created not by the victims but by those that they consider to be trusted partners,&#8221; Holden said.</p>
<p>It&#8217;s fairly remarkable that a company can spend millions on all the security technology under the sun and have all of it potentially undermined by one ill-advised post to Pastebin, but that is certainly the reality we live in today.</p>
<p>Long gone are the days when one could post something for a few hours to a public document hosting service and expect nobody to notice when it&#8217;s taken down. Today there are a number of third-party services that regularly index and preserve such postings, regardless of how ephemeral those postings may be.</p>
<p>&#8220;Pastebin and other similar repositories are constantly being monitored and any data put out there will be preserved no matter how brief the posting is,&#8221; Holden said. &#8220;In the current threat landscape, we see data exposures nearly as often as we see data breaches. These exposures vary in scope and impact, and this particular one is as bad as they come without specific data exposures.&#8221;</p>
<p>If you&#8217;re responsible for securing your organization&#8217;s environment, it would be an excellent idea to create some tools for monitoring for your domains and brands at Pastebin, Github and other sites where employees sometimes publish sensitive corporate data, inadvertently or otherwise. There are many ways to do this; <a href="http://www.automatingosint.com/blog/2017/04/building-a-keyword-monitoring-pipeline-with-python-pastebin-and-searx/" target="_blank" rel="noopener">here&#8217;s one example</a>.</p>
<p>Have you built such monitoring tools for your organization or employer? If so, please feel free to sound off about your approach in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=49481
title: Patch Tuesday, November 2019 Edition
uri: Patch-Tuesday-November-2019-Edition
url: https://krebsonsecurity.com/2019/11/patch-tuesday-november-2019-edition/
content:
<p><strong>Microsoft</strong> today released updates to plug security holes in its software, including patches to fix at least 74 weaknesses in various flavors of <strong>Windows</strong> and programs that run on top of it. The November updates include patches for a zero-day flaw in <strong>Internet Explorer</strong> that is currently being exploited in the wild, as well as a sneaky bug in certain versions of <strong>Office for Mac</strong> that bypasses security protections and was detailed publicly prior to today&#8217;s patches.</p>
<p><img class="alignright wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="220" height="231" />More than a dozen of the flaws tackled in this month&#8217;s release are rated &#8220;critical,&#8221; meaning they involve weaknesses that could be exploited to install malware without any action on the part of the user, except for perhaps browsing to a hacked or malicious Web site or opening a booby-trapped file attachment.</p>
<p>Perhaps the most concerning of those critical holes is a zero-day flaw in Internet <del>Exploder</del> Explorer (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1429" target="_blank" rel="noopener">CVE-2019-1429</a>) that has already seen active exploitation. Today&#8217;s updates also address two other critical vulnerabilities in the same Windows component that handles various <a href="https://encyclopedia2.thefreedictionary.com/Microsoft+Script+Engine" target="_blank" rel="noopener">scripting languages</a>.</p>
<p>Microsoft also fixed a flaw in Microsoft Office for Mac (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1457" target="_blank" rel="noopener">CVE-2019-1457</a>) that could allow attackers to bypass security protections in some versions of the program that could let malicious macros through.</p>
<p>Macros are bits of computer code that can be embedded into Office files, and malicious macros are frequently used by malware purveyors to compromise Windows systems. Usually, this takes the form of a prompt urging the user to &#8220;enable macros&#8221; once they&#8217;ve opened a booby-trapped Office document delivered via email. Thus, Office has a feature called &#8220;disable all macros without notification.&#8221;</p>
<p><img class="aligncenter wp-image-28673" src="media/69eaa5fa.macrosms.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/11/macrosms.png" alt="" width="596" height="348" srcset="https://krebsonsecurity.com/wp-content/uploads/2014/11/macrosms.png 630w, https://krebsonsecurity.com/wp-content/uploads/2014/11/macrosms-285x166.png 285w, https://krebsonsecurity.com/wp-content/uploads/2014/11/macrosms-600x350.png 600w" sizes="(max-width: 596px) 100vw, 596px" /></p>
<p>But Microsoft says all versions of Office still support an older type of macros that do not respect this setting, and can be used as <a href="https://krebsonsecurity.com/2019/02/payroll-provider-gives-extortionists-a-payday/" target="_blank" rel="noopener">a vector for pushing malware</a>. <strong>Will Dornan</strong> of <a href="https://kb.cert.org/vuls/id/125336/" target="_blank" rel="noopener">CERT/CC reports</a> that while Office 2016 and 2019 for Mac will still prompt the user before executing these older macro types, <strong>Office for Mac 2011</strong> fails to warn users before opening them.<span id="more-49481"></span></p>
<p>Other Windows applications or components receiving patches for critical flaws today include Microsoft Exchange and Windows Media Player. In addition, Microsoft also patched nine vulnerabilities &#8212; five of them critical &#8212; in the <strong>Windows Hyper-V</strong>, an add-on to the <strong>Windows Server OS</strong> (and <strong>Windows 10 Pro</strong>) that allows users to create and run <a href="https://azure.microsoft.com/en-us/overview/what-is-a-virtual-machine/" target="_blank" rel="noopener">virtual machines</a> (other &#8220;guest&#8221; operating systems) from within Windows.</p>
<p>Although <strong>Adobe</strong> typically issues patches for its <strong>Flash Player</strong> browser component on Patch Tuesday, this is the second month in a row that Adobe has not released any security updates for Flash. However, Adobe today did push security fixes for a variety of its creative software suites, including <a href="https://helpx.adobe.com/security/products/animate/apsb19-34.html" target="_blank" rel="noopener">Animate</a>, <a href="https://helpx.adobe.com/security/products/illustrator/apsb19-36.html" target="_blank" rel="noopener">Illustrator</a>, <a href="https://helpx.adobe.com/security/products/media-encoder/apsb19-52.html" target="_blank" rel="noopener">Media Encoder</a> and <a href="https://helpx.adobe.com/security/products/bridge/apsb19-53.html" target="_blank" rel="noopener">Bridge</a>. Also, I neglected to note last month that Adobe released a critical update for <strong>Acrobat/Reader</strong> that <a href="https://helpx.adobe.com/security/products/acrobat/apsb19-49.html" target="_blank" rel="noopener">addressed at least 67 bugs</a>, so if you&#8217;ve got either of these products installed, please be sure they&#8217;re patched and up to date.</p>
<p>Finally, <strong>Google</strong> recently fixed a zero-day flaw in its <strong>Chrome</strong> Web browser (<a href="https://securelist.com/chrome-0-day-exploit-cve-2019-13720-used-in-operation-wizardopium/94866/" target="_blank" rel="noopener">CVE-2019-13720</a>). If you use Chrome and see an upward-facing arrow to the right of the address bar, you have an update pending; fully closing and restarting the browser should install any available updates.</p>
<p>Now seems like a good time to remind all you <strong>Windows 7</strong> end users that Microsoft will cease shipping security updates after January 2020 (this end-of-life also affects Windows Server 2008 and 2008 R2). While businesses and other volume-license purchasers will <a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/How-to-get-Extended-Security-Updates-for-eligible-Windows/ba-p/917807" target="_blank" rel="noopener">have the option to pay for further fixes</a> after that point, all other Windows 7 users who want to stick with Windows will need to consider migrating to <strong>Windows 10</strong> soon.</p>
<p>Standard heads-up: Windows 10 likes to install patches all in one go and reboot your computer on its own schedule. Microsoft doesn’t make it easy for Windows 10 users to change this setting, <a href="https://www.howtogeek.com/224471/how-to-prevent-windows-10-from-automatically-downloading-updates/" target="_blank" rel="noopener">but it is possible</a>. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in Windows Update. To get there, click the Windows key on your keyboard and type “windows update” into the box that pops up.</p>
<p>Keep in mind that while staying up-to-date on Windows patches is a good idea, it&#8217;s important to make sure you&#8217;re updating only after you’ve backed up your important data and files. A reliable backup means you’re probably not freaking out when the odd buggy patch causes problems booting the system. So do yourself a favor and backup your files before installing any patches.</p>
<p>As ever, if you experience glitches or problems installing any of these patches this month, please feel free to leave a comment about it below; there’s a decent chance other readers have experienced the same and may even chime in here with some helpful tips.</p>


feed_id: https://krebsonsecurity.com/?p=49491
title: Orcus RAT Author Charged in Malware Scheme
uri: Orcus-RAT-Author-Charged-in-Malware-Scheme
url: https://krebsonsecurity.com/2019/11/orcus-rat-author-charged-in-malware-scheme/
content:
<p>In July 2016, KrebsOnSecurity <a href="https://krebsonsecurity.com/2016/07/canadian-man-is-author-of-popular-orcus-rat/" target="_blank" rel="noopener">published a story</a> identifying a Toronto man as the author of the <strong>Orcus RAT</strong>, a software product that’s been marketed on underground forums and used in countless malware attacks since its creation in 2015. This week, Canadian authorities criminally charged him with orchestrating an international malware scheme.</p>
<div id="attachment_47154" style="width: 607px" class="wp-caption aligncenter"><img class="wp-image-47154" src="media/63e0fe4f.orcusad.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/orcusad.jpg" alt="" width="597" height="244" /><p class="wp-caption-text">An advertisement for Orcus RAT.</p></div>
<p>The accused, 36-year-old <strong>John &#8220;Armada&#8221; Revesz</strong>, has maintained that Orcus is a legitimate &#8220;<strong>R</strong>emote <strong>A</strong>dministration <strong>T</strong>ool&#8221; aimed at helping system administrators remotely manage their computers, and that he&#8217;s not responsible for how licensed customers use his product.</p>
<p>In my 2016 piece, however, several sources noted that Armada and his team were marketing it more like a <strong>R</strong>emote <strong>A</strong>ccess <strong>T</strong>rojan, providing ongoing technical support and help to customers who&#8217;d purchased Orcus but were having trouble figuring out how to infect new machines or hide their activities online.</p>
<p>Follow-up reporting revealed that the list of features and plugins advertised for Orcus includes functionality that goes significantly beyond what one might see in a traditional remote administration tool, such as DDoS-for-hire capabilities, and the ability to disable the light indicator on webcams so as not to alert the target that the RAT is active.</p>
<p>Canadian investigators don&#8217;t appear to be buying Revesz&#8217; claims. On Monday the <strong>Royal Canadian Mounted Police</strong> (RCMP) announced it had charged Revesz with operating an international malware distribution scheme under the company name &#8220;Orcus Technologies.&#8221;</p>
<p>&#8220;An RCMP criminal investigation began in July 2016 after reports of a significant amount of computers were being infected with a &#8216;Remote Access Trojan&#8217; type of virus,&#8221; the agency said in <a href="http://www.rcmp-grc.gc.ca/en/news/2019/charges-laid-rcmp-relation-international-malware-virus" target="_blank" rel="noopener">a statement</a>.</p>
<p>The RCMP filed the charges eight months after executing a search warrant at Revesz&#8217; home, where they seized several hard drives containing Orcus RAT customer names, financial transactions, and other information.</p>
<p>&#8220;The evidence obtained shows that this virus has infected computers from around the world, making thousands of victims in multiple countries,&#8221; the RCMP said.</p>
<p>Revesz did not respond to requests for comment.<span id="more-49491"></span></p>
<p>If Revesz&#8217;s customers are feeling the heat right now, they probably should be. Several former customers of his took to Hackforums[.]net to complain about being raided by investigators who are trying to track down individuals suspected of using Orcus to infect computers with malware.</p>
<p>&#8220;I got raided [and] within the first 5 minutes they mention Orcus to me,&#8221; complained one customer on Hackforums[.]net, the forum where Revesz principally advertised his software. That user pointed to <a href="https://www.afp.gov.au/news-media/media-releases/afp-executes-warrant-malware-investigation" target="_blank" rel="noopener">a March 2019 media advisory</a> released by the <strong>Australian Federal Police</strong>, who said they&#8217;d executed search warrants there as part of an investigation into RAT technology conducted in tandem with the RCMP.</p>
<p>According to Revesz himself, the arrests and searches related to Orcus have since expanded to individuals in the United States and Germany.</p>
<p>The sale and marketing of remote administration tools is not illegal in the United States, and indeed there are plenty such tools sold by legitimate companies to help computer experts remotely administer computers.</p>
<p>However, these tools tend to be viewed by prosecutors as malware and spyware when their proprietors advertise them as hacking devices and provide customer support aimed at helping buyers deploy the RATs stealthily and evade detection by anti-malware programs.</p>
<p>Last year, a 21-year-old Kentucky man <a href="https://krebsonsecurity.com/2018/07/luminositylink-rat-author-pleads-guilty/" target="_blank" rel="noopener">pleaded guilty</a> to authoring and distributing a popular hacking tool called “LuminosityLink,” which experts say was used by thousands of customers to gain access to tens of thousands of computers across 78 countries worldwide.</p>
<p>Also in 2018, 27-year-old Arkansas resident <strong>Taylor Huddleston</strong> was <a href="https://krebsonsecurity.com/2018/02/bot-roundup-avalanche-kronos-nanocore/" target="_blank" rel="noopener">sentenced to three years in jail</a> for making and selling the “NanoCore RAT,” which was being used to spy on webcams and steal passwords from systems running the software.</p>
<p>In many previous law enforcement investigations targeting RAT developers and sellers, investigators also have targeted customers of these products. In 2014, the U.S. Justice Department announced a series of actions against <a href="https://krebsonsecurity.com/2014/05/blackshades-trojan-users-had-it-coming/" target="_blank" rel="noopener">more than 100 people accused of purchasing and using “Blackshades,”</a> a cheap and powerful RAT that the U.S. government said was used to infect more than a half million computers worldwide.</p>
<p>It&#8217;s remarkable how many denizens of various hacking forums persist in believing that an end-user licensing agreement (EULA) or &#8220;terms of service&#8221; (TOS) disavowing any responsibility for what customers do with the product somehow absolves sellers of RAT programs of any liability when they then turn around and actively assist customers in using the tools to infect systems with malware.</p>


feed_id: https://krebsonsecurity.com/?p=49519
title: Why Were the Russians So Set Against This Hacker Being Extradited?
uri: Why-Were-the-Russians-So-Set-Against-This-Hacker-Being-Extradited
url:
https://krebsonsecurity.com/2019/11/why-were-the-russians-so-set-against-this-hacker-being-extradited/

content:
<p>The Russian government has for the past four years been fighting to keep 29-year-old alleged cybercriminal <strong>Alexei Burkov</strong> from being extradited by Israel to the United States. When Israeli authorities turned down requests to send him back to Russia &#8212; supposedly to face separate hacking charges there &#8212; the Russians then imprisoned an Israeli woman for seven years on trumped-up drug charges in a bid to trade prisoners. That effort failed as well, and Burkov had his first appearance in a U.S. court last week. What follows are some clues that might explain why the Russians are so eager to reclaim this young man.</p>
<div id="attachment_49530" style="width: 605px" class="wp-caption aligncenter"><img class=" wp-image-49530" src="media/a23ec59c.burkov-jerusalem-getty.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/burkov-jerusalem-getty.png" alt="" width="595" height="375" /><p class="wp-caption-text">Alexei Burkov, seated second from right, attends a hearing in Jerusalem in 2015. Andrei Shirokov / Tass via Getty Images.</p></div>
<p>On the surface, <a href="media/e24900aa.Burkov-Superceding.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/Burkov-Superceding.pdf" target="_blank" rel="noopener">the charges</a> the U.S. government has <a href="https://www.nbcnews.com/news/world/suspected-hacker-s-extradition-focuses-attention-israeli-american-russian-jail-n1079781" target="_blank" rel="noopener">leveled against Burkov</a> may seem fairly unremarkable: Prosecutors <a href="https://www.justice.gov/usao-edva/pr/russian-national-extradited-running-online-criminal-marketplace" target="_blank" rel="noopener">say</a> he ran a credit card fraud forum called <strong>CardPlanet</strong> that sold more than 150,000 stolen cards.</p>
<p>However, a deep dive into the various pseudonyms allegedly used by Burkov suggests this individual may be one of the most connected and skilled malicious hackers ever apprehended by U.S. authorities, and that the Russian government is probably concerned that he simply knows too much.</p>
<p>Burkov calls himself a specialist in information security and denies having committed the crimes for which he&#8217;s been charged. But according to denizens of several Russian-language cybercrime forums that have been following his case in the Israeli news media, Burkov was by all accounts an elite cybercrook who primarily operated under the hacker alias &#8220;<strong>K0pa</strong>.&#8221;</p>
<p>This is the same nickname used by an individual who served as co-administrator of perhaps the most exclusive Russian-language hacking forums ever created, including <strong>Mazafaka</strong> and <strong>DirectConnection</strong>.</p>
<div id="attachment_49526" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/6b5d3c82.maza.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/maza.png"><img class="wp-image-49526" src="media/6b5d3c82.maza.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/maza.png" alt="" width="597" height="226" /></a><p class="wp-caption-text">A screen shot from the Mazafaka cybercrime forum, circa 2011.</p></div>
<p>Since their inception in the mid-aughts, both of these forums have been among the most difficult to join &#8212; admitting only native Russian speakers and requiring each applicant to furnish a non-refundable cash deposit and &#8220;vouches&#8221; &#8212; or guarantees &#8212; from at least three existing members. Also, neither forum was accessible or even visible to anyone without a special encryption certificate supplied by forum administrators that allowed the sites to load properly in a Web browser.</p>
<div id="attachment_49525" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/6ba84ca9.dc-ws.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/dc-ws.png"><img class="wp-image-49525" src="media/6ba84ca9.dc-ws.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/dc-ws.png" alt="" width="594" height="320" /></a><p class="wp-caption-text">DirectConnection, circa 2011. The identity shown at the bottom of this screenshot &#8212; Severa &#8212; belonged to Peter Levashov, a prolific spammer who pleaded guilty in the United States last year to operating the Kelihos spam botnet.</p></div>
<p>Notably, some of the world&#8217;s most-wanted cybercriminals were members of these two highly exclusive forums, and many of those individuals have already been arrested, extradited and tried for various cybercrime charges in the United States over the years. Those include convicted credit card fraudsters <a href="https://www.wired.com/2010/08/badb-rbs-worldpay-hack/" target="_blank" rel="noopener">Vladislav &#8220;Badb&#8221; Horohorin</a> and <a href="https://krebsonsecurity.com/?s=zo0mer&amp;x=0&amp;y=0" target="_blank" rel="noopener">Sergey &#8220;zo0mer&#8221; Kozerev</a>, as well as the infamous spammer and botnet master <a href="https://krebsonsecurity.com/?s=severa+waledac&amp;x=0&amp;y=0" target="_blank" rel="noopener">Peter &#8220;Severa&#8221; Levashov</a>.</p>
<p>A user database obtained by KrebsOnSecurity several years back indicates K0pa relied on the same email address he used to register at Mazafaka and DirectConnection to register the user account &#8220;<strong>Botnet</strong>&#8221; on <strong>Spamdot</strong>, which for years was <a href="https://krebsonsecurity.com/2010/09/spam-affialite-program-spamit-com-to-close/" target="_blank" rel="noopener">the closely-guarded stomping ground</a> of the world&#8217;s most prolific spammers and virus writers, as well as hackers who created services catering to both professions.</p>
<p>As a reporter for <em>The Washington Post</em> in 2008, I wrote about the core offering that K0pa/Botnet advertised on Spamdot and other exclusive forums: <a href="http://voices.washingtonpost.com/securityfix/2008/11/web_fraud_20_faking_your_inter.html" target="_blank" rel="noopener">A botnet-based anonymity service called <strong>FraudCrew</strong></a>. This service sold access to hacked computers, which FraudCrew customers used for the purposes of hiding their real location online while conducting cybercriminal activities.</p>
<div id="attachment_49524" style="width: 603px" class="wp-caption aligncenter"><a class="lightbox" href="media/8096303c.fraudcrew.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/fraudcrew.png"><img class="wp-image-49524" src="media/8096303c.fraudcrew.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/fraudcrew.png" alt="" width="593" height="401" /></a><p class="wp-caption-text">FraudCrew, a botnet-based anonymity service offered by K0pa.</p></div>
<p>K0pa also was a top staff member at <strong>Verified</strong>, among the oldest and most venerated of Russian language cybercrime forums. Specifically, K0pa&#8217;s role at Verified was in maintaining its blacklist, a dispute resolution process designed to weed out &#8220;dishonest&#8221; cybercriminals who seek only to rip off less experienced crooks. From this vantage point, K0pa would have held considerable sway on the forum, and almost certainly played a key role in vetting new applicants to the site.<span id="more-49519"></span></p>
<p>Prior to his ascendance at these forums, K0pa was perhaps best known for being a founding member of a hacker group calling themselves <a href="https://translate.google.com/translate?sl=ru&amp;tl=en&amp;u=https%3A%2F%2Fj3qx.wordpress.com%2F2009%2F01%2F07%2F%25D0%25B8%25D0%25BD%25D1%2582%25D0%25B5%25D1%2580%25D0%25B2%25D1%258C%25D1%258E-%25D1%2581-cyberlords-community%2F" target="_blank" rel="noopener">the CyberLords</a>. Over nearly a decade, the CyberLords team would release dozens of hacking tools and exploits targeting previously unknown security vulnerabilities in Web-based services and computer software.</p>
<p><H4>A DIRECT CONNECTION?</H4></p>
<p>According to security firm <strong>Cybereason</strong>, Russia has a history of using contractors &#8212; even cybercriminals &#8212; <a href="https://www.theregister.co.uk/2017/06/06/russia_cyber_militia_analysis/" target="_blank" rel="noopener">to run intelligence operations</a>. These crooks-turned-spies &#8220;offer a resource to the state while enjoying a cloak of semi-protected &#8216;status&#8217; for their extracurricular activities, provided they are directed against foreign targets.&#8221;</p>
<p>&#8220;Cybercriminals are recruited to Russia&#8217;s national cause through a mix of coercion, payments and appeals to patriotic sentiment,&#8221; reads <a href="https://www.theregister.co.uk/2017/06/06/russia_cyber_militia_analysis/" target="_blank" rel="noopener">a 2017 story</a> from <em>The Register</em> on Cybereason&#8217;s <a href="https://www.cybereason.com/blog-russia-nation-state-hacking-the-countrys-dedicated-policy-of-strategic-ambiguity/" target="_blank" rel="noopener">analysis</a> of the Russian cybercrime scene. &#8220;Russia&#8217;s use of private contractors also has other benefits in helping to decrease overall operational costs, mitigating the risk of detection and gaining technical expertise that they cannot recruit directly into the government. Combining a cyber-militia with official state-sponsored hacking teams has created the most technically advanced and bold cybercriminal community in the world.&#8221;</p>
<div id="attachment_49523" style="width: 602px" class="wp-caption aligncenter"><img class="wp-image-49523" src="media/6e9d7c46.verified.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/verified.png" alt="" width="592" height="97" /><p class="wp-caption-text">A banner that ran on top of the Verified cybercrime forum for many years.</p></div>
<p>It&#8217;s probably worth noting that also present on both DirectConnection and Mazafaka were the core members of a prolific gang of online bank robbers called the <a href="https://krebsonsecurity.com/2015/02/fbi-3m-bounty-for-zeus-trojan-author/" target="_blank" rel="noopener">JabberZeus Crew</a>, who used custom versions of the ZeuS Trojan to steal tens &#8212; if not hundreds &#8212; of millions of dollars <a href="https://krebsonsecurity.com/?s=cyberheist+zeus+trojan&amp;x=0&amp;y=0" target="_blank" rel="noopener">from hacked small businesses across the United States</a>. In 2011, most of that crew was <a href="https://krebsonsecurity.com/2010/10/ukraine-detains-5-individuals-tied-to-70-million-in-ebanking-heists/" target="_blank" rel="noopener">rounded up in an international cybercrime crackdown</a>, although virtually all of them escaped prosecution in their home countries (mainly Russia and Ukraine).</p>
<p>I mention this because K0pa also was in regular communications with &#8212; if not a core member of &#8211;the JabberZeus crew. This gang worked directly with the author of the ZeuS trojan &#8212; <strong>Evgeniy &#8220;Slavik&#8221; Bogachev</strong> &#8212; a Russian man with <a href="https://krebsonsecurity.com/2015/02/fbi-3m-bounty-for-zeus-trojan-author/" target="_blank" rel="noopener">a $3 million bounty on his head from the FBI</a>. The cybercriminal organization Bogchev allegedly ran was responsible for the theft of more than $100 million from banks and businesses worldwide that were infected with his ZeuS malware. That organization, dubbed the “Business Club,” had members spanning most of Russia’s 11 time zones.</p>
<div id="attachment_49556" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/ae7b3c84.jz-dc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/jz-dc.png"><img class="wp-image-49556" src="media/ae7b3c84.jz-dc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/jz-dc.png" alt="" width="596" height="215" /></a><p class="wp-caption-text">In this 2011 screenshot of DirectConnection, we can see the nickname &#8220;aqua,&#8221; one of the JabberZeus crime gang actors. K0pa also was affiliated with the JabberZeus crew.</p></div>
<p><strong>Fox-IT</strong>, a Dutch security firm that infiltrated the Business Club’s back-end operations, found that beginning in late fall 2013 — about the time that conflict between Ukraine and Russia was just beginning to heat up — Slavik retooled his cyberheist botnet to serve as purely a spying machine, and began scouring infected systems in Ukraine for specific keywords in emails and documents that would likely only be found in classified documents.</p>
<p>Likewise, the keyword searches that Slavik used to scour bot-infected systems in Turkey suggested the botmaster was searching for specific files from the Turkish Ministry of Foreign Affairs – a specialized police unit. Fox-IT said it was clear that Slavik was looking to intercept communications about the conflict in Syria on Turkey’s southern border — one that Russia has supported by reportedly shipping arms into the region.</p>
<p>To my knowledge, no one has accused Burkov of being some kind of cybercrime fixer or virtual badguy Rolodex for the Russian government. On the other hand, from his onetime lofty perch atop some of the most exclusive Russian cybercrime forums, K0pa certainly would have fit that role nicely.</p>
<p>Further reading, including the fascinating story on the diplomatic back and forth between Russia and Israel mentioned in the first paragraph: <a href="https://www.haaretz.com/israel-news/.premium-the-russian-hacker-who-just-became-one-of-israel-s-most-famous-prisoners-1.7972490" target="_blank" rel="noopener">The Russian Hacker Who Just Became One of Israel&#8217;s Most Famous Prisoners</a>.</p>
<p><a href="https://www.nytimes.com/2016/12/29/world/europe/how-russia-recruited-elite-hackers-for-its-cyberwar.html" target="_blank" rel="noopener">How Russia Recruited Elite Hackers for Its Cyberwar</a></p>


feed_id: https://krebsonsecurity.com/?p=49503
title: Ransomware Bites 400 Veterinary Hospitals
uri: Ransomware-Bites-400-Veterinary-Hospitals
url: https://krebsonsecurity.com/2019/11/ransomware-bites-400-veterinary-hospitals/
content:
<p><strong>National Veterinary Associates</strong> (NVA), a California company that owns more than 700 animal care facilities around the globe, is still working to recover from a ransomware attack late last month that affected more than half of those properties, separating many veterinary practices from their patient records, payment systems and practice management software. NVA says it expects to have all facilities fully back up and running normally within the next week.</p>
<p><img class="aligncenter  wp-image-49579" src="media/4ee774f0.nva700.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/nva700.png" alt="" width="596" height="378" /></p>
<p>Agoura Hills, Calif.-based NVA bills itself as is the largest private owner of freestanding veterinary hospitals in the United States. The company&#8217;s <a href="https://www.nva.com/" target="_blank" rel="noopener">Web site</a> says it currently owns roughly 700 veterinary hospitals and animal boarding facilities in the United States, Canada, Australia and New Zealand.</p>
<p>NVA said it discovered the ransomware outbreak on the morning of Sunday, Oct. 27, and soon after hired two outside security firms to investigate and remediate the attack. A source close to the investigation told KrebsOnSecurity that NVA was hit with <strong>Ryuk</strong>, a ransomware strain first spotted in August 2018 that targets mostly large organizations for a high-ransom return.</p>
<p>NVA declined to answer questions about the malware, or whether the NVA paid the ransom demand.</p>
<p>&#8220;It was ransomware, but we&#8217;ve been referring to it as a malware incident,&#8221; said <strong>Laura Koester</strong>, NVA&#8217;s chief marketing officer.</p>
<p>Koester said because every NVA hospital runs their IT operations as they see fit, not all were affected. More importantly, she said, all of the NVA&#8217;s hospitals have remained open and able to see clients (animals in need of care), and access to patient records has been fully restored to all affected hospitals.</p>
<p>&#8220;For a few days, some [pet owners] couldn&#8217;t do online bookings, and some hospitals had to look at different records for their patients,&#8221; Koester said. &#8220;But throughout this whole thing, if there was a sick animal, we saw them. No one closed their doors.&#8221;</p>
<p>The source close to the investigation painted a slight less rosy picture of the situation at NVA, and said the company&#8217;s response has been complicated by the effects of wildfires surrounding its headquarters in Los Angeles County: A year ago, <a href="https://en.wikipedia.org/wiki/Woolsey_Fire" target="_blank" rel="noopener">a destructive wildfire in Los Angeles and Ventura Counties</a> burned almost 100,00 acres, destroyed more than 1,600 structures, killed three people and prompted the evacuation of nearly 300,000 people &#8212; including all residents of Agoura Hills.</p>
<p>&#8220;The support center was scheduled to be closed on Friday Oct 25, 2019 due to poor air quality caused by wildfires to the north,&#8221; said the source, who asked to remain anonymous. &#8220;Around 2 am PT [Oct. 27], the Ryuk virus was unleashed at <span class="il">NVA</span>. Approximately 400 locations were infected. [Microsoft] Active Directory and Exchange servers were infected. Many of the infected locations immediately lost access to their Patient Information Management systems (PIMs). These locations were immediately unable to provide care.&#8221;</p>
<p>The source shared internal communications from different NVA executives to their hospitals about the extent of the remediation efforts and possible source of the compromise, which seemed to suggest that at least some NVA properties have been struggling to accommodate patients.<span id="more-49503"></span></p>
<p>A missive from NVA&#8217;s <strong>Director of Operations Robert Hill</strong> on Oct. 30 acknowledged that &#8220;we continue to be faced with a monumental effort to restore IT service [to] nearly 400 of our hospitals.&#8221;</p>
<p>&#8220;This really hit home for me Saturday,&#8221; Hill wrote. &#8220;One of my best friends had to take his Yellow Lab into Conejo Valley for urgent care. Thankfully CV was able to provide care as their [systems] were up and running, but many of our hospitals are not in as good shape.&#8221;</p>
<p>In an update sent to NVA hospitals on Nov. 6, the company&#8217;s new head of technology <strong>Greg Hartmann</strong> said its security system successfully blocked the ransomware from infiltrating its systems &#8212; at least at first.</p>
<p>&#8220;Because of the scale of the attack, the virus eventually found three smaller points of entry through accounts that were unaffiliated with NVA, but unfortunately opened within our network,&#8221; Hartmann said. &#8220;Upon discovery of the incident, our technology team immediately implemented procedures to prevent the malware from spreading; however, many local systems were affected. Still, we have many hospitals whose systems are not recovered. The technology team continues to set up interim workstations at each affected hospital while they prepare to rebuild servers.&#8221;</p>
<p>The source told KrebsOnSecurity that NVA suffered a separate ransomware infestation earlier this summer that also involved Ryuk, and they expressed concern that the first incident may not have been fully remediated &#8212; potentially letting the attackers maintain a foothold within the organization.</p>
<p>&#8220;This is the second time this year Ryuk struck NVA,&#8221; the source said. &#8220;The first time, NVA was rather open to all facilities about what happened. This time, however, they are simply referring to it as a &#8216;system outage.'&#8221;</p>
<div id="attachment_49581" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/73ef6790.talkingpoints.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/talkingpoints.png"><img class="wp-image-49581" src="media/73ef6790.talkingpoints.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/talkingpoints.png" alt="" width="599" height="208" /></a><p class="wp-caption-text">A set of talking points NVA distributed to staff on Oct. 27, the day some 400 veterinary hospitals were hit with the Ryuk ransomware.</p></div>
<p>Koester said some NVA facilities did get hit with a malware incident earlier this year, but that she did not believe ransomware was involved in that intrusion.</p>
<p>The Ryuk ransomware has made a name for itself going after businesses that supply services to other companies &#8212; particularly cloud-data firms &#8212; with the ransom demands set according to the victim&#8217;s perceived ability to pay. In February, payroll software provider <strong>Apex Human Capital Management</strong> <a href="https://krebsonsecurity.com/2019/02/payroll-provider-gives-extortionists-a-payday/" target="_blank" rel="noopener">chose to pay the ransom demand</a> after a Ryuk infection severed payroll management services for hundreds of the company&#8217;s customers. And on Christmas Eve 2018, cloud hosting provider Dataresolution.net <a href="https://krebsonsecurity.com/2019/01/cloud-hosting-provider-dataresolution-net-battling-christmas-eve-ransomware-attack/" target="_blank" rel="noopener">suffered a multi-week outage</a> after a Ryuk attack.</p>
<p>According to a bulletin released by the FBI in May, cybercriminals had targeted over 100 U.S. and international businesses with Ryuk since August 2018. Security firm CrowdStrike estimated that attackers deploying Ryuk <a href="https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/" target="_blank" rel="noopener">had netted over $3.7 million in bitcoin ransom payments</a> between Aug. 2018 and January 2019.</p>
<p>Many people and organizations may be under the impression that ransomware attacks like Ryuk can appear at a moment&#8217;s notice merely from someone clicking a malicious link or opening a booby-trapped email attachment. While the latter appears to be the most common vector for ransomware infestations, <a href="https://www.ncsc.gov.uk/news/ryuk-advisory" target="_blank" rel="noopener">an advisory</a> released in September by the U.K&#8217;s <strong>National Cyber Security Centre</strong> suggests most Ryuk victims are compromised weeks or months before the ransomware is actually deployed inside the victim&#8217;s network.</p>
<p>&#8220;The Ryuk ransomware is often not observed until a period of time after the initial infection – ranging from days to months – which allows the actor time to carry out<br />
reconnaissance inside an infected network, identifying and targeting critical network systems and therefore maximizing the impact of the attack,&#8221; reads the NCSC advisory, which includes tips on spotting signs of a Ryuk infection. &#8220;But it may also offer the potential to mitigate against a ransomware attack before it occurs, if the initial infection is detected and remedied.&#8221;</p>
<p>As for what changes NVA will be making to prevent yet another ransomware outbreak, an internal update on Nov. 7 from NVA&#8217;s chief information officer <strong>Joe Leggio</strong> said NVA was investing in software from <a href="http://www.carbonblack.com/" target="_blank" rel="noopener">Carbon Black</a>, a cloud-based security solution that will be installed on all NVA property computers.</p>
<p>&#8220;Throughout my career, I have witnessed incredible advances in technology making our lives better,&#8221; Leggio wrote. &#8220;At nearly the same rate, the bad guys have been increasing the aggressiveness and sophistication of their attacks. As we rebuild, we are also thinking of the future. That is why we are investing in cybersecurity talent, new infrastructure, and better software.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=49609
title: DDoS-for-Hire Boss Gets 13 Months Jail Time
uri: DDoS-for-Hire-Boss-Gets-13-Months-Jail-Time
url: https://krebsonsecurity.com/2019/11/ddos-for-hire-boss-gets-13-months-jail-time/
content:
<p>A 21-year-old Illinois man was sentenced last week to 13 months in prison for running multiple DDoS-for-hire services that launched millions of attacks over several years. This individual&#8217;s sentencing comes more than five years after KrebsOnSecurity interviewed both the defendant and his father and urged the latter to take a more active interest in his son’s online activities.</p>
<div id="attachment_49610" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/18238f5e.databooter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/databooter.png"><img class="wp-image-49610" src="media/18238f5e.databooter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/databooter.png" alt="" width="594" height="228" /></a><p class="wp-caption-text">A screenshot of databooter[.]com, circa 2017. Image: Cisco Talos.</p></div>
<p>The jail time was handed down to <strong>Sergiy P. Usatyuk </strong>of Orland Park, Ill., who pleaded guilty in February to one count of conspiracy to cause damage to Internet-connected computers and owning, administering and supporting illegal “booter” or “stresser” services designed to knock Web sites offline, including <strong>exostress[.]in</strong>, <strong>quezstresser[.]com</strong>, <strong>betabooter[.]com</strong>, <strong>databooter[.]com</strong>, <strong>instabooter[.]com</strong>, <strong>polystress[.]com</strong> and <strong>zstress[.]net</strong>.</p>
<p>According to the <strong>U.S. Justice Department,</strong> in just the first 13 months of the 27-month long conspiracy, Usatyuk&#8217;s booter users ordered approximately 3,829,812 DDoS attacks. As of September 12, 2017, ExoStresser advertised on its website that this one booter service had launched 1,367,610 DDoS attacks, and caused targets to suffer 109,186.4 hours of network downtime (-4,549 days).</p>
<p>Usatyuk — operating under the hacker aliases “Andrew Quez” and “Brian Martinez,” among others — admitted developing, controlling and operating the aforementioned booter services from around August 2015 through November 2017. But Usatyuk’s involvement in the DDoS-for-hire space very much predates that period.</p>
<p>In February 2014, KrebsOnSecurity reached out to Usatyuk’s father <strong>Peter Usatyuk</strong>, an assistant professor at the <strong>University of Illinois at Chicago</strong>. I did so because a brief amount of sleuthing on Hackforums[.]net revealed that his then 15-year-old son Sergiy — who at the time went by the nicknames “Rasbora” and “Mr. Booter Master” — was heavily involved in helping to launch crippling DDoS attacks.</p>
<p>I phoned Usatyuk the elder because Sergiy’s alter egos had been posting evidence on Hackforums and elsewhere that he’d just hit KrebsOnSecurity.com with a 200 Gbps DDoS attack, which was then considered a fairly impressive DDoS assault.</p>
<p>“I am writing you after our phone conversation just to confirm that you may call evening time/weekend to talk to my son Sergio regarding to your reasons,” Peter Usatyuk wrote in an email to this author on Feb. 13, 2014. “I also have [a] major concern what my 15 yo son [is] doing. If you think that is any kind of illegal work, please, let me know.”<span id="more-49609"></span></p>
<p>That 2014 story declined to quote Rasbora by name because he was a minor then, but his father seemed alarmed enough about my inquiry that he insisted his son speak with me about the matter.</p>
<p>Here’s  an excerpt <a href="https://krebsonsecurity.com/2014/02/the-new-normal-200-400-gbps-ddos-attacks/" target="_blank" rel="noopener">of what I wrote about Sergiy at the time</a>:</p>
<blockquote><p>Rasbora’s most recent project just happens to be gathering, maintaining huge “top quality” lists of servers that can be used to launch amplification attacks online. Despite his insistence that he’s never launched DDoS attacks, Rasbora did eventually allow that someone reading his posts on Hackforums might conclude that he was actively involved in DDoS attacks for hire.</p>
<p>“I don’t see what a wall of text can really tell you about what someone does in real life though,” said Rasbora, whose real-life identity is being withheld because he’s a minor. This reply came in response to my reading him several posts that he’d made on Hackforums not 24 hours earlier that strongly suggested he was still in the business of knocking Web sites offline: In a Feb. 12 post on a thread called “Hiring a hit on a Web site” that Rasbora has since deleted, he tells a fellow Hackforums user, “If all else fails and you just want it offline, PM me.”</p>
<p>Rasbora has tried to clean up some of his more self-incriminating posts on Hackforums, but he remains defiantly steadfast in his claim that he doesn’t DDoS people. Who knows, maybe his dad will ground him and take away his Internet privileges.</p>
<p>I’m guessing young Sergiy never had his Internet privileges revoked, nor did he heed advice to use his skills for less destructive activities. His dad hung up on me when I called Wednesday evening requesting comment.</p></blockquote>
<p>In addition to serving the <a href="https://www.justice.gov/opa/pr/former-operator-illegal-booter-services-sentenced-conspiracy-commit-computer-damage-and-abuse" target="_blank" rel="noopener">13-month jail sentence</a> and three years of supervised release, Usatyuk will forfeit $542,925 in proceeds from the scheme, as well as dozens of servers and other computer equipment that powered his many DDoS-for-hire businesses.</p>


feed_id: https://krebsonsecurity.com/?p=49619
title: 110 Nursing Homes Cut Off from Health Records in Ransomware Attack
uri: 110-Nursing-Homes-Cut-Off-from-Health-Records-in-Ransomware-Attack
url:
https://krebsonsecurity.com/2019/11/110-nursing-homes-cut-off-from-health-records-in-ransomware-attack/

content:
<p>A ransomware outbreak has besieged a Wisconsin based IT company that provides cloud data hosting, security and access management to more than 100 nursing homes across the United States. The ongoing attack is preventing these care centers from accessing crucial patient medical records, and the IT company&#8217;s owner says she fears this incident could soon lead not only to the closure of her business, but also to the untimely demise of some patients.</p>
<p><img class="aligncenter wp-image-49623" src="media/08717eec.vcpi.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/vcpi.png" alt="" width="596" height="297" /></p>
<p>Milwaukee, Wisc. based <a href="https://www.vcpi.com" target="_blank" rel="noopener">Virtual Care Provider Inc.</a> (VCPI) provides IT consulting, Internet access, data storage and security services to some 110 nursing homes and acute-care facilities in 45 states. All told, VCPI is responsible for maintaining approximately 80,000 computers and servers that assist those facilities.</p>
<p>At around 1:30 a.m. CT on Nov. 17, unknown attackers launched a ransomware strain known as <strong>Ryuk</strong> inside VCPI&#8217;s networks, encrypting all data the company hosts for its clients and demanding a whopping $14 million ransom in exchange for a digital key needed to unlock access to the files. Ryuk has made a name for itself targeting businesses that supply services to other companies — particularly cloud-data firms — with the ransom demands set according to the victim’s perceived ability to pay.</p>
<p>In an interview with KrebsOnSecurity today, VCPI chief executive and owner <strong>Karen Christianson</strong> said the attack had affected virtually all of their core offerings, including Internet service and email, access to patient records, client billing and phone systems, and even VCPI&#8217;s own payroll operations that serve nearly 150 company employees.</p>
<p>The care facilities that VCPI serves access their records and other systems outsourced to VCPI by using a <a href="https://www.citrix.com/networking/consolidate-remote-access.html" target="_blank" rel="noopener">Citrix-based</a> <a href="https://en.wikipedia.org/wiki/Virtual_private_network" target="_blank" rel="noopener">virtual private networking</a> (VPN) platform, and Christianson said restoring customer access to this functionality is the company&#8217;s top priority right now.</p>
<p>&#8220;We have employees asking when we&#8217;re going to make payroll,&#8221; Christianson said. &#8220;But right now all we&#8217;re dealing with is getting electronic medical records back up and life-threatening situations handled first.&#8221;</p>
<p>Christianson said her firm cannot afford to pay the ransom amount being demanded &#8212; roughly $14 million worth of Bitcoin &#8212; and said some clients will soon be in danger of having to shut their doors if VCPI can&#8217;t recover from the attack.</p>
<p>&#8220;We&#8217;ve got some facilities where the nurses can&#8217;t get the drugs updated and the order put in so the drugs can arrive on time,&#8221; she said. &#8220;In another case, we have this one small assisted living place that is just a single unit that connects to billing. And if they don&#8217;t get their billing into Medicaid by December 5, they close their doors. Seniors that don&#8217;t have family to go to are then done. We have a lot of [clients] right now who are like, &#8216;Just give me my data,&#8217; but we can&#8217;t.&#8221;<span id="more-49619"></span></p>
<p>The ongoing incident at VCPI is just the latest in a string of ransomware attacks against healthcare organizations, which typically operate on razor thin profit margins and have comparatively little funds to invest in maintaining and securing their IT systems.</p>
<p>Earlier this week, a <a href="https://www.silicon.co.uk/security/cyberwar/french-hospital-ransomware-attack-318031" target="_blank" rel="noopener">1,300-bed hospital in France was hit by ransomware</a> that knocked its computer systems offline, causing &#8220;very long delays in care&#8221; and forcing staff to resort to pen and paper.</p>
<p>On Nov. 20, Cape Girardeau, Mo.-based <strong>Saint Francis Healthcare System</strong> <a href="https://www.beckershospitalreview.com/cybersecurity/missouri-health-system-alerts-patients-of-ransomware-attack.html" target="_blank" rel="noopener">began notifying patients about a ransomware attack</a> that left physicians unable to access medical records prior to Jan. 1.</p>
<p>Tragically, there is evidence to suggest that patient outcomes can suffer even after the dust settles from a ransomware infestation at a healthcare provider. <a href="https://krebsonsecurity.com/2019/11/study-ransomware-data-breaches-at-hospitals-tied-to-uptick-in-fatal-heart-attacks/" target="_blank" rel="noopener">New research</a> indicates hospitals and other care facilities that have been hit by a data breach or ransomware attack can expect to see an increase in the death rate among certain patients in the following months or years because of cybersecurity remediation efforts.</p>
<p>Researchers at Vanderbilt University‘s Owen Graduate School of Management took the Department of Health and Human Services (HHS) list of healthcare data breaches and used it to drill down on data about patient mortality rates at more than 3,000 Medicare-certified hospitals, about 10 percent of which had experienced a data breach.</p>
<p>Their findings suggest that after data breaches as many as 36 additional deaths per 10,000 heart attacks occurred annually at the hundreds of hospitals examined. The researchers concluded that for care centers that experienced a breach, it took an additional 2.7 minutes for suspected heart attack patients to receive an electrocardiogram.</p>
<p>Companies hit by the Ryuk ransomware all too often are compromised for months or even years before the intruders get around to mapping out the target&#8217;s internal networks and compromising key resources and data backup systems. Typically, the initial infection stems from a booby-trapped email attachment that is used to download additional malware &#8212; such as <a href="https://www.cisecurity.org/white-papers/security-primer-trickbot/" target="_blank" rel="noopener">Trickbot</a> and <a href="https://www.us-cert.gov/ncas/alerts/TA18-201A" target="_blank" rel="noopener">Emotet</a>.</p>
<div id="attachment_49636" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/dfd0590b.emotet-cert.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/emotet-cert.png"><img class="wp-image-49636" src="media/dfd0590b.emotet-cert.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/emotet-cert.png" alt="" width="597" height="409" /></a><p class="wp-caption-text">This graphic from US-CERT depicts how the Emotet malware is typically used to lay the groundwork for a full-fledged ransomware infestation.</p></div>
<p>In this case, there is evidence to suggest that VCPI was compromised by one (or both) of these malware strains on multiple occasions over the past year. <strong>Alex Holden</strong>, founder of Milwaukee-based cyber intelligence firm <a href="https://www.holdsecurity.com/" target="_blank" rel="noopener">Hold Security</a>, showed KrebsOnSecurity information obtained from monitoring dark web communications which suggested the initial intrusion may have begun as far back as September 2018.</p>
<p>Holden said t<span id=":1db.co" class="tL8wMe EMoHub" dir="ltr">he attack was preventable up until the very end when the ransomware was deployed, and that this attack once again shows that even after the initial Trickbot or Emotet infection, companies can still prevent a ransomware attack. That is, of course, assuming they&#8217;re in the habit of regularly looking for signs of an intrusion.</span></p>
<p>&#8220;While it is clear that the initial breach occurred 14 months ago, the escalation of the compromise didn&#8217;t start until around November 15th of this year,&#8221; Holden said. &#8220;When we looked at this in retrospect, during these three days the cybercriminals slowly compromised the entire network, disabling antivirus, running customized scripts, and deploying ransomware. They didn&#8217;t even succeed at first, but they kept trying.&#8221;</p>
<p>VCPI&#8217;s CEO said her organization plans to publicly document everything that has happened so far when (and if) this attack is brought under control, but for now the company is fully focused on rebuilding systems and restoring operations, and on <a href="media/d1b210ef.Client_Letter_Nov_17_Incident_Response_6am_Tuesday_update.pdf" data-original-source="https://gallery.mailchimp.com/e4b69b80950b6530cfb032285/files/99792ea8-cad9-4c28-82d5-21c6b757b138/Client_Letter_Nov_17_Incident_Response_6am_Tuesday_update.pdf" target="_blank" rel="noopener">keeping clients informed</a> at every step of the way.</p>
<p>&#8220;We&#8217;re going to make it part of our strategy to share everything we&#8217;re going through,&#8221; Christianson said, adding that when the company initially tried several efforts to sidestep the intruders their phone systems came under concerted assault. &#8220;But we&#8217;re still under attack, and as soon as we can open, we&#8217;re going to document everything.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=49592
title: Hidden Cam Above Bluetooth Pump Skimmer
uri: Hidden-Cam-Above-Bluetooth-Pump-Skimmer
url: https://krebsonsecurity.com/2019/11/hidden-cam-above-bluetooth-pump-skimmer/
content:
<p>Tiny hidden spy cameras are a common sight at ATMs that have been tampered with by crooks who specialize in retrofitting the machines with card skimmers. But until this past week I&#8217;d never heard of hidden cameras being used at gas pumps in tandem with Bluetooth-based card skimming devices.</p>
<p>Apparently, I&#8217;m not alone.</p>
<p>&#8220;I believe this is the first time I’ve seen a camera on a gas pump with a Bluetooth card skimmer,&#8221; said <strong>Detective Matt Jogodka </strong>of the Las Vegas Police Department, referring to the compromised fuel pump pictured below.</p>
<div id="attachment_49597" style="width: 605px" class="wp-caption aligncenter"><img class=" wp-image-49597" src="media/7b14d387.btpskimpanel.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/btpskimpanel.png" alt="" width="595" height="307" /><p class="wp-caption-text">The fake panel (horizontal) above the &#8220;This Sale&#8221; display obscures a tiny hidden camera angled toward the gas pump&#8217;s PIN pad.</p></div>
<p>It may be difficult to tell from the angle of the photograph above, but the horizontal bar across the top of the machine (just above the &#8220;This Sale $&#8221; indicator) contains a hidden pinhole camera angled so as to record debit card users entering their PIN.</p>
<p>Here&#8217;s a look at the fake panel removed from the compromised pump:</p>
<div id="attachment_49598" style="width: 606px" class="wp-caption aligncenter"><img class=" wp-image-49598" src="media/5a70f684.btpumpskimcamface.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/btpumpskimcamface.png" alt="" width="596" height="193" /><p class="wp-caption-text">A front view of the hidden camera panel.</p></div>
<p>Jogodka said although this pump&#8217;s PIN pad is encrypted, the hidden camera sidesteps that security feature.</p>
<p>&#8220;The PIN pad is encrypted, so this is a NEW way to capture the PIN,&#8221; Jogodka wrote in a message to a mailing list about skimming devices found on Arizona fuel pumps. &#8220;The camera was set on Motion, [to] save memory space and battery life. Sad for the suspect, it was recovered 2 hours after it was installed.&#8221;<span id="more-49592"></span></p>
<p>Whoever hacked this fuel pump was able to get inside the machine and install a Bluetooth-based circuit board that connects to the power and can transmit stolen card data wirelessly. This allows the thieves to drive by at any time and download the card data remotely from a mobile device or laptop.</p>
<div id="attachment_49600" style="width: 603px" class="wp-caption aligncenter"><img class=" wp-image-49600" src="media/0002b9dc.btpumpskimclose.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/btpumpskimclose.png" alt="" width="593" height="409" /><p class="wp-caption-text">The unauthorized Bluetooth circuit board can be seen at bottom left attached to the pump&#8217;s power and card reader.</p></div>
<p>This kind of fuel pump skimmer, while rare, serves as a reminder that it&#8217;s a good idea to choose credit over debit when buying fuel. For starters, there are different legal protections for fraudulent transactions on debit vs. credit cards.</p>
<p>With a credit card, your maximum loss on any transactions you report as fraud is $50; with a debit card, that protection only extends for within two days of the unauthorized transaction. After that, the maximum consumer liability can increase to $500 within 60 days, and to an unlimited amount after 60 days.</p>
<p>In practice, your bank or debit card issuer may still waive additional liabilities, and many do. But even then, having your checking account emptied of cash while your bank sorts out the situation can still be a huge hassle and create secondary problems (bounced checks, for instance).</p>
<p>Interestingly, this advice against using debit cards at the pump often runs counter to the messaging pushed by fuel station owners themselves, many of whom offer lower prices for cash or debit card transactions. That’s because credit card transactions typically are more expensive to process.</p>
<p>Anyone curious how to tell the difference between filling stations that prioritize card security versus those that haven&#8217;t should check out <a href="https://krebsonsecurity.com/2018/06/how-to-avoid-card-skimmers-at-the-pump/" target="_blank" rel="noopener">How to Avoid Card Skimmers at the Pump</a>.</p>
<div id="attachment_49651" style="width: 605px" class="wp-caption aligncenter"><img class=" wp-image-49651" src="media/ca5d6045.pumpskimbt-full.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/pumpskimbt-full.png" alt="" width="595" height="490" /><p class="wp-caption-text">The compromised pump with the hidden camera bar still attached. Newer, more secure pumps have a horizontal card reader and a raised metallic keypad.</p></div>


feed_id: https://krebsonsecurity.com/?p=49648
title: Sale of 4 Million Stolen Cards Tied to Breaches at 4 Restaurant Chains
uri: Sale-of-4-Million-Stolen-Cards-Tied-to-Breaches-at-4-Restaurant-Chains
url:
https://krebsonsecurity.com/2019/11/sale-of-4-million-stolen-cards-tied-to-breaches-at-4-restaurant-chains/

content:
<p>On Nov. 23, one of the cybercrime underground&#8217;s largest bazaars for buying and selling stolen payment card data announced the immediate availability of some four million freshly-hacked debit and credit cards. KrebsOnSecurity has learned this latest batch of cards was siphoned from four different compromised restaurant chains that are most prevalent across the midwest and eastern United States.</p>
<div id="attachment_49658" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/c9a5f455.jstashnewworld.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/jstashnewworld.png"><img class="wp-image-49658" src="media/c9a5f455.jstashnewworld.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/jstashnewworld.png" alt="" width="598" height="554" /></a><p class="wp-caption-text">An advertisement on the cybercrime store Joker&#8217;s Stash for a new batch of ~4 million credit/debit cards stolen from four different restaurant chains across the midwest and eastern United States.</p></div>
<p>Two financial industry sources who track payment card fraud and asked to remain anonymous for this story said the four million cards were taken in breaches recently disclosed by restaurant chains <a href="http://krystal.com/security/" target="_blank" rel="noopener">Krystal</a>, <a href="https://www.moes.com/paymentcardnotification" target="_blank" rel="noopener">Moe&#8217;s</a>, <a href="https://www.mcalistersdeli.com/paymentcardnotification" target="_blank" rel="noopener">McAlister&#8217;s Deli</a> and <a href="https://www.schlotzskys.com/paymentcardnotification" target="_blank" rel="noopener">Schlotzsky&#8217;s</a>. Krystal announced a card breach last month. The other three restaurants are all part of the same parent company and disclosed breaches in August 2019.</p>
<p>KrebsOnSecurity heard the same conclusion from <a href="https://geminiadvisory.io/" target="_blank" rel="noopener">Gemini Advisory</a>, a New York-based fraud intelligence company.</p>
<p>&#8220;Gemini found that the four breached restaurants, ranked from most to least affected, were Krystal, Moe&#8217;s, McAlister&#8217;s and Schlotzsky&#8217;s,&#8221;  Gemini wrote in an analysis of the New World Order batch shared with this author. &#8220;Of the 1,750+ locations belonging to these restaurants, nearly 50% were breached and had customer payment card data exposed. These breached locations were concentrated in the central and eastern United States, with the highest exposure in Florida, Georgia, South Carolina, North Carolina, and Alabama.&#8221;</p>
<div id="attachment_49662" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/4fb4f0e0.newworldgeo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/newworldgeo.png"><img class="wp-image-49662" src="media/4fb4f0e0.newworldgeo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/newworldgeo.png" alt="" width="594" height="324" /></a><p class="wp-caption-text">McAlister’s (green), Schlotzsky’s (blue), Moe’s (gray), and Krystal (orange) locations across the United States. There is an additional Moe’s location in Hawaii that is not depicted. Image: Gemini Advisory.</p></div>
<p><strong>Focus Brands</strong> (which owns Moe&#8217;s, McAlister&#8217;s, and Schlotzsky&#8217;s) was breached between April and July 2019, and publicly disclosed this on August 23. Krystal claims to have been breached between July and September 2019, and disclosed this in late October.</p>
<p>The stolen cards went up for sale at <a href="https://krebsonsecurity.com/?s=joker%27s+stash&amp;x=0&amp;y=0" target="_blank" rel="noopener">the infamous Joker&#8217;s Stash carding bazaar</a>. The most recent big breach marketed on Joker&#8217;s Stash <a href="https://krebsonsecurity.com/2019/08/breach-at-hy-vee-supermarket-chain-tied-to-sale-of-5m-stolen-credit-debit-cards/" target="_blank" rel="noopener">was dubbed &#8220;Solar Energy,&#8221; and included more than five million cards stolen from restaurants, fuel pumps and drive-through coffee shops operated by Hy-Vee</a>, a supermarket chain based in Iowa.</p>
<p>According to Gemini, Joker&#8217;s Stash likely delayed the debut of the New World Order cards to keep from flooding the market with too much stolen card data all at once, which can have the effect of lowering prices for stolen cards across the board.</p>
<p>&#8220;Joker&#8217;s Stash first announced their breach on November 11, 2019 and published the data on November 22,&#8221; Gemini found. &#8220;This delay between breaches occurring as early as July and data being offered in the dark web in November appears to be an effort to avoid oversaturating the dark web market with an excess of stolen payment records.&#8221;<span id="more-49648"></span></p>
<p>Most card breaches at restaurants and other brick-and-mortar stores occur when cybercriminals manage to remotely install malicious software on the retailer’s card-processing systems, often by compromising third-party firms that help manage these systems. This type of point-of-sale malware is capable of copying data stored on a credit or debit card’s magnetic stripe when those cards are swiped at compromised payment terminals, and that data can then be used to create counterfeit copies of the cards.</p>
<p>The United States is embarrassingly the last of the G20 nations to make the shift to more secure chip-based cards, which are far more expensive and difficult for criminals to counterfeit. Unfortunately, many merchants have not yet shifted to using chip-based card readers and still swipe their customers&#8217; cards.</p>
<p>According to <a href="https://usa.visa.com/visa-everywhere/blog/bdp/2019/09/03/visa-emv-chip-1567530138363.html" target="_blank" rel="noopener">stats released in September</a> by <strong>Visa</strong>, 80 percent of U.S. storefronts now accept chip cards. Visa says for merchants who have completed the chip upgrade, counterfeit fraud dollars dropped 87 percent in March 2019 compared to September 2015. This may help explain why card thieves <a href="https://krebsonsecurity.com/2019/04/data-e-retail-hacks-more-lucrative-than-ever/" target="_blank" rel="noopener">increasingly are shifting their attention to compromising e-commerce merchants</a>, a trend seen in virtually every country that has already made the transition to chip-based cards.</p>
<p>Companies that accept, store, process and transmit credit and debit card payments are required to implement so-called <a href="https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard" target="_blank" rel="noopener">Payment Card Industry (PCI) security standards</a>, but not all entities are required to prove that they have met them. While the PCI standards are widely considered a baseline for merchants that accept payment cards, many security experts advise companies to put in place protections that go well beyond these standards.</p>
<p>Even so, the <a href="https://enterprise.verizon.com/resources/reports/payment-security/" target="_blank" rel="noopener">2019 Payment Security Report</a> from <strong>Verizon</strong> indicates the number of companies that maintain full compliance with PCI standards decreased for the second year in a row to just 36.7 percent worldwide.</p>
<p>As noted in <a href="https://krebsonsecurity.com/2017/12/4-years-after-target-the-little-guy-is-the-target/" target="_blank" rel="noopener">previous stories here</a>, the organized cyberthieves involved in stealing card data from main street merchants have gradually moved down the food chain from big box retailers like Target and Home Depot to smaller but far more plentiful and probably less secure merchants (either by choice or because the larger stores became a harder target).</p>
<p>It’s really not worth worrying about where your card number may have been breached, <a href="https://krebsonsecurity.com/2015/01/how-was-your-credit-card-stolen/" target="_blank" rel="noopener">since it’s almost always impossible to say for sure</a> and because it’s common for the same card to be breached at multiple establishments during the same time period.</p>
<p>Just remember that while consumers are not liable for fraudulent charges, it may still fall to you the consumer to spot and report any suspicious charges. So keep a close eye on your statements, and consider signing up for text message notifications of new charges if your card issuer offers this service. Most of these services also can be set to alert you if you’re about to miss an upcoming payment, so they can also be handy for avoiding late fees and other costly charges.</p>


feed_id: https://krebsonsecurity.com/?p=49517
title: It’s Way Too Easy to Get a .gov Domain Name
uri: It-s-Way-Too-Easy-to-Get-a-gov-Domain-Name
url: https://krebsonsecurity.com/2019/11/its-way-too-easy-to-get-a-gov-domain-name/
content:
<p>Many readers probably believe they can trust links and emails coming from U.S. federal government domain names, or else assume there are at least more stringent verification requirements involved in obtaining a <strong>.gov</strong> domain versus a commercial one ending in .com or .org. But a recent experience suggests this trust may be severely misplaced, and that it is relatively straightforward for anyone to obtain their very own .gov domain.</p>
<p><img class="aligncenter size-full wp-image-49682" src="media/f25f353d.dotgov.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/dotgov.png" alt="" width="596" height="378" /></p>
<p>Earlier this month, KrebsOnSecurity received an email from a researcher who said he got a .gov domain simply by filling out and emailing an online form, grabbing some letterhead off the homepage of a small U.S. town that only has a &#8220;.us&#8221; domain name, and impersonating the town&#8217;s mayor in the application.</p>
<p>&#8220;I used a fake Google Voice number and fake Gmail address,&#8221; said the source, who asked to remain anonymous for this story but who said he did it mainly as a thought experiment. &#8220;The only thing that was real was the mayor&#8217;s name.&#8221;</p>
<p>The email from this source was sent from <strong>exeterri[.]gov</strong>, a domain registered on Nov. 14 that at the time displayed the same content as the .us domain it was impersonating &#8212; <a href="https://www.town.exeter.ri.us/" target="_blank" rel="noopener">town.exeter.ri.us</a> &#8212; which belongs to the town of Exeter, Rhode Island (the impostor domain is no longer resolving).</p>
<p>&#8220;I had to [fill out] &#8216;<a href="https://home.dotgov.gov/registration/authorization-templates/" target="_blank" rel="noopener">an official authorization form</a>,&#8217; which basically just lists your admin, tech guy, and billing guy,&#8221; the source continued. &#8220;Also, it needs to be printed on &#8216;official letterhead,&#8217; which of course can be easily forged just by Googling a document from said municipality. Then you either mail or fax it in. After that, they send account creation links to all the contacts.&#8221;</p>
<p>Technically, what my source did was <a href="https://criminal.findlaw.com/criminal-charges/wire-fraud.html" target="_blank" rel="noopener">wire fraud</a> (obtaining something of value via the Internet/telephone/fax through false pretenses); had he done it through the U.S. mail, he could be facing <a href="https://criminal.findlaw.com/criminal-charges/mail-fraud.html" target="_blank" rel="noopener">mail fraud</a> charges if caught.</p>
<p>But a cybercriminal &#8212; particularly a state-sponsored actor operating outside the United States &#8212; likely would not hesitate to do so if he thought the $400 pricetag for registering a .gov was worth it to make his malicious website, emails or fake news social media campaign more believable.</p>
<p>&#8220;I never said it was legal, just that it was easy,&#8221; the source said. <span class="pullquote pqright">&#8220;I assumed there would be at least ID verification. The deepest research I needed to do was Yellow Pages records.&#8221;</span></p>
<p>On Tuesday, KrebsOnSecurity contacted officials in the real town of Exeter, RI to find out if anyone from the <strong>U.S.</strong> <strong>General Services Administration </strong>&#8212; the federal agency responsible for managing the .gov domain registration process &#8212; had sought to validate the request prior to granting a .gov in their name.</p>
<p>A person who called back from the town clerk&#8217;s office but who asked not to be named said someone from the GSA did phone the mayor&#8217;s office on Nov. 24 &#8212; which was four days after I reached out to the federal agency about the domain in question and approximately 10 days after the GSA had already granted the phony request.</p>
<h4>WHO WANTS TO BE A GOVERNMENT?</h4>
<p>Responding today via email, a GSA spokesperson said the agency doesn&#8217;t comment on open investigations.</p>
<p>&#8220;GSA is working with the appropriate authorities and has already implemented additional fraud prevention controls,&#8221; the agency wrote, without elaborating on what those additional controls might be.</p>
<p>KrebsOnSecurity did get a substantive response from the <strong>Cybersecurity and Infrastructure Security Agency</strong>, a division of the <strong>U.S. Department of Homeland Security</strong> which is leading efforts to protect the federal .gov domain of civilian government networks [NB: The head of CISA, <a href="https://www.dhs.gov/person/christopher-c-krebs" target="_blank" rel="noopener">Christopher C. Krebs</a>, is of no relation to this author].</p>
<p>The CISA said this matter is so critical to maintaining the security and integrity of the .gov space that DHS is now making a play to assume control over the issuance of all .gov domains.</p>
<p>&#8220;The .gov top-level domain (TLD) is critical infrastructure for thousands of federal, state and local government organizations across the country,&#8221; reads a statement CISA sent to KrebsOnSecurity. &#8220;Its use by these institutions should instill trust. In order to increase the security of all US-based government organizations, CISA is seeking the authority to manage the .gov TLD and assume governance from the General Services Administration.&#8221;</p>
<p>The statement continues:</p>
<p>&#8220;This transfer would allow CISA to modernize the .gov registrar, enhance the security of individual .gov domains, ensure that only authorized users obtain a .gov domain, proactively validate existing .gov holders, and better secure everyone that relies on .gov. We are appreciative of Congress’ efforts to put forth the <a href="https://www.congress.gov/bill/116th-congress/senate-bill/2749/text" target="_blank" rel="noopener">DOTGOV bill</a> [link added] that would grant CISA this important authority moving forward. GSA has been an important partner in these efforts and our two agencies will continue to work hand-in-hand to identify and implement near-term security enhancements to the .gov.&#8221;<span id="more-49517"></span></p>
<h4>FEELING LUCKY? LASVEGAS.GOV CAN BE YOURS FOR $400!</h4>
<p>In an era when the nation&#8217;s top intelligence agencies continue to warn about ongoing efforts by Russia and other countries to interfere in our elections and democratic processes, it may be difficult to fathom that an attacker could so easily leverage such a simple method for impersonating state and local authorities.</p>
<p>Despite the ease with which apparently anyone can get their own .gov domain, there are plenty of major U.S. cities that currently do not have one, probably because they never realized they <em>could</em> with very little effort or expense. A review of the <a href="https://en.wikipedia.org/wiki/List_of_United_States_cities_by_population" target="_blank" rel="noopener">Top 10 most populous U.S. cities</a> indicates only half of them have obtained .gov domains, including Chicago, Dallas, Phoenix, San Antonio, and San Diego.</p>
<p>Yes, you read that right: <strong>houston.gov</strong>, <strong>losangeles.gov, </strong><strong>newyorkcity.gov</strong>, and <strong>philadelphia.gov</strong> <a href="https://domains.dotgov.gov/dotgov-web/registration/whois.xhtml" target="_blank" rel="noopener">are all still available</a>. As is the .gov for San Jose, Calif., the economic, cultural and political center of Silicon Valley. No doubt a great number of smaller cities also haven&#8217;t figured out they&#8217;re eligible to secure their own .gov domains.</p>
<p>In addition to being able to convincingly spoof communications from and websites for cities and towns, there are almost certainly a myriad other ways that possessing a phony .gov domain could be abused. For example, my source said he was able to register his domain in Facebook&#8217;s law enforcement subpoena system, although he says he did not attempt to abuse that access.</p>
<div id="attachment_49686" style="width: 602px" class="wp-caption aligncenter"><a class="lightbox" href="media/9c92cffc.exe-fbleo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/exe-fbleo.png"><img class="wp-image-49686" src="media/9c92cffc.exe-fbleo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/exe-fbleo.png" alt="" width="592" height="465" /></a><p class="wp-caption-text">The source who successfully registered an impostor .gov domain said he was able to use that access to register for Facebook&#8217;s law enforcement subpoena system.</p></div>
<p>One way fraudsters might make a fake .gov domain even more convincing would be to equip the site with an SSL certificate so that the phony domain displays the green padlock icon in a user&#8217;s Web browser. While the presence of a lock icon is most definitely <em>not</em> an indicator that a site is legitimate (<a href="https://krebsonsecurity.com/2018/11/half-of-all-phishing-sites-now-have-the-padlock/" target="_blank" rel="noopener">somewhere north of 50 percent of all phishing sites now include the padlock</a>), anyone who obtains a .gov domain is automatically eligible to have an SSL cert issued for that domain by the GSA.</p>
<p>Now consider what a well-funded adversary could do on Election Day armed with a handful of .gov domains for some major cities in Democrat strongholds within key swing states: The attackers register their domains a few days in advance of the election, and then on Election Day send out emails signed by .gov from, say, miami.gov (also still available) informing residents that bombs had gone off at polling stations in Democrat-leaning districts. Such a hoax could well decide the fate of a close national election.</p>
<p><a href="https://en.wikipedia.org/wiki/John_R._Levine" target="_blank" rel="noopener">John Levine</a>, a domain name expert, consultant and author of the book <a href="https://www.amazon.com/Internet-Dummies-John-R-Levine/dp/1118096142" target="_blank" rel="noopener"><em>The Internet for Dummies</em></a>, said the .gov domain space wasn&#8217;t always so open as it is today.</p>
<p>&#8220;Back in the day, everyone not in the federal government was supposed to register in the .us space,&#8221; Levine said. &#8220;At some point, someone decided .gov is going to be more democratic and let everyone in the states register. But as we see, there&#8217;s still no validation.&#8221;</p>
<p>Levine, who served three years as mayor of the village of Trumansburg, New York, said it would not be terribly difficult for the GSA to do a better job of validating .gov domain requests, but that some manual verification would probably be required.</p>
<p>&#8220;When I was a mayor, I was in frequent contact with the state, and states know who all their municipalities are and how to reach people in charge of them,&#8221; Levine said. &#8220;Also, every state has a Secretary of State that keeps track of what all the subdivisions are, and including them in the process could help as well.&#8221;</p>
<p>Levine said like the Internet itself, this entire debacle is yet another example of an important resource with potentially explosive geopolitical implications that was never designed with security or authentication in mind.</p>
<p>&#8220;It turns out that the GSA is pretty good at doing boring clerical stuff,&#8221; he said. &#8220;But as we keep discovering, what we once thought was a boring clerical thing now actually has real-world security implications.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=49744
title: The iPhone 11 Pro’s Location Data Puzzler
uri: The-iPhone-11-Pro-s-Location-Data-Puzzler
url: https://krebsonsecurity.com/2019/12/the-iphone-11-pros-location-data-puzzler/
content:
<p>One of the more curious behaviors of Apple&#8217;s new <strong>iPhone 11 Pro</strong> is that it intermittently seeks the user&#8217;s location information even when all applications and system services on the phone are individually set to never request this data. Apple says this is by design, but that response seems at odds with the company&#8217;s own privacy policy.</p>
<p>The privacy policy available from the iPhone&#8217;s Location Services screen says, &#8220;If Location Services is on, your iPhone will periodically send the geo-tagged locations of nearby Wi-Fi hotspots and cell towers (where supported by a device) in an anonymous and encrypted form to Apple, to be used for augmenting this crowd-sourced database of Wi-Fi hotspot and cell tower locations.&#8221;</p>
<p>The policy explains users can disable all location services entirely with one swipe (by navigating to Settings &gt; Privacy &gt; Location Services, then switching &#8220;Location Services&#8221; to &#8220;off&#8221;). When one does this, the location services indicator &#8212; a small diagonal upward arrow to the left of the battery icon &#8212; no longer appears unless Location Services is re-enabled.</p>
<p>The policy continues: &#8220;You can also disable location-based system services by tapping on System Services and turning off each location-based system service.&#8221; But apparently there are some system services on this model (and possibly <a href="https://www.macworld.com/article/3437999/iphone-11-vs-iphone-11-prosspecs-features-colors-price.html" target="_blank" rel="noopener">other iPhone 11 models</a>) which request location data and cannot be disabled by users without completely turning off location services, as the arrow icon still appears periodically even after individually disabling all system services that use location.</p>
<p>On Nov. 13, KrebsOnSecurity contacted Apple to report this as a possible privacy bug in the new iPhone Pro and/or in iOS 13.x, sharing a video showing how the device still seeks the user&#8217;s location when each app and system service is set to &#8220;never&#8221; request location information (but with the main Location Data service still turned on).</p>
<p><iframe src="https://www.youtube.com/embed/37_3hd_SK24" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></p>
<p>The video above was recorded on a brand new iPhone 11 Pro. The behavior appears to persist in the latest iPhone operating system (iOS 13.2.3) on iPhone 11 Pro devices. A review of Apple&#8217;s support forum indicates other users <a href="https://discussions.apple.com/thread/250665845" target="_blank" rel="noopener">are experiencing the same issue</a>. I was not able replicate this behavior on an older model iPhone 8 with the latest iOS.</p>
<p>This week Apple responded that the company does not see any concerns here and that the iPhone was performing as designed.</p>
<p>&#8220;We do not see any actual security implications,&#8221; an Apple engineer wrote in a response to KrebsOnSecurity. &#8220;It is expected behavior that the Location Services icon appears in the status bar when Location Services is enabled. <em>The icon appears for system services that do not have a switch in Settings&#8221; </em>[emphasis added].</p>
<p>Apple has not yet responded to follow-up questions, but it seems they are saying their phones have some system services that query your location regardless of whether one has disabled this setting individually for all apps and iOS system services.</p>
<p>Granted, the latest versions of iOS give users far more granular control over the sharing of this data <a href="https://appletoolbox.com/why-is-my-iphones-location-services-icon-is-always-on/" target="_blank" rel="noopener">than in the past</a>, especially with respect to third-party apps. And perhaps this oddity is somehow related to <a href="https://www.wi-fi.org/discover-wi-fi/wi-fi-certified-6" target="_blank" rel="noopener">adding support for super-fast new WiFi 6 routers</a>, which may have involved the introduction of new hardware.</p>
<p>But it would be nice to know what has changed in the iPhone 11 and why, particularly given Apple&#8217;s <a href="https://www.youtube.com/watch?v=Py0acqg1oKc" target="_blank" rel="noopener">recent commercials</a> on how they respect user privacy choices &#8212; including location information. This post will be updated in the event Apple provides a more detailed response.</p>


feed_id: https://krebsonsecurity.com/?p=49813
title: Apple Explains Mysterious iPhone 11 Location Requests
uri: Apple-Explains-Mysterious-iPhone-11-Location-Requests
url: https://krebsonsecurity.com/2019/12/apple-explains-mysterious-iphone-11-location-requests/
content:
<p>KrebsOnSecurity <a href="https://krebsonsecurity.com/2019/12/the-iphone-11-pros-location-data-puzzler/" target="_blank" rel="noopener">ran a story this week</a> that puzzled over <strong>Apple</strong>&#8216;s response to inquiries about a potential privacy leak in its new <strong>iPhone 11</strong> line, in which the devices appear to intermittently seek the user&#8217;s location even when all applications and system services are individually set never to request this data. Today, Apple disclosed that this behavior is tied to the inclusion of a short-range technology that lets iPhone 11 users share files locally with other nearby phones that support this feature, and that a future version of its mobile operating system will allow users to disable it.</p>
<p><img class="aligncenter wp-image-49815" src="media/fcff6064.iphone11pro.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/iphone11pro.png" alt="" width="598" height="318" /></p>
<p>I published Tuesday&#8217;s story mainly because Apple&#8217;s initial and somewhat dismissive response &#8212; that this was expected behavior and not a bug &#8212; was at odds with its own privacy policy and with its <a href="https://www.youtube.com/watch?v=Py0acqg1oKc" target="_blank" rel="noopener">recent commercials</a> stating that customers should be in full control over what they share via their phones and what their phones share about them.</p>
<p>But in a statement provided today, Apple said the location beaconing <a href="https://www.youtube.com/watch?v=37_3hd_SK24&amp;feature=emb_logo" target="_blank" rel="noopener">I documented in a video</a> was related to <strong>Ultra Wideband</strong> technology that &#8220;provides spatial awareness allowing iPhone to understand its position relative to other Ultra Wideband enabled devices (i.e. all new iPhone 11s, including the Pro and Pro Max).</p>
<p>Ultra-wideband (a.k.a UWB) is <a href="https://en.wikipedia.org/wiki/Ultra-wideband" target="_blank" rel="noopener">a radio technology</a> that uses a very low energy level for short-range, high-bandwidth communications of a large portion of the radio spectrum without interfering with more conventional transmissions.</p>
<p>&#8220;So users can do things like share a file with someone using AirDrop simply by pointing at another user’s iPhone,&#8221; Apple&#8217;s statement reads. The company further explained that the location information indicator (a small, upward-facing arrow to the left of the battery icon) appears because the device periodically checks to see whether it is being used in a handful of countries for which Apple hasn&#8217;t yet received approval to deploy Ultra Wideband.</p>
<p>&#8220;Ultra Wideband technology is an industry standard technology and is subject to international regulatory requirements that require it to be turned off in certain locations,&#8221; the statement continues. &#8220;iOS uses Location Services to help determine if iPhone is in these prohibited locations in order to disable Ultra Wideband and comply with regulations. The management of Ultrawide Band compliance and its use of location data is done entirely on the device and Apple is not collecting user location data.&#8221;<span id="more-49813"></span></p>
<p>Apple&#8217;s privacy policy says users can disable all apps and system services that query the user&#8217;s location all at once by toggling the main &#8220;Location Services&#8221; option to &#8220;off.&#8221; Alternatively, it says, users can achieve the same results by individually turning off all System Services that use location in the iPhone settings.</p>
<p>What prompted my initial inquiry to Apple about this on Nov. 13 was that the location services icon on the iPhone 11 would reappear every few minutes even though all of the device&#8217;s individual location services had been disabled.</p>
<p>“It is expected behavior that the Location Services icon appears in the status bar when Location Services is enabled,&#8221; Apple stated in their initial response. &#8220;<em>The icon appears for system services that do not have a switch in Settings</em>” [emphasis added].</p>
<p>Now we know more about at least one of those services. Apple says it plans to include the option of a dedicated toggle in System Services to disable the UWB activity in an upcoming update of its <strong>iOS</strong> operating system, although it didn&#8217;t specify when that option might be available.</p>
<p>The one head-scratcher remaining is that the new iPhone seems to check whether it&#8217;s in a country that allows UWB fairly frequently, even though the list of countries where this feature is not yet permitted is fairly small, and includes Argentina, Indonesia and Paraguay. A complete list of countries where iPhones <em>can</em> use UWB is <a href="https://www.apple.com/ios/feature-availability/#ultra-wideband" target="_blank" rel="noopener">here</a>. The principal remaining concern may be that these periodic checks unnecessarily drain the iPhone 11&#8217;s battery.</p>
<p>It is never my intention to create alarm where none should exist; there are far too many real threats to security and privacy that deserve greater public attention and scrutiny from the news media. However, Apple does itself and its users no favors when it takes weeks to respond (or not, as my colleague <a href="https://twitter.com/zackwhittaker" target="_blank" rel="noopener">Zack Whittaker</a> at <em>TechCrunch</em> <a href="https://techcrunch.com/2019/12/05/apple-ultra-wideband-newer-iphones-location/" target="_blank" rel="noopener">discovered</a>) to legitimate privacy concerns, and then does so in a way that only generates more questions.</p>


feed_id: https://krebsonsecurity.com/?p=49848
title: Ransomware at Colorado IT Provider Affects 100+ Dental Offices
uri: Ransomware-at-Colorado-IT-Provider-Affects-100-Dental-Offices
url: https://krebsonsecurity.com/2019/12/ransomware-at-colorado-it-provider-affects-100-dental-offices/
content:
<p>A Colorado company that specializes in providing IT services to dental offices suffered a ransomware attack this week that is disrupting operations for more than 100 dentistry practices, KrebsOnSecurity has learned.</p>
<p>Multiple sources affected say their IT provider, Englewood, Colo. based <a href="https://www.systemconfidence.com/" target="_blank" rel="noopener">Complete Technology Solutions</a> (CTS), was hacked, allowing a potent strain of ransomware known as <a href="https://krebsonsecurity.com/2019/07/is-revil-the-new-gandcrab-ransomware/" target="_blank" rel="noopener">&#8220;Sodinokibi&#8221; or &#8220;rEvil&#8221;</a> to be installed on computers at more than 100 dentistry businesses that rely on the company for a range of services &#8212; including network security, data backup and voice-over-IP phone service.</p>
<p><img class="aligncenter wp-image-49851" src="media/a1f13a09.dentalsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/dentalsec.png" alt="" width="594" height="355" /></p>
<p>Reached via phone Friday evening, CTS President <strong>Herb Miner</strong> declined to answer questions about the incident. When asked about reports of a ransomware attack on his company, Miner simply said it was not a good time and hung up.</p>
<p>The attack on CTS comes little more than two months after <a href="https://krebsonsecurity.com/2019/08/ransomware-bites-dental-data-backup-firm/" target="_blank" rel="noopener">Sodinokibi hit Wisconsin-based dental IT provider PerCSoft</a>, an intrusion that encrypted files for approximately 400 dental practices.</p>
<p><strong>Thomas Terronez</strong>, CEO of Iowa-based <a href="https://www.medixdental.com" target="_blank" rel="noopener">Medix Dental</a>, said he&#8217;s heard from several affected practices that the attackers are demanding $700,000 in bitcoin from some of the larger victims to receive a key that can unlock files encrypted by the ransomware.</p>
<p>Others reported a ransom demand in the tens of thousands of dollars. In previous ransomware attacks, the assailants appear to have priced their ransom demands based on the number of workstation and/or server endpoints within the victim organization. According to CTS, its clients typically have anywhere from 10 to 100 workstations.</p>
<p>Terronez said he&#8217;s spoken with multiple other practices that have been sidelined by the ransomware attack, and that some CTS clients had usable backups of their data available off-site, while others have been working with third party companies to independently negotiate and pay the ransom for their practice only.<span id="more-49848"></span></p>
<p>Many of CTS&#8217;s customers took to posting about the attack on a private Facebook group for dentists, discussing steps they&#8217;ve taken or attempted to take to get their files back.</p>
<p>&#8220;I would recommend everyone reach out to their insurance provider,&#8221; said one dentist based in Denver. &#8220;I was told by CTS that I would have to pay the ransom to get my corrupted files back.&#8221;</p>
<p>&#8220;My experience has been very different,&#8221; said dental practitioner based in Las Vegas. &#8220;No help from my insurance. Still not working, great loss of income, patients are mad, staff even worse.&#8221;</p>
<p>Terronez said the dental industry in general has fairly atrocious security practices, and that relatively few offices are willing to spend what&#8217;s needed to fend off sophisticated attackers. He said it&#8217;s common to see servers that haven&#8217;t been patched for over a year, backups that haven&#8217;t run for a while, Windows Defender as only point of detection, non-segmented wireless networks, and the whole staff having administrator access to the computers &#8212; sometimes all using the same or simple passwords.</p>
<p>&#8220;A lot of these [practices] are forced into a price point on what they&#8217;re willing to spend,&#8221; said Terronez, whose company also offers IT services to dental providers. &#8220;The most important thing for these offices is how fast can you solve their problems, and not necessarily the security stuff behind the scenes until it really matters.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=49737
title: CISO Magazine Honors KrebsOnSecurity
uri: CISO-Magazine-Honors-KrebsOnSecurity
url: https://krebsonsecurity.com/2019/12/ciso-magazine-honors-krebsonsecurity/
content:
<p><strong>CISO Magazine</strong>, a publication dedicated to covering issues near and dear to corporate chief information security officers everywhere, has graciously awarded this author the designation of &#8220;<strong>Cybersecurity Person of the Year</strong>&#8221; in its December 2019 issue.</p>
<p><a class="lightbox" href="media/24be0028.ciso-cspy.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/ciso-cspy.png"><img class="alignright wp-image-49870" src="media/24be0028.ciso-cspy.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/ciso-cspy.png" alt="" width="250" height="334" /></a>KrebsOnSecurity is grateful for the unexpected honor. But I can definitely think of quite a few people who are far more deserving of this title. In fact, if I&#8217;m eligible for any kind of recognition, perhaps &#8220;Bad News Harbinger of the Year&#8221; would be more apt.</p>
<p>As in years past, 2019 featured quite a few big breaches and more than a little public speaking. Almost without fail at each engagement multiple C-level folks will approach after my talk, hand me their business cards and say something like, &#8220;I hope you never have to use this, but if you do please call me first.&#8221;</p>
<p>I&#8217;ve taken that advice to heart, and now endeavor wherever possible to give a heads up to CISOs/CSOs about a breach <em>before</em> reaching out to the public relations folks. I fully realize that in many cases the person in that role will refer me to the PR department eventually or perhaps immediately.</p>
<p>But on balance, my experience so far is that an initial outreach to the top security person in the organization often results in that inquiry being taken far more seriously. And including this person in my initial outreach makes it much more likely that this individual ends up being on the phone when the company returns my call.<span id="more-49737"></span></p>
<p>Too often, these conversations are led by the breached organization&#8217;s general counsel, which strikes me as an unnecessarily confrontational and strategically misguided approach. Especially if this is also their playbook for responding to random security researchers trying to let the company know about a dangerous security vulnerability, data breach or leak.</p>
<p>At least when there is a C-level security person on the phone when that call comes in I can be relatively sure I&#8217;m not going to get snowed on the technical details. While this may a distant concern for the organization in the throes of responding to a data security incident, the truth is that the first report is usually what gets repeated in the media &#8212; whether or not it is wholly accurate or fair.</p>
<p>This year&#8217;s CISO Magazine awards also honor the contributions of <strong>Rik Ferguson</strong>, vice president security research at <strong>Trend Micro</strong>, and <strong>Troy Hunt</strong>, an expert on web security and author of the data breach search website <a href="https://haveibeenpwned.com/" target="_blank" rel="noopener noreferrer" data-ss1575995807="1"><em>Have I Been Pwned?</em></a> More at <a href="https://www.cisomag.com/brian-krebs-cybersecurity-person-of-the-year/" target="_blank" rel="noopener">cisomag.com</a>.</p>


feed_id: https://krebsonsecurity.com/?p=49895
title: Patch Tuesday, December 2019 Edition
uri: Patch-Tuesday-December-2019-Edition
url: https://krebsonsecurity.com/2019/12/patch-tuesday-december-2019-edition/
content:
<p><strong>Microsoft</strong> today released updates to plug three dozen security holes in its <strong>Windows</strong> operating system and other software. The patches include fixes for seven critical bugs — those that can be exploited by malware or miscreants to take control over a Windows system with no help from users &#8212; as well as another flaw in most versions of Windows that is already being exploited in active attacks.</p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />By nearly all accounts, the chief bugaboo this month is <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1458" target="_blank" rel="noopener">CVE-2019-1458</a>, a vulnerability in a core Windows component (Win32k) that is present in Windows 7 through 10 and Windows Server 2008-2019. This bug is already being exploited in the wild, and according to <strong>Recorded Future</strong> the exploit available for it is similar to <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0859" target="_blank" rel="noopener">CVE-2019-0859</a>, a Windows flaw reported in April that was found <a href="https://securelist.com/new-win32k-zero-day-cve-2019-0859/90435/" target="_blank" rel="noopener">being sold in underground markets</a>.</p>
<p>CVE-2019-1458 is what&#8217;s known as a &#8220;privilege escalation&#8221; flaw, meaning an attacker would need to previously have compromised the system using another vulnerability. Handy in that respect is <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1468" target="_blank" rel="noopener">CVE-2019-1468</a>, a similarly widespread critical issue in the Windows font library that could be exploited just by getting the user to visit a hacked or malicious Web site.</p>
<p><strong>Chris Goettl</strong>, director of security at <a href="https://www.ivanti.com/resources/patch-tuesday" target="_blank" rel="noopener">Ivanti</a>, called attention to a curious patch advisory Microsoft released today for <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1489" target="_blank" rel="noopener">CVE-2019-1489</a>, which is yet another weakness in the <strong>Windows Remote Desktop Protocol</strong> (RDP) client, a component of Windows which lets users view and manage their system from a remote computer. What&#8217;s curious about this advisory is that it applies only to <strong>Windows XP Service Pack 3</strong>, which is no longer receiving security updates.</p>
<p>&#8220;The Exploitability Assessment for Latest Software Release and Older Software Release is 0, which is usually the value reserved for a vulnerability that is known to be exploited, yet the Exploited value was currently set to &#8216;No&#8217; as the bulletin was released today,&#8221; Goettl said. &#8220;If you look at the Zero Day from this month (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1458" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1458&amp;source=gmail&amp;ust=1576110872132000&amp;usg=AFQjCNG0f9W8x_nfgwEUyPH1qfJhF3zreA">CVE-2019-1458</a>) the EA for Older Software Release is &#8216;0 &#8211; Exploitation Detected.&#8217; An odd discrepancy on top of a CVE advisory for an outdated OS. It is very likely this is being exploited in the wild.&#8221;</p>
<p>Microsoft didn&#8217;t release a patch for this bug on XP, and <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1489" target="_blank" rel="noopener">its advisory on it</a> is about as sparse as they come. But if you&#8217;re still depending on Windows XP for remote access, you likely have bigger security concerns. Microsoft has patched <a href="https://krebsonsecurity.com/?s=rdp+2019+microsoft+patch&amp;x=0&amp;y=0" target="_blank" rel="noopener">many critical RDP flaws</a> in the past year. Even <a href="https://blog.netop.com/fbi-recommends-rdp-alternative" target="_blank" rel="noopener">the FBI last year encouraged users to disable it</a> unless needed, citing flawed encryption mechanisms in older versions and a lack of access controls which make RDP a frequent entry point for malware and ransomware.<span id="more-49895"></span></p>
<p>Speaking of no-longer-supported Microsoft operating systems, <strong>Windows 7</strong> and <strong>Windows Server 2008</strong> will cease receiving security updates after the next decade&#8217;s first Patch Tuesday comes to pass on January 14, 2020. While businesses and other volume-license purchasers will <a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/How-to-get-Extended-Security-Updates-for-eligible-Windows/ba-p/917807" target="_blank" rel="noopener">have the option to pay for further fixes</a> after that point, all other Windows 7 users who want to stick with Windows will need to consider migrating to <strong>Windows 10</strong> soon.</p>
<p>Windows 10 likes to install patches and sometimes feature updates all in one go and reboot your computer on its own schedule, but you don&#8217;t have to accept this default setting. <em>Windows Central</em> has <a href="https://www.windowscentral.com/how-stop-updates-installing-automatically-windows-10" target="_blank" rel="noopener">a useful guide</a> on how to disable or postpone automatic updates until you&#8217;re ready to install them. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in Windows Update. To get there, click the Windows key on your keyboard and type “windows update” into the box that pops up.</p>
<p>Keep in mind that while staying up-to-date on Windows patches is a good idea, it’s important to make sure you’re updating only after you’ve backed up your important data and files. A reliable backup means you’re probably not losing your mind when the odd buggy patch causes problems booting the system. So do yourself a favor and backup your files before installing any patches.</p>
<p>And as always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may even chime in here with some helpful tips.</p>
<p>Finally, once again there are no security updates for <strong>Adobe Flash Player</strong> this month (there is a non-security update available), but Adobe did release critical updates for Windows and macOS versions of its <strong>Acrobat</strong> and <strong>PDF Reader</strong> that fix more than 20 vulnerabilities in these products. <strong>Photoshop</strong> and <strong>ColdFusion 2018</strong> also received security updates today. Links to advisories <a href="https://blogs.adobe.com/psirt/?p=1813" target="_blank" rel="noopener">here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=49646
title: The Great $50M African IP Address Heist
uri: The-Great-50M-African-IP-Address-Heist
url: https://krebsonsecurity.com/2019/12/the-great-50m-african-ip-address-heist/
content:
<p>A top executive at the nonprofit entity responsible for doling out chunks of Internet addresses to businesses and other organizations in Africa has resigned his post following accusations that he secretly operated several companies which sold tens of millions of dollars worth of the increasingly scarce resource to online marketers. The allegations stemmed from a three-year investigation by a U.S.-based researcher whose findings shed light on a murky area of Internet governance that is all too often exploited by spammers and scammers alike.</p>
<p><img class="aligncenter wp-image-49907" src="media/866e714b.africa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/africa.png" alt="" width="594" height="328" /></p>
<p>There are fewer than four billion so-called &#8220;Internet Protocol version 4&#8221; or IPv4 addresses available for use, but the vast majority of them have already been allocated. The global dearth of available IP addresses has turned them into a commodity wherein each IP can fetch between $15-$25 on the open market. This has led to boom times for those engaged in the acquisition and sale of IP address blocks, but it has likewise emboldened those who specialize in <a href="https://krebsonsecurity.com/2019/05/a-tough-week-for-ip-address-scammers/" target="_blank" rel="noopener">absconding with</a> and <a href="https://krebsonsecurity.com/2019/09/feds-allege-adconion-employees-hijacked-ip-addresses-for-spamming/" target="_blank" rel="noopener">spamming from dormant IP address blocks</a> without permission from the rightful owners.</p>
<p>Perhaps the most dogged chronicler of this trend is California-based freelance researcher <a href="https://krebsonsecurity.com/?s=ron+guilmette" target="_blank" rel="noopener">Ron Guilmette</a>, who since 2016 has been tracking several large swaths of IP address blocks set aside for use by African entities that somehow found their way into the hands of Internet marketing firms based in other continents.</p>
<p>Over the course of his investigation, Guilmette unearthed records showing many of these IP addresses were quietly commandeered from African businesses that are no longer in existence or that were years ago acquired by other firms. Guilmette estimates the current market value of the purloined IPs he&#8217;s documented in this case exceeds USD $50 million.</p>
<p>In collaboration with journalists based in South Africa, Guilmette discovered tens of thousands of these wayward IP addresses that appear to have been sold off by a <a href="https://pastebin.com/raw/GPnMw0kR" target="_blank" rel="noopener">handful of</a> <a href="media/97d86dda.amazondigital.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/amazondigital.png" target="_blank" rel="noopener">companies</a> <a href="media/08ef0b10.amiekholdings.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/amiekholdings.png" target="_blank" rel="noopener">founded by</a> the policy coordinator for <strong>The African Network Information Centre</strong> (<a href="https://en.wikipedia.org/wiki/AFRINIC" target="_blank" rel="noopener">AFRINIC</a>), one of the world&#8217;s five regional Internet registries which handles IP address allocations for Africa and the Indian Ocean region.</p>
<p>That individual &#8212; <a href="media/ad866fb6.eb-pc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/eb-pc.png" target="_blank" rel="noopener"><strong>Ernest Byaruhanga</strong></a> &#8212; was only the second person hired at AFRINIC back in 2004. Byaruhanga did not respond to requests for comment. However, he abruptly resigned from his position in October 2019 shortly after news of the IP address scheme was <a href="https://mybroadband.co.za/news/internet/318205-the-big-south-african-ip-address-heist-how-millions-are-made-on-the-grey-market.html" target="_blank" rel="noopener">first detailed</a> by <strong>Jan Vermeulen</strong>, a reporter for the South African tech news publication <strong>Mybroadband.co.za</strong> who assisted Guilmette in his research.</p>
<p>KrebsOnSecurity sought comment from AFRINIC&#8217;s new <strong>CEO</strong> <strong>Eddy Kayihura</strong>, who said the organization was aware of the allegations and is currently conducting an investigation into the matter.</p>
<p>&#8220;Since the investigation is ongoing, you will understand that we prefer to complete it before we make a public statement,&#8221; Kayihura said. &#8220;Mr. Byauhanga&#8217;s resignation letter did not mention specific reasons, though no one would be blamed to think the two events are related.&#8221;<span id="more-49646"></span></p>
<p>Guilmette said the first clue he found suggesting someone at AFRINIC may have been involved came after he located records suggesting that official AFRINIC documents had been altered to change the ownership of IP address blocks once assigned to <strong>Infoplan</strong> (now <strong>Network and Information Technology Ltd</strong>), a South African company that was folded into the State IT Agency in 1998.</p>
<p>&#8220;This guy was shoveling IP addresses out the backdoor and selling them on the streets,&#8221; said Guilmette, who&#8217;s been posting evidence of his findings for years to public discussion lists on Internet governance. &#8220;To say that he had an evident conflict of interest would be a gross understatement.&#8221;</p>
<p>For example, documents obtained from the government of Uganda by Guilmette and others show Byaruhanga registered a private company called <strong><a href="media/2c26400e.ipv4leasing.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/ipv4leasing.png" target="_blank" rel="noopener">ipv4leasing</a> </strong>after joining AFRINIC. Historic WHOIS records from <a href="https://www.domaintools.com" target="_blank" rel="noopener">domaintools.com</a> [a former advertiser on this site] indicate Byaruhanga was the registrant of two domain names tied to this company &#8212; <strong>ipv4leasing.org and .net</strong> &#8212; back in 2013.</p>
<p>Guilmette and his journalist contacts in South Africa uncovered many instances of other companies tied to Byaruhanga and his immediate family members that appear to have been secretly selling AFRINIC IP address blocks to just about anyone willing to pay the asking price. But the activities of ipv4leasing are worth a closer look because they demonstrate how this type of shadowy commerce is critical to operations of spammers and scammers, who are constantly sullying swaths of IP addresses and seeking new ones to keep their operations afloat.</p>
<p>Historic AFRINIC record lookups show ipv4leasing.org tied to at least six sizable blocks of IP addresses that once belonged to a now defunct company from Cameroon called <strong>ITC </strong>that also did business as &#8220;<strong>Afriq*Access</strong>.&#8221;</p>
<p>In 2013, Anti-spam group <strong>Spamhaus.org</strong> began tracking floods of junk email originating from this block of IPs that once belonged to Afriq*Access. Spamhaus says it ultimately traced the domains advertised in those spam emails back to <strong>Adconion Direct</strong>, a U.S. based email marketing company that employs several executives who <a href="https://krebsonsecurity.com/2019/09/feds-allege-adconion-employees-hijacked-ip-addresses-for-spamming/" target="_blank" rel="noopener">are now facing federal criminal charges for allegedly paying others to hijack large ranges of IP addresses</a> used in wide-ranging spam campaigns.</p>
<p><img class="aligncenter wp-image-48876" src="media/8a5810a5.adconion-spam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/adconion-spam.png" alt="" width="595" height="360" /></p>
<p><a href="https://en.wikipedia.org/wiki/Bill_Woodcock" target="_blank" rel="noopener">Bill Woodcock</a> is executive director of <a href="https://www.pch.net" target="_blank" rel="noopener">Packet Clearing House</a>, a non-profit research institute dedicated to understanding and supporting Internet traffic exchange technology, policy, and economics. Woodcock said it&#8217;s not unheard of for employees at regional Internet registries (RIRs) to get caught selling off IP addresses as a side hustle, but that this case is by far the longest-running alleged scheme to date.</p>
<p>&#8220;It&#8217;s not unprecedented in the sense that there have been insider deals in the past done illicitly by employees of other RIRs,&#8221; he said. &#8220;But typically they&#8217;ve been one-off or short-lived before getting caught or fired.&#8221;</p>
<p>Anyone interested in a deeper dive on Guilmette&#8217;s years-long investigation &#8212; including the various IP address blocks in question &#8212; should check out MyBroadband&#8217;s detailed Dec. 4 story, <a href="https://mybroadband.co.za/news/internet/330379-how-internet-resources-worth-r800-million-were-stolen-and-sold-on-the-black-market.html" target="_blank" rel="noopener">How Internet Resources Worth R800 Million (USD $54M) Were Stolen and Sold on the Black Market</a>.</p>


feed_id: https://krebsonsecurity.com/?p=49835
title: Inside ‘Evil Corp,’ a $100M Cybercrime Menace
uri: Inside-Evil-Corp-a-100M-Cybercrime-Menace
url: https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/
content:
<p>The <strong>U.S. Justice Department</strong> this month offered a $5 million bounty for information leading to the arrest and conviction of a Russian man indicted for allegedly orchestrating a vast, international cybercrime network that called itself &#8220;<strong>Evil Corp</strong>&#8221; and stole roughly $100 million from businesses and consumers. As it happens, for several years KrebsOnSecurity closely monitored the day-to-day communications and activities of the accused and his accomplices. What follows is an insider&#8217;s look at the back-end operations of this gang.</p>
<div id="attachment_49935" style="width: 599px" class="wp-caption aligncenter"><img class=" wp-image-49935" src="media/0a225466.yukabets.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/yukabets.png" alt="" width="589" height="480" /><p class="wp-caption-text">Image: FBI</p></div>
<p>The $5 million reward is being offered for 32 year-old <strong>Maksim V. Yakubets</strong>, who the government says went by the nicknames &#8220;<strong>aqua</strong>,&#8221; and &#8220;<strong>aquamo</strong>,&#8221; among others. The feds allege Aqua led an elite cybercrime ring with at least 16 others who used advanced, custom-made strains of malware known as &#8220;<strong>JabberZeus</strong>&#8221; and &#8220;<strong>Bugat</strong>&#8221; (a.k.a. &#8220;<strong>Dridex</strong>&#8220;) to steal banking credentials from employees at hundreds of small- to mid-sized companies in the United States and Europe.</p>
<p>From 2009 to the present, Aqua&#8217;s primary role in the conspiracy was recruiting and managing a continuous supply of unwitting or <a href="https://krebsonsecurity.com/2011/08/experienced-money-mule-will-travel/" target="_blank" rel="noopener">complicit</a> accomplices to help Evil Corp. launder money stolen from their victims and transfer funds to members of the conspiracy based in Russia, Ukraine and other parts of Eastern Europe. These accomplices, known as &#8220;money mules,&#8221; are typically recruited via work-at-home job solicitations sent out by email and to people who have submitted their resumes to job search Web sites.</p>
<p>Money mule recruiters tend to target people looking for part-time, remote employment, and the jobs usually involve little work other than receiving and forwarding bank transfers. People who bite on these offers sometimes receive small commissions for each successful transfer, but just as often end up getting stiffed out of a promised payday, and/or receiving a visit or threatening letter from law enforcement agencies that track such crime (more on that in a moment).</p>
<h4>HITCHED TO A MULE</h4>
<p>KrebsOnSecurity first encountered Aqua&#8217;s work in 2008 as a reporter for <em>The Washington Post</em>. A source said they&#8217;d stumbled upon a way to intercept and read the daily online chats between Aqua and several other mule recruiters and malware purveyors who were stealing hundreds of thousands of dollars weekly from hacked businesses.</p>
<p>The source also discovered a pattern in the naming convention and appearance of several money mule recruitment Web sites being operated by Aqua. People who responded to recruitment messages were invited to create an account at one of these sites, enter personal and bank account data (mules were told they would be processing payments for their employer&#8217;s &#8220;programmers&#8221; based in Eastern Europe) and then log in each day to check for new messages.</p>
<p>Each mule <a href="media/bdc11733.busywork.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/busywork.png" target="_blank" rel="noopener">was given busy work or menial tasks</a> for a few days or weeks prior to being asked to handle money transfers. I believe this was an effort to weed out unreliable money mules. After all, those who showed up late for work tended to cost the crooks a lot of money, as the victim&#8217;s bank would usually try to reverse any transfers that hadn&#8217;t already been withdrawn by the mules.</p>
<div id="attachment_49940" style="width: 603px" class="wp-caption aligncenter"><a class="lightbox" href="media/08c66dc1.westernco-r.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/westernco-r.png"><img class="wp-image-49940" src="media/08c66dc1.westernco-r.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/westernco-r.png" alt="" width="593" height="376" /></a><p class="wp-caption-text">One of several sites set up by Aqua and others to recruit and manage money mules.</p></div>
<p>When it came time to transfer stolen funds, the recruiters would send a message through the mule site saying something like: &#8220;Good morning [mule name here]. Our client &#8212; XYZ Corp. &#8212; is sending you some money today. Please visit your bank now and withdraw this payment in cash, and then wire the funds in equal payments &#8212; minus your commission &#8212; to these three individuals in Eastern Europe.&#8221;</p>
<p>Only, in every case the company mentioned as the &#8220;client&#8221; was in fact a small business whose payroll accounts they&#8217;d already hacked into.</p>
<p>Here&#8217;s where it got interesting. Each of these mule recruitment sites had the same security weakness: Anyone <a href="media/7bedc754.avcompanybackoffice.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2011/08/avcompanybackoffice.png" target="_blank" rel="noopener">could register</a>, and after logging in any user could view messages sent to and from all other users simply by changing a number in the browser&#8217;s address bar. As a result, it was trivial to automate the retrieval of messages sent to every money mule registered across dozens of these fake company sites.</p>
<p>So, each day for several years my morning routine went as follows: Make a pot of coffee; shuffle over to the computer and view the messages Aqua and his co-conspirators had sent to their money mules over the previous 12-24 hours; look up the victim company names in Google; pick up the phone to warn each that they were in the process of being robbed by the Russian Cyber Mob.</p>
<p>My spiel on all of these calls was more or less the same: &#8220;You probably have no idea who I am, but here&#8217;s all my contact info and what I do. Your payroll accounts have been hacked, and you&#8217;re about to lose a great deal of money. You should contact your bank immediately and have them put a hold on any pending transfers before it&#8217;s too late. Feel free to call me back afterwards if you want more information about how I know all this, but for now please just call or visit your bank.&#8221;</p>
<div id="attachment_49939" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/59def984.amr-co.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/amr-co.png"><img class="wp-image-49939" src="media/59def984.amr-co.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/amr-co.png" alt="" width="594" height="335" /></a><p class="wp-caption-text">Messages to and from a money mule working for Aqua&#8217;s crew, circa May 2011.</p></div>
<p>In many instances, my call would come in just minutes or hours before an unauthorized payroll batch was processed by the victim company&#8217;s bank, and some of those notifications prevented what otherwise would have been enormous losses &#8212; often several times the amount of the organization&#8217;s normal weekly payroll. At some point I stopped counting how many tens of thousands of dollars those calls saved victims, but over several years it was probably in the millions.</p>
<p>Just as often, the victim company would suspect that I was somehow involved in the robbery, and soon after alerting them I would receive a call from an FBI agent or from a police officer in the victim&#8217;s hometown. Those were always interesting conversations. Needless to say, the victims that spun their wheels chasing after me usually suffered far more substantial financial losses (mainly because they delayed calling their financial institution until it was too late).</p>
<p>Collectively, these notifications to Evil Corp.&#8217;s victims led to <a href="https://krebsonsecurity.com/category/smallbizvictims/" target="_blank" rel="noopener">dozens of stories over several years</a> about small businesses battling their financial institutions to recover their losses. I don&#8217;t believe I ever wrote about a single victim that wasn&#8217;t okay with my calling attention to their plight and to the sophistication of the threat facing other companies.<span id="more-49835"></span></p>
<h4>LOW FRIENDS IN HIGH PLACES</h4>
<p>According to the U.S. Justice Department, Yakubets/Aqua served as leader of Evil Corp. and was responsible for managing and supervising the group&#8217;s cybercrime activities in deploying and using the Jabberzeus and Dridex banking malware. The DOJ notes that prior to serving in this leadership role for Evil Corp, Yakubets was also directly associated with <a href="https://krebsonsecurity.com/2015/02/fbi-3m-bounty-for-zeus-trojan-author/" target="_blank" rel="noopener">Evgeniy &#8220;Slavik&#8221; Bogachev</a>, a previously designated Russian cybercriminal responsible for the distribution of the Zeus, Jabber Zeus, and <a href="https://krebsonsecurity.com/?s=gameover+zeus&amp;x=0&amp;y=0" target="_blank" rel="noopener">GameOver Zeus malware schemes</a> who currently has a $3 million FBI bounty on his head.</p>
<div id="attachment_49974" style="width: 603px" class="wp-caption aligncenter"><img class=" wp-image-49974" src="media/fbbd8b0e.bogachev.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/bogachev.png" alt="" width="593" height="364" /><p class="wp-caption-text">Evgeniy M. Bogachev, in undated photos.</p></div>
<p>As noted <a href="https://krebsonsecurity.com/2019/11/why-were-the-russians-so-set-against-this-hacker-being-extradited/" target="_blank" rel="noopener">in previous stories here</a>, during times of conflict with Russia&#8217;s neighbors, Slavik was known to retool his crime machines to search for classified information on victim systems in regions of the world that were of strategic interest to the Russian government &#8211; particularly in Turkey and Ukraine.</p>
<p>&#8220;Cybercriminals are recruited to Russia’s national cause through a mix of coercion, payments and appeals to patriotic sentiment,” reads <a href="https://www.theregister.co.uk/2017/06/06/russia_cyber_militia_analysis/" target="_blank" rel="noopener">a 2017 story</a> from <em>The Register</em> on security firm <strong>Cybereason</strong>’s <a href="https://www.cybereason.com/blog-russia-nation-state-hacking-the-countrys-dedicated-policy-of-strategic-ambiguity/" target="_blank" rel="noopener">analysis</a> of the Russian cybercrime scene. “Russia’s use of private contractors also has other benefits in helping to decrease overall operational costs, mitigating the risk of detection and gaining technical expertise that they cannot recruit directly into the government. Combining a cyber-militia with official state-sponsored hacking teams has created the most technically advanced and bold cybercriminal community in the world.”</p>
<p>This is interesting because the <strong>U.S. Treasury Department</strong> says Yukabets as of 2017 was working for <a href="https://en.wikipedia.org/wiki/Federal_Security_Service" target="_blank" rel="noopener">the Russian FSB</a>, one of Russia’s leading intelligence organizations.</p>
<p>&#8220;As of April 2018, Yakubets was in the process of obtaining a license to work with Russian classified information from the FSB,&#8221; notes <a href="https://home.treasury.gov/news/press-releases/sm845" target="_blank" rel="noopener">a statement</a> from the Treasury.</p>
<p>The Treasury Department&#8217;s role in this action is key because it means the United States has now imposed economic sanctions on Yukabets and 16 accused associates, effectively freezing all property and interests of these persons (subject to U.S. jurisdiction) and making it a crime to transact with these individuals.</p>
<p>The Justice Department&#8217;s <a href="https://www.justice.gov/opa/press-release/file/1223591/download" target="_blank" rel="noopener">criminal complaint against Yukabets</a> (PDF) mentions several intercepted chat communications between Aqua and his alleged associates in which they puzzle over why KrebsOnSecurity seemed to know so much about their internal operations and victims. In the following chat conversations (translated from Russian), Aqua and others discuss <a href="http://voices.washingtonpost.com/securityfix/2009/07/an_odyssey_of_fraud_part_ii.html" target="_blank" rel="noopener">a story I wrote for <em>The Washington Post</em></a> in 2009 about their theft of hundreds of thousands of dollars from the payroll accounts of Bullitt County, Ky:</p>
<p>tank: [Are you] there?<br />
indep: Yeah.<br />
indep: Greetings.<br />
tank: http://voices.washingtonpost.com/securityfix/2009/07/an_odyssey_of_fraud_part_ii.html#more<br />
tank: This is still about me.<br />
tank: Originator: BULLITT COUNTY FISCAL Company: Bullitt County Fiscal Court<br />
tank: He is the account from which we cashed.<br />
tank: Today someone else send this news.<br />
tank: I&#8217;m reading and thinking: Let me take a look at history. For some reason this name is familiar.<br />
tank: I&#8217;m on line and I&#8217;ll look. Ah, here is this shit.<br />
indep: How are you?<br />
tank: Did you get my announcements?<br />
indep: Well, I congratulate [you].<br />
indep: This is just fuck when they write about you in the news.<br />
tank: Whose [What]?<br />
tank: 😀<br />
indep: Too much publicity is not needed.<br />
tank: Well, so nobody knows who they are talking about.</p>
<p>tank: Well, nevertheless, they were writing about us.<br />
aqua: So because of whom did they lock Western Union for Ukraine?<br />
aqua: Tough shit.<br />
tank: *************Originator: BULLITT COUNTY FISCAL Company: Bullitt<br />
County Fiscal Court<br />
aqua: So?<br />
aqua: This is the court system.<br />
tank: Shit.<br />
tank: Yes<br />
aqua: This is why they fucked [nailed?] several drops.<br />
tank: Yes, indeed.<br />
aqua: Well, fuck. Hackers: It&#8217;s true they stole a lot of money.</p>
<p>At roughly the same time, one of Aqua&#8217;s crew had a chat with Slavik, who used the nickname &#8220;lucky12345&#8221; at the time:</p>
<p>tank: Are you there?<br />
tank: This is what they damn wrote about me.<br />
tank: http://voices.washingtonpost.com/securityfix/2009/07/an_odyssey_of_fraud_part_ii.html#more<br />
tank: I&#8217;ll take a quick look at history<br />
tank: Originator: BULLITT COUNTY FISCAL Company: Bullitt County Fiscal Court<br />
tank: Well, you got [it] from that cash-in.<br />
lucky12345: From 200K?<br />
tank: Well, they are not the right amounts and the cash out from that account was shitty.<br />
tank: Levak was written there.<br />
tank: Because now the entire USA knows about Zeus.<br />
tank: 😀<br />
lucky12345: It&#8217;s fucked.</p>
<p>On Dec. 13, 2009, one of the Jabberzeus gang’s money mule recruiters –- a crook who used the pseudonym “Jim Rogers” &#8212; somehow learned about something I hadn’t shared beyond a few trusted friends at that point: That The Washington Post had eliminated my job in the process of merging the newspaper’s Web site (where I worked at the time) with the dead tree edition. The following is an exchange between Jim Rogers and the above-quoted “tank”:</p>
<p>jim_rogers: There is a rumor that our favorite (Brian) didn’t get his contract extension at Washington Post. We are giddily awaiting confirmation <img src="media/e68d9d70.1f642.png" data-original-source="https://s.w.org/images/core/emoji/11/72x72/1f642.png" alt="🙂" class="wp-smiley" style="height: 1em; max-height: 1em;" /> Good news expected exactly by the New Year! Besides us no one reads his column <img src="media/e68d9d70.1f642.png" data-original-source="https://s.w.org/images/core/emoji/11/72x72/1f642.png" alt="🙂" class="wp-smiley" style="height: 1em; max-height: 1em;" /></p>
<p>tank: Mr. Fucking Brian Fucking Kerbs!</p>
<p>In March 2010, Aqua would divulge in an encrypted chat that his crew was working directly with the Zeus author (Slavik/Lucky12345), but that they found him abrasive and difficult to tolerate:</p>
<p>dimka: I read about the king of seas, was it your handy work?<br />
aqua: what are you talking about? show me<br />
dimka: zeus<br />
aqua: 🙂<br />
aqua: yes, we are using it right now<br />
aqua: its developer sits with us on the system<br />
dimka: it&#8217;s a popular thing<br />
aqua: but, he, fucker, annoyed the hell out of everyone, doesn&#8217;t want to write bypass of interactives (scans) and trojan penetration 35-40%, bitch<br />
aqua: yeah, shit<br />
aqua: we need better<br />
aqua: http://voices.washingtonpost.com/securityfix read it 🙂 here you find almost everything about us 🙂<br />
dimka: I think everything will be slightly different, if you think so<br />
aqua: we, in this system, the big dog, the rest on the system are doing small crap</p>
<p>Later that month, Aqua bemoaned even more publicity about their work, pointing to <a href="https://krebsonsecurity.com/2010/03/crooks-crank-up-volume-of-e-banking-attacks/" target="_blank" rel="noopener">a KrebsOnSecurity story</a> about a sophisticated attack in which their malware not only intercepted a one-time password needed to log in to the victim&#8217;s bank account, but even modified the bank&#8217;s own Web site as displayed in the victim&#8217;s browser to point to a phony customer support number.</p>
<p>Ironically, the fake bank phone number was what tipped off the victim company employee. In this instance, the victim&#8217;s bank &#8212; Fifth Third Bank (referred to as &#8220;53&#8221; in the chat below) was able to claw back the money stolen by Aqua&#8217;s money mules, but not funds that were taken via fraudulent international wire transfers. The cybercriminals in this chat also complain they will need a newly-obfuscated version of their malware due to public exposure:</p>
<p>aqua: tomorrow, everything should work.<br />
aqua: fuck, we need to find more socks for spam.<br />
aqua: okay, so tomorrow Petro [<a href="https://krebsonsecurity.com/2015/02/fbi-3m-bounty-for-zeus-trojan-author/" target="_blank" rel="noopener">another conspirator who went by the nickname Petr0vich</a>] will give us a [new] .exe<br />
jtk: ok<br />
jim_rogers: this one doesn&#8217;t work<br />
jim_rogers: http://www.krebsonsecurity.com/2010/03/crooks-crank-up-volume-of-e-banking-attacks/<br />
jim_rogers: here it&#8217;s written about my transfer from 53. How I made a number of wires like it said there. And a woman burnt the deal because of a fake phone number.</p>
<h4>ANTI-MULE INITIATIVE</h4>
<p>In tandem with the indictments against Evil Corp, the Justice Department joined with officials from <a href="https://en.wikipedia.org/wiki/Europol" target="_blank" rel="noopener">Europol</a> to execute a law enforcement action and public awareness campaign to combat money mule activity.</p>
<p>&#8220;More than 90% of money mule transactions identified through the European Money Mule Actions are linked to cybercrime,&#8221; Europol wrote in <a href="https://www.europol.europa.eu/activities-services/public-awareness-and-prevention-guides/money-muling" target="_blank" rel="noopener">a statement</a> about the action. &#8220;The illegal money often comes from criminal activities like phishing, malware attacks, online auction fraud, e-commerce fraud, business e-mail compromise (BEC) and CEO fraud, romance scams, holiday fraud (booking fraud) and many others.&#8221;</p>
<p>The DOJ <a href="https://www.justice.gov/opa/pr/justice-department-announces-landmark-money-mule-initiative" target="_blank" rel="noopener">said</a> U.S. law enforcement disrupted mule networks that spanned from Hawaii to Florida and from Alaska to Maine. Actions were taken to halt the conduct of over 600 domestic money mules, including 30 individuals who were criminally charged for their roles in receiving victim payments and providing the fraud proceeds to accomplices.</p>
<div id="attachment_49952" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/69f28205.europol-mm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/europol-mm.png"><img class="wp-image-49952" src="media/69f28205.europol-mm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/europol-mm.png" alt="" width="594" height="500" /></a><p class="wp-caption-text">Some tips from Europol on how to spot money mule recruitment scams dressed up as legitimate job offers.</p></div>
<p>It&#8217;s good to see more public education about the damage that money mules inflict, because without them most of these criminal schemes simply fall apart. Aside from helping to launder funds from banking trojan victims, money mules often are instrumental in fleecing elderly people taken in by various online confidence scams.</p>
<p>It&#8217;s also great to see the U.S. government finally wielding its most powerful weapon against cybercriminals based in Russia and other safe havens for such activity: Economic sanctions that severely restrict cybercriminals&#8217; access to ill-gotten gains and the ability to launder the proceeds of their crimes by investing in overseas assets.</p>
<p>Further reading:</p>
<p><a href="https://www.justice.gov/opa/speech/assistant-attorney-general-brian-benczkowski-delivers-remarks-yakubets-press-conference" target="_blank" rel="noopener">DOJ press conference remarks on Yakubets</a><br />
<a href="https://www.fbi.gov/news/stories/charges-announced-in-malware-conspiracy-120519" target="_blank" rel="noopener">FBI charges announced in malware conspiracy</a><br />
<a href="https://www.justice.gov/opa/press-release/file/1223586/download" target="_blank" rel="noopener">2019 indictment of Yakubets, Turashev. et al. </a><br />
<a href="https://www.justice.gov/opa/press-release/file/1223591/download" target="_blank" rel="noopener">2010 Criminal complaint vs. Yukabets, et. al.</a><br />
<a href="https://www.fbi.gov/wanted/cyber/igor-olegovich-turashev" target="_blank" rel="noopener">FBI &#8220;wanted&#8221; alert on Igor &#8220;Enki&#8221; Turashev</a><br />
<a href="https://www.us-cert.gov/ncas/alerts/aa19-339a" target="_blank" rel="noopener">US-CERT alert on Dridex</a></p>


feed_id: https://krebsonsecurity.com/?p=49994
title: Ransomware Gangs Now Outing Victim Businesses That Don’t Pay Up
uri: Ransomware-Gangs-Now-Outing-Victim-Businesses-That-Don-t-Pay-Up
url: https://krebsonsecurity.com/2019/12/ransomware-gangs-now-outing-victim-businesses-that-dont-pay-up/
content:
<p>As if the scourge of ransomware wasn&#8217;t bad enough already: Several prominent purveyors of ransomware have signaled they plan to start publishing data stolen from victims who refuse to pay up. To make matters worse, one ransomware gang has now created a public Web site identifying recent victim companies that have chosen to rebuild their operations instead of quietly acquiescing to their tormentors.</p>
<div id="attachment_49997" style="width: 609px" class="wp-caption aligncenter"><img class="wp-image-49997" src="media/235851b4.mazemaze.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/mazemaze.png" alt="" width="599" height="62" /><p class="wp-caption-text">The message displayed at the top of the Maze Ransomware public shaming site.</p></div>
<p>Less than 48 hours ago, the cybercriminals behind the Maze Ransomware strain erected a Web site on the public Internet, and it currently lists the company names and corresponding Web sites for eight victims of their malware that have declined to pay a ransom demand.</p>
<p>&#8220;Represented here companies dont wish to cooperate with us, and trying to hide our successful attack on their resources,&#8221; the site explains in broken English. &#8220;Wait for their databases and private papers here. Follow the news!&#8221;</p>
<p>KrebsOnSecurity was able to verify that at least one of the companies listed on the site indeed recently suffered from a Maze ransomware infestation that has not yet been reported in the news media.</p>
<p>The information disclosed for each Maze victim includes the initial date of infection, several stolen Microsoft Office, text and PDF files, the total volume of files allegedly exfiltrated from victims (measured in Gigabytes), as well as the IP addresses and machine names of the servers infected by Maze.<span id="more-49994"></span></p>
<p>As shocking as this new development may be to some, it&#8217;s not like the bad guys haven&#8217;t warned us this was coming.</p>
<p>&#8220;For years, ransomware developers and affiliates have been telling victims that they must pay the ransom or stolen data would be publicly released,&#8221; said <strong>Lawrence Abrams</strong>, founder of the computer security blog and victim assistance site <a href="https://www.bleepingcomputer.com/news/security/another-ransomware-will-now-publish-victims-data-if-not-paid/" target="_blank" rel="noopener">BleepingComputer.com</a>. &#8220;While it has been a well-known secret that ransomware actors snoop through victim&#8217;s data, and in many cases steal it before the data is encrypted, they never actually carried out their threats of releasing it.&#8221;</p>
<p>Abrams said that changed at the end of last month, when the crooks behind Maze Ransomware threatened Allied Universal that if they did not pay the ransom, they would release their files. When they did not receive a payment, <a href="https://www.bleepingcomputer.com/news/security/allied-universal-breached-by-maze-ransomware-stolen-data-leaked/" target="_blank" rel="noopener">they released 700MB worth of data</a> on a hacking forum.</p>
<p><span class="pullquote pqright">&#8220;Ransomware attacks are now data breaches,&#8221; Abrams said.</span> &#8220;During ransomware attacks, some threat actors have told companies that they are familiar with internal company secrets after reading the company&#8217;s files. Even though this should be considered a data breach, many ransomware victims simply swept it under the rug in the hopes that nobody would ever find out. Now that ransomware operators are releasing victim&#8217;s data, this will need to change and companies will have to treat these attacks like data breaches.&#8221;</p>
<p>The move by Maze Ransomware comes just days after the cybercriminals responsible for managing <a href="https://krebsonsecurity.com/?s=sodinokibi&amp;x=0&amp;y=0" target="_blank" rel="noopener">the &#8220;Sodinokibi/rEvil&#8221; ransomware empire</a> posted on a popular dark Web forum that they also plan to start using stolen files and data as public leverage to get victims to pay ransoms.</p>
<div id="attachment_50000" style="width: 604px" class="wp-caption aligncenter"><img class="wp-image-50000" src="media/7cff19cf.revil-threat.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/revil-threat.png" alt="" width="594" height="324" /><p class="wp-caption-text">The leader of the Sodinokibi/rEvil ransomware gang promising to name and shame victims publicly in a recent cybercrime forum post. Image: BleepingComputer.</p></div>
<p>This is especially ghastly news for many companies that may already face steep fines and other penalties for failing to report breaches and safeguard their customers&#8217; data. For example, many companies in the healthcare sector are required to report ransomware incidents to the U.S. Department of Health and Human Services, which often documents breaches involving lost or stolen healthcare data on its own site.</p>
<p>While these victims may be able to avoid reporting ransomware incidents if they can show forensic evidence demonstrating that patient data was never taken or accessed, sites like the one that Maze Ransomware has now erected could soon dramatically complicate these incidents.</p>


feed_id: https://krebsonsecurity.com/?p=49983
title: Nuclear Bot Author Arrested in Sextortion Case
uri: Nuclear-Bot-Author-Arrested-in-Sextortion-Case
url: https://krebsonsecurity.com/2019/12/nuclear-bot-author-arrested-in-sextortion-case/
content:
<p>Last summer, <a href="https://krebsonsecurity.com/2018/07/sextortion-scam-uses-recipients-hacked-passwords/" target="_blank" rel="noopener">a wave of sextortion emails</a> began flooding inboxes around the world. The spammers behind this scheme claimed they&#8217;d hacked your computer and recorded videos of you watching porn, and promised to release the embarrassing footage to all your contacts unless a bitcoin demand was paid. Now, French authorities say they&#8217;ve charged two men they believe are responsible for masterminding this scam. One of them is a 21-year-old hacker interviewed by KrebsOnSecurity in 2017 who openly admitted to authoring a banking trojan called &#8220;<strong>Nuclear Bot</strong>.&#8221;</p>
<p><img class="aligncenter size-full wp-image-44412" src="media/4f452cd1.sextortion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/sextortion.png" alt="" width="487" height="87" /></p>
<p>On Dec. 15, the French news daily <em>Le Parisien</em> <a href="http://www.leparisien.fr/faits-divers/l-incroyable-cyber-escroquerie-au-porno-d-un-francais-de-21-ans-14-12-2019-8217375.php" target="_blank" rel="noopener">published a report</a> stating that French authorities had arrested and charged two men in the sextortion scheme. The story doesn&#8217;t name either individual, but rather refers to one of the accused only by the pseudonym &#8220;Antoine I.,&#8221; noting that his first had been changed (presumably to protect his identity because he hasn&#8217;t yet been convicted of a crime).</p>
<p>&#8220;According to sources close to the investigation, Antoine I. surrendered to the French authorities at the beginning of the month, after being hunted down all over Europe,&#8221; the story notes. &#8220;The young Frenchman, who lived between Ukraine, Poland and the Baltic countries, was indicted on 6 December for &#8216;extortion by organized gang, fraudulent access to a data processing system and money laundering.&#8217; He was placed in pre-trial detention.&#8221;</p>
<p>According to Le Parisien, Antoine I. admitted to being the inventor of the initial 2018 sextortion scam, which was subsequently <a href="https://krebsonsecurity.com/2018/08/whos-behind-the-screencam-extortion-scam/" target="_blank" rel="noopener">imitated by countless other ne&#8217;er-do-wells</a>. The story says the two men deployed malware to compromise at least 2,000 computers that were used to blast out the sextortion emails.</p>
<p>While that story is light on details about the identities of the accused, <a href="http://www.leparisien.fr/faits-divers/escroquerie-au-crypto-porno-un-pirate-doue-mais-instable-psychologiquement-14-12-2019-8217504.php" target="_blank" rel="noopener">an earlier version of it</a> published Dec. 14 includes more helpful clues. The Dec. 14 piece said Antoine I. had been interviewed by KrebsOnSecurity in April 2017, where he boasted about having created Nuclear Bot, a malware strain designed to steal banking credentials from victims.</p>
<p>My April 2017 exposé featured <a href="https://krebsonsecurity.com/2017/04/self-proclaimed-nuclear-bot-author-weighs-u-s-job-offer/" target="_blank" rel="noopener">an interview with <strong>Augustin Inzirillo</strong></a>, a young man who came across as deeply conflicted about his chosen career path. That path became traceable after he released the computer code for Nuclear Bot on GitHub. Inzirillo outed himself by defending the sophistication of his malware after it was ridiculed by both security researchers and denizens of the cybercrime underground, where copies of the code wound up for sale. From that story:</p>
<blockquote><p>“It was a big mistake, because now I know people will reuse my code to steal money from other people,” Inzirillo told KrebsOnSecurity in an online chat.</p>
<p>Inzirillo released the code on GitHub with a short note explaining his motivations, and included a contact email address at a domain (inzirillo.com) set up long ago by his father, Daniel Inzirillo.</p>
<p>KrebsOnSecurity also reached out to Daniel, and heard back from him roughly an hour before Augustin replied to requests for an interview. Inzirillo the elder said his son used the family domain name in his source code release as part of a misguided attempt to impress him.</p>
<p>“He didn’t do it for money,” said Daniel Inzirillo, whose CV shows he has built an impressive career in computer programming and working for various financial institutions. “He did it to spite all the cyber shitheads. The idea was that they wouldn’t be able to sell his software anymore because it was now free for grabs.”</p></blockquote>
<p>If Augustin Inzirillo ever did truly desire to change his ways, it wasn&#8217;t clear from his apparent actions last summer: The Le Parisien story says the sextortion scams netted the Frenchman and his co-conspirator at least a million Euros.</p>
<p>In August 2018, KrebsOnSecurity was contacted by a researcher working with French authorities on the investigation who said he suspected the young man was bragging on Twitter that he used a custom version of Nuclear Bot dubbed &#8220;TinyNuke&#8221; to steal funds from customers of French and Polish banks.</p>
<p><img class="aligncenter wp-image-49985" src="media/a612f5d1.tinygang.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/tinygang.png" alt="" width="592" height="602" /></p>
<p>The source said this individual used the now-defunct Twitter account @tiny_gang1 to taunt French authorities, while showing off a fan of 100-Euro notes allegedly gained from his illicit activities (see image above). It seemed to the source that Inzirillo wanted to get caught, because at one point @tiny_gang1 even privately shared a copy of Inzirillo&#8217;s French passport to prove his identity and accomplishments to the researcher.<span id="more-49983"></span></p>
<p>&#8220;He modified the Tinynuke&#8217;s config several times, and we saw numerous modifications in the malware code too,&#8221; the source said. &#8220;We tried to compare his samples with the leaked code available on GitHub and we noticed that the guy actually was using a more advanced version with features that don&#8217;t exist in the publicly available repositories. As an example, custom samples have video recording functionality, socks proxy and other features. So the guy clearly improved the source code and recompiled a new version for every new campaign.&#8221;</p>
<p>The source said the person behind the @tiny_gang Twitter account attacked French targets with custom versions of TinyNuke in one to three campaigns per week earlier this year, harvesting French bank accounts and laundering the stolen funds via <a href="https://krebsonsecurity.com/?s=money+mule&amp;x=0&amp;y=0" target="_blank" rel="noopener">a money mule network</a> based mostly in the United Kingdom.</p>
<p>&#8220;If the guy behind this campaign is the malware author, it could easily explain the modifications happening with the malware, and his French is pretty good,&#8221; the researcher told KrebsOnSecurity. &#8220;He&#8217;s really provocative and I think he wants to be arrested in France because it could be a good way to become famous and maybe prove that his malware works (to resell it after?).&#8221;</p>
<p>The source said the TinyNuke author threatened him with physical harm after the researcher insulted his intelligence while trying to goad him into disclosing more details about his cybercrime activities.</p>
<p>&#8220;The guy has a serious ego problem,&#8221; the researcher said. &#8220;He likes when we talk about him and he hates when we mock him. He got really angry as time went by and started personally threatening me. In the last [TinyNuke malware configuration file] targeting Poland we found a long message dedicated to me with clear physical threats.&#8221;</p>
<p>All of the above is consistent with the findings detailed in the Le Parisien report, which quoted French investigators saying Antoine I. in October 2019 used a now-deleted Twitter account to taunt the authorities into looking for him. In one such post, he included a picture of himself holding a beer, saying: &#8220;On the train to Naples. You should send me a registered letter instead of threatening guys informally.&#8221;</p>
<p>The Le Parisien story also said Antoine I. threatened a researcher working with French authorities on the investigation (the researcher is referred to pseudonymously as &#8220;Marc&#8221;).</p>
<p>&#8220;I make a lot more money than you, I am younger, more intelligent,&#8221; Antoine I. reportedly wrote in July 2018 to Marc. &#8220;If you do not stop playing with me, I will put a bullet in your head. &#8221;</p>
<p>French authorities say the defendant managed his extortion operations while traveling throughout Ukraine and other parts of Eastern Europe. But at some point he decided to return home to France, despite knowing investigators there were hunting him. According to Le Parisien, he told the French authorities he wanted to cooperate in the investigation and that he no longer wished to live like a fugitive.</p>


feed_id: https://krebsonsecurity.com/?p=50017
title: Ransomware at IT Services Provider Synoptek
uri: Ransomware-at-IT-Services-Provider-Synoptek
url: https://krebsonsecurity.com/2019/12/ransomware-at-it-services-provider-synoptek/
content:
<p><strong>Synoptek</strong>, a California business that provides cloud hosting and IT management services to more than a thousand customers nationwide, suffered a ransomware attack this week that has disrupted operations for many of its clients, according to sources. The company has reportedly paid a ransom demand in a bid to restore operations as quickly as possible.</p>
<p>Irvine, Calif.-based Synoptek is a managed service provider that maintains a variety of cloud-based services for more than 1,100 customers across <a href="https://www.featuredcustomers.com/vendor/synoptek/customers" target="_blank" rel="noopener">a broad spectrum of industries</a>, including state and local governments, financial services, healthcare, manufacturing, media, retail and software. The company has nearly a thousand employees and brought in more than $100 million in revenue in the past year, according to their Web site.</p>
<div id="attachment_50020" style="width: 501px" class="wp-caption aligncenter"><img class="size-full wp-image-50020" src="media/ef40092d.synoptek-tweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/synoptek-tweet.png" alt="" width="491" height="609" /><p class="wp-caption-text">A now-deleted Tweet from Synoptek on Dec. 20 warned against the dangers of phishing-based cyberattacks, less than three days prior to their (apparently phishing-based) Sodinokibi ransomware infestation.</p></div>
<p>News of the incident <a href="https://www.reddit.com/r/sysadmin/comments/ef2egh/synoptek_issues/" target="_blank" rel="noopener">first surfaced</a> on Reddit, which lit up on Christmas Eve with posts from people working at companies affected by the outage. The only official statement about any kind of incident came late Friday evening from the company&#8217;s <a href="https://twitter.com/Synoptek/status/1210695156669616128" target="_blank" rel="noopener">Twitter page</a>, which said that on Dec. 23 it experienced a &#8220;credential compromise which has been contained,&#8221; and that Synoptek &#8220;took immediate action and have been working diligently with customers to remediate the situation.&#8221;</p>
<p>Synoptek has not yet responded to multiple requests for comment. But two sources who work at the company have now confirmed their employer was hit by <a href="https://krebsonsecurity.com/?s=sodinokibi&amp;x=0&amp;y=0" target="_blank" rel="noopener">Sodinokibi</a>, a potent ransomware strain also known as &#8220;rEvil&#8221; that encrypts data and demands a cryptocurrency payment in return for a digital key that unlocks access to infected systems. Those sources also say the company paid their extortionists an unverified sum in exchange for decryption keys.</p>
<p>Sources also confirm that both the State of California and the U.S. Department of Homeland Security have been reaching out to state and local entities potentially affected by the attack. One Synoptek customer briefed on the attack who asked to remain anonymous said that once inside Synoptek&#8217;s systems, the intruders used a remote management tool to install the ransomware on client systems.<span id="more-50017"></span></p>
<p>Much like other ransomware gangs operating today, the crooks behind Sodiniokibi seem to focus on targeting IT providers. And it&#8217;s not hard to see why: With each passing day of an attack, customers affected by it vent their anger and frustration on social media, which places increased pressure on the provider to simply pay up.</p>
<p>A <a href="https://krebsonsecurity.com/2019/12/ransomware-at-colorado-it-provider-affects-100-dental-offices/" target="_blank" rel="noopener">Sodinokibi attack earlier this month</a> on Colorado-based IT services firm <strong>Complete Technology Solutions</strong> resulted in ransomware being installed on computers at more than 100 dentistry practices that relied on the company. In August, Wisconsin-based IT provider <a href="https://krebsonsecurity.com/2019/08/ransomware-bites-dental-data-backup-firm/" target="_blank" rel="noopener">PerCSoft was hit by Sodinokibi</a>, causing outages for more than 400 clients.</p>
<p>To put added pressure on victims to negotiate payment, the purveyors of Sodinokibi recently stated that they plan to publish data stolen from companies infected with their malware who elect to rebuild their operations instead of paying the ransom.</p>
<p>In addition, the group behind the <strong>Maze Ransomware</strong> malware strain recently began following through on a similar threat, <a href="https://krebsonsecurity.com/2019/12/ransomware-gangs-now-outing-victim-businesses-that-dont-pay-up/" target="_blank" rel="noopener">erecting a site on the public Internet that lists victims by name</a> and includes samples of sensitive documents stolen from victims who have opted not to pay. When the site was first set up on Dec. 14, it listed just eight victims; as of today, there are more than two dozen companies named.</p>


feed_id: https://krebsonsecurity.com/?p=50032
title: Happy 10th Birthday, KrebsOnSecurity.com
uri: Happy-10th-Birthday-KrebsOnSecurity-com
url: https://krebsonsecurity.com/2019/12/happy-10th-birthday-krebsonsecurity-com/
content:
<p>Today marks the 10th anniversary of KrebsOnSecurity.com! Over the past decade, the site has featured more than 1,800 stories focusing mainly on cybercrime, computer security and user privacy concerns. And what a decade it has been.</p>
<p><img class="alignright  wp-image-50039" src="media/e600af4e.10.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/10.png" alt="" width="250" height="185" />Stories here have exposed countless scams, data breaches, cybercrooks and corporate stumbles. In the ten years since its inception, the site has attracted more than 37,000 newsletter subscribers, and nearly 100 million pageviews generated by roughly 40 million unique visitors.</p>
<p>Some of those 40 million visitors left more than 100,000 comments. The community that has sprung up around KrebsOnSecurity has been truly humbling and a joy to watch, and I&#8217;m eternally grateful for all your contributions.</p>
<p>One housekeeping note: A good chunk of the loyal readers here are understandably security- and privacy-conscious, and many block advertisements by default &#8212; including the ads displayed here.</p>
<p>Just a reminder that KrebsOnSecurity does not run third-party ads and has no plans to change that; all of the creatives you see on this site are hosted in-house, are purely image-based, and are vetted first by Yours Truly. Love them or hate &#8217;em, these ads help keep the content at KrebsOnSecurity free to any and all readers. If you&#8217;re currently blocking ads here, please consider making an exception for this site.</p>
<p>Last but certainly not least, thank you for your readership. I couldn&#8217;t have done this without your encouragement, wisdom, tips and support. Here&#8217;s wishing you all a happy, healthy and wealthy 2020, and for another decade of stories to come.</p>


feed_id: https://krebsonsecurity.com/?p=50062
title: The Hidden Cost of Ransomware: Wholesale Password Theft
uri: The-Hidden-Cost-of-Ransomware-Wholesale-Password-Theft
url: https://krebsonsecurity.com/2020/01/the-hidden-cost-of-ransomware-wholesale-password-theft/
content:
<p>Organizations in the throes of cleaning up after a ransomware outbreak typically will change passwords for all user accounts that have access to any email systems, servers and desktop workstations within their network. But all too often, ransomware victims fail to grasp that the crooks behind these attacks can and frequently do siphon every single password stored on each infected endpoint. The result of this oversight may offer attackers a way back into the affected organization, access to financial and healthcare accounts, or &#8212; worse yet &#8212; key tools for attacking the victim&#8217;s various business partners and clients.</p>
<p>In mid-November 2019, Wisconsin-based <strong>Virtual Care Provider Inc.</strong> (VCPI) was <a href="https://krebsonsecurity.com/2019/11/110-nursing-homes-cut-off-from-health-records-in-ransomware-attack/" target="_blank" rel="noopener">hit by the Ryuk ransomware strain</a>. VCPI manages the IT systems for some 110 clients that serve approximately 2,400 nursing homes in 45 U.S. states. VCPI declined to pay the multi-million dollar ransom demanded by their extortionists, and the attack cut off many of those elder care facilities from their patient records, email and telephone service for days or weeks while VCPI rebuilt its network.</p>
<p><img class="aligncenter  wp-image-49623" src="media/08717eec.vcpi.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/vcpi.png" alt="" width="594" height="296" /></p>
<p>Just hours after that story was published, VCPI chief executive and owner <strong>Karen Christianson</strong> reached out to say she hoped I would write a follow-up piece about how they recovered from the incident. My reply was that I&#8217;d consider doing so if there was something in their experience that I thought others could learn from their handling of the incident.</p>
<p>I had no inkling at the time of how much I would learn in the days ahead.</p>
<h4>EERIE EMAILS</h4>
<p>On December 3, I contacted Christianson to schedule a follow-up interview for the next day. On the morning of Dec. 4 (less than two hours before my scheduled call with VCPI and more than two weeks after the start of their ransomware attack) I heard via email from someone claiming to be part of the criminal group that launched the Ryuk ransomware inside VCPI.</p>
<p>That email was unsettling because its timing suggested that whoever sent it somehow knew I was going to speak with VCPI later that day. This person said they wanted me to reiterate a message they&#8217;d just sent to the owner of VCPI stating that their offer of a greatly reduced price for a digital key needed to unlock servers and workstations seized by the malware would expire soon if the company continued to ignore them.</p>
<p>&#8220;Maybe you chat to them lets see if that works,&#8221; the email suggested.</p>
<p>The anonymous individual behind that communication declined to provide proof that they were part of the group that held VPCI&#8217;s network for ransom, and after an increasingly combative and personally threatening exchange of messages soon stopped responding to requests for more information.</p>
<p>&#8220;We were bitten with releasing evidence before hence we have stopped this even in our ransoms,&#8221; the anonymous person wrote. &#8220;If you want proof we have hacked T-Systems as well. You may confirm this with them. We havent [sic] seen any Media articles on this and as such you should be the first to report it, we are sure they are just keeping it under wraps.&#8221; Security news site <a href="https://www.bleepingcomputer.com/news/security/ryuk-ransomware-is-making-victims-left-and-right/" target="_blank" rel="noopener">Bleeping Computer reported on the T-Systems Ryuk ransomware attack</a> on Dec. 3.</p>
<p>In our Dec. 4 interview, VCPI&#8217;s acting chief information security officer &#8212; <strong>Mark Schafer</strong>, CISO at Wisconsin-based <strong>SVA Consulting</strong> &#8212; confirmed that the company received a nearly identical message that same morning, and that the wording seemed &#8220;very similar&#8221; to the original extortion demand the company received.</p>
<p>However, Schafer assured me that VCPI had indeed rebuilt its email network following the intrusion and strictly used a third-party service to discuss remediation efforts and other sensitive topics.<span id="more-50062"></span></p>
<h4>&#8216;LIKE A COMPANY BATTLING A COUNTRY&#8217;</h4>
<p>Christianson said several factors stopped the painful Ryuk ransomware attack from morphing into a company-ending event. For starters, she said, an employee spotted suspicious activity on their network in the early morning hours of Saturday, Nov. 16. She said that employee then immediately alerted higher-ups within VCPI, who ordered a complete and immediate shutdown of the entire network.</p>
<p>&#8220;The bottom line is at 2 a.m. on a Saturday, it was still a human being who saw a bunch of lights and had enough presence of mind to say someone else might want to take a look at this,&#8221; she said. &#8220;The other guy he called said he didn&#8217;t like it either and called the [chief information officer] at 2:30 a.m., who picked up his cell phone and said shut it off from the Internet.&#8221;</p>
<p>Schafer said another mitigating factor was that VCPI had contracted with a third-party roughly six months prior to the attack to establish off-site data backups that were not directly connected to the company&#8217;s infrastructure.</p>
<p>&#8220;The authentication for that was entirely separate, so the lateral movement [of the intruders] didn&#8217;t allow them to touch that,&#8221; Schafer said.</p>
<p>Schafer said the move to third-party data backups coincided with a comprehensive internal review that identified multiple areas where VCPI could harden its security, but that the attack hit before the company could complete work on some of those action items.</p>
<p>&#8220;We did a risk assessment which was pretty much spot-on, we just needed more time to work on it before we got hit,&#8221; he said. &#8220;We were doing the right things, just not fast enough. If we&#8217;d had more time to prepare, it would have gone better. I feel like we were a company battling a country. It&#8217;s not a fair fight, and once you&#8217;re targeted it&#8217;s pretty tough to defend.&#8221;</p>
<h4>WHOLESALE PASSWORD THEFT</h4>
<p>Just after receiving a tip from a reader about the ongoing Ryuk infestation at VCPI, KrebsOnSecurity contacted Milwaukee-based <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a> to see if its owner <strong>Alex Holden</strong> had any more information about the attack. Holden and his team had previously intercepted online communications between and among multiple ransomware gangs and their victims, and I was curious to know if that held true in the VCPI attack as well.</p>
<p>Sure enough, Holden quickly sent over several logs of data suggesting the attackers had breached VCPI&#8217;s network on multiple occasions over the previous 14 months.</p>
<p>“While it is clear that the initial breach occurred 14 months ago, the escalation of the compromise didn’t start until around November 15th of this year,” Holden said at the time. “When we looked at this in retrospect, during these three days the cybercriminals slowly compromised the entire network, disabling antivirus, running customized scripts, and deploying ransomware. They didn’t even succeed at first, but they kept trying.”</p>
<p>Holden said it appears the intruders laid the groundwork for the VPCI using <a href="https://www.us-cert.gov/ncas/alerts/TA18-201A" target="_blank" rel="noopener"><strong>Emotet</strong></a>, a powerful malware tool typically disseminated via spam.</p>
<p>&#8220;Emotet continues to be among the most costly and destructive malware,&#8221; reads a July 2018 alert on the malware from the <strong>U.S. Department of Homeland Security</strong>. &#8220;Its worm-like features result in rapidly spreading network-wide infection, which are difficult to combat.&#8221;</p>
<p>According to Holden, after using Emotet to prime VCPI&#8217;s servers and endpoints for the ransomware attack, the intruders deployed a module of Emotet called <a href="https://www.cisecurity.org/white-papers/security-primer-trickbot/" target="_blank" rel="noopener"><strong>Trickbot</strong></a>, which is a banking trojan often used to download other malware and harvest passwords from infected systems.</p>
<p>Indeed, Holden shared records of communications from VCPI&#8217;s tormentors suggesting they&#8217;d unleashed Trickbot to steal passwords from infected VCPI endpoints that the company used to log in at <em>more than 300 Web sites and services</em>, including:</p>
<p>-Identity and password management platforms Auth0 and LastPass<br />
-Multiple personal and business banking portals;<br />
-Microsoft Office365 accounts<br />
-Direct deposit and Medicaid billing portals<br />
-Cloud-based health insurance management portals<br />
-Numerous online payment processing services<br />
-Cloud-based payroll management services<br />
-Prescription management services<br />
-Commercial phone, Internet and power services<br />
-Medical supply services<br />
-State and local government competitive bidding portals<br />
-Online content distribution networks<br />
-Shipping and postage accounts<br />
-Amazon, Facebook, LinkedIn, Microsoft, Twitter accounts</p>
<p>Toward the end of my follow-up interview with Schafer and VCPI&#8217;s Christianson, I shared Holden&#8217;s list of sites for which the attackers had apparently stolen internal company credentials. At that point, Christianson abruptly ended the interview and got off the line, saying she had personal matters to attend to. Schafer thanked me for sharing the list, noting that it looked like VCPI probably now had a &#8220;few more notifications to do.&#8221;</p>
<p>Moral of the story: Companies that experience a ransomware attack &#8212; or for that matter any type of equally invasive malware infestation &#8212; <em>should assume that all credentials stored anywhere on the local network (including those saved inside Web browsers and password managers) are compromised and need to be changed</em>.</p>
<p>Out of an abundance of caution, this process should be done from a pristine (preferably non-Windows-based) system that does not reside within the network compromised by the attackers. In addition, full use should be made of <a href="https://www.twofactorauth.org" target="_blank" rel="noopener">the strongest method available for securing these passwords with multi-factor authentication</a>.</p>


feed_id: https://krebsonsecurity.com/?p=50056
title: Tricky Phish Angles for Persistence, Not Passwords
uri: Tricky-Phish-Angles-for-Persistence-Not-Passwords
url: https://krebsonsecurity.com/2020/01/tricky-phish-angles-for-persistence-not-passwords/
content:
<p>Late last year saw the re-emergence of a nasty phishing tactic that allows the attacker to gain full access to a user&#8217;s data stored in the cloud without actually stealing the account password. The phishing lure starts with a link that leads to the real login page for a cloud email and/or file storage service. Anyone who takes the bait will inadvertently forward a digital token to the attackers that gives them indefinite access to the victim&#8217;s email, files and contacts &#8212; even after the victim has changed their password.</p>
<p>Before delving into the details, it&#8217;s important to note two things. First, while the most recent versions of this stealthy phish targeted corporate users of <strong>Microsoft&#8217;s Office 365</strong> service, the same approach could be leveraged to ensnare users of many other cloud providers. Second, this attack is not exactly new: In 2017, for instance, phishers used a similar technique <a href="https://duo.com/blog/gmail-oauth-phishing-goes-viral" target="_blank" rel="noopener">to plunder accounts at Google&#8217;s Gmail service</a>.</p>
<p>Still, this phishing tactic is worth highlighting because recent examples of it received relatively little press coverage. Also, the resulting compromise is quite persistent and sidesteps two-factor authentication, and thus it seems likely we will see this approach exploited more frequently in the future.</p>
<p>In early December, security experts at <strong>Phishlabs</strong> detailed <a href="https://info.phishlabs.com/blog/office-365-phishing-uses-malicious-app-persist-password-reset" target="_blank" rel="noopener">a sophisticated phishing scheme</a> targeting Office 365 users that used a malicious link which took people who clicked to an official Office 365 login page &#8212; <strong>login.microsoftonline.com</strong>. Anyone suspicious about the link would have seen nothing immediately amiss in their browser&#8217;s address bar, and could quite easily verify that the link indeed took them to Microsoft&#8217;s real login page:</p>
<div id="attachment_50080" style="width: 602px" class="wp-caption aligncenter"><a class="lightbox" href="media/9df757c5.0365phish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/01/0365phish.png"><img class="wp-image-50080" src="media/9df757c5.0365phish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/01/0365phish.png" alt="" width="592" height="330" /></a><p class="wp-caption-text">This phishing link asks users to log in at Microsoft&#8217;s real Office 365 portal (login.microsoftonline.com).</p></div>
<p>Only by copying and pasting the link or by scrolling far to the right in the URL bar can we detect that something isn&#8217;t quite right:</p>
<div id="attachment_50081" style="width: 600px" class="wp-caption aligncenter"><a class="lightbox" href="media/0e03a531.redir.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/01/redir.png"><img class="wp-image-50081" src="media/0e03a531.redir.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/01/redir.png" alt="" width="590" height="177" /></a><p class="wp-caption-text">Notice this section of the URL (obscured off-page and visible only by scrolling to the right quite a bit) attempts to grant a malicious app hosted at officesuited.com full access to read the victim&#8217;s email and files stored at Microsoft&#8217;s Office 365 service.</p></div>
<p>As we can see from the URL in the image directly above, the link tells Microsoft to forward the authorization token produced by a successful login to the domain <strong>officesuited[.]com</strong>. From there, the user will be presented with a prompt that says an app is requesting permissions to read your email, contacts, OneNote notebooks, access your files, read/write to your mailbox settings, sign you in, read your profile, and maintain access to that data.</p>
<div id="attachment_50086" style="width: 497px" class="wp-caption aligncenter"><img class="size-full wp-image-50086" src="media/fef4d616.0365appprompt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/01/0365appprompt.png" alt="" width="487" height="631" /><p class="wp-caption-text">Image: Phishlabs</p></div>
<p>According to Phishlabs, the app that generates this request was created using information apparently stolen from a legitimate organization. The domain hosting the malicious app pictured above &#8212; <strong>officemtr[.]com</strong> &#8212; is different from the one I saw in late December, but it was hosted at the same Internet address as officesuited[.]com and likely signed using the same legitimate company&#8217;s credentials.</p>
<p>Phishlabs says the attackers are exploiting a feature of Outlook known as &#8220;add-ins,&#8221; which are applications built by third-party developers that can be installed either from a file or URL from the Office store.</p>
<p>&#8220;By default, any user can apply add-ins to their outlook application,&#8221; wrote Phishlabs&#8217; <strong>Michael Tyler</strong>. &#8220;Additionally, Microsoft allows Office 365 add-ins and apps to be installed via side loading without going through the Office Store, and thereby avoiding any review process.&#8221;</p>
<p>In an interview with KrebsOnSecurity, Tyler said he views this attack method more like malware than traditional phishing, which tries to trick someone into giving their password to the scammers.</p>
<p>&#8220;The difference here is instead of handing off credentials to someone, they are allowing an outside application to start interacting with their Office 365 environment directly,&#8221; he said.</p>
<p>Many readers at this point may be thinking that they would hesitate before approving such powerful permissions as those requested by this malicious application. But Tyler said this assumes the user somehow understands that there is a malicious third-party involved in the transaction.</p>
<p>&#8220;We can look at the reason phishing is still around, and it&#8217;s because people are making decisions they shouldn&#8217;t be making or shouldn&#8217;t be able to make,&#8221; he said. &#8220;Even employees who are trained on security are trained to make sure it&#8217;s a legitimate site before entering their credentials. Well, in this attack the site <em>is</em> legitimate, and at that point their guard is down. I look at this and think, would I be more likely to type my password into a box or more likely to click a button that says &#8216;okay&#8217;?&#8221;<span id="more-50056"></span></p>
<p>The scary part about this attack is that once a user grants the malicious app permissions to read their files and emails, the attackers can maintain access to the account even after the user changes his password. What&#8217;s more, Tyler said the malicious app they tested was not visible as an add-in at the individual user level; only system administrators responsible for managing user accounts could see that the app had been approved.</p>
<p>Furthermore, even if an organization requires multi-factor authentication at sign-in, recall that this phish&#8217;s login process takes place on Microsoft&#8217;s own Web site. That means having two-factor enabled for an account would do nothing to prevent a malicious app that has already been approved by the user from accessing their emails or files.</p>
<p>Once given permission to access the user&#8217;s email and files, the app will retain that access until one of two things happen: Microsoft discovers and disables the malicious app, or an administrator on the victim user&#8217;s domain removes the program from the user&#8217;s account.</p>
<p>Expecting swift action from Microsoft might not be ideal: From my testing, Microsoft appears to have disabled the malicious app being served from officesuited[.]com sometime around Dec. 19 &#8212; roughly one week after it went live.</p>
<p>In a statement provided to KrebsOnSecurity, Microsoft Senior Director <strong>Jeff Jones</strong> said the company continues to monitor for potential new variations of this malicious activity and will take action to disable applications as they are identified.</p>
<p>&#8220;The technique described relies on a sophisticated phishing campaign that invites users to permit a malicious Azure Active Directory Application,&#8221; Jones said. &#8220;We&#8217;ve notified impacted customers and worked with them to help remediate their environments.&#8221;</p>
<p>Microsoft&#8217;s instructions for detecting and removing illicit consent grants in Office 365 are <a href="https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants" target="_blank" rel="noopener">here</a>. Microsoft says administrators <a href="https://docs.microsoft.com/office365/admin/misc/integrated-apps" target="_blank" rel="noopener">can enable a setting</a> that blocks users from installing third-party apps into Office 365, but it calls this a &#8220;drastic step&#8221; that &#8220;isn&#8217;t strongly recommended as it severely impairs your users&#8217; ability to be productive with third-party applications.&#8221;</p>
<p>Phishlabs&#8217; Tyler said he disagrees with Microsoft here, and encourages Office 365 administrators to block users from installing apps altogether &#8212; or at the very least restrict them to apps from the official Microsoft store.</p>
<p>Apart from that, he said, it&#8217;s important for Office 365 administrators to periodically look for suspicious apps installed on their Office 365 environment.</p>
<p>&#8220;If an organization were to fall prey to this, your traditional methods of eradicating things involve activating two-factor authentication, clearing the user&#8217;s sessions, and so on, but that won&#8217;t do anything here,&#8221; he said. &#8220;It&#8217;s important that response teams know about this tactic so they can look for problems. If you can&#8217;t or don&#8217;t want to do that, at least make sure you <a href="https://docs.microsoft.com/en-us/cloud-app-security/app-permission-policy" target="_blank" rel="noopener">have security logging turned on</a> so it&#8217;s generating an alert when people are introducing new software into your infrastructure.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=50106
title: Lawmakers Prod FCC to Act on SIM Swapping
uri: Lawmakers-Prod-FCC-to-Act-on-SIM-Swapping
url: https://krebsonsecurity.com/2020/01/senators-prod-fcc-to-act-on-sim-swapping/
content:
<p>Crooks have stolen tens of millions of dollars and other valuable commodities from thousands of consumers via &#8220;SIM swapping,&#8221; a particularly invasive form of fraud that involves tricking a target&#8217;s mobile carrier into transferring someone&#8217;s wireless service to a device they control. But the <strong>U.S. Federal Communications Commission</strong> (FCC), the entity responsible for overseeing wireless industry practices, has so far remained largely silent on the matter. Now, a cadre of lawmakers is demanding to know what, if anything, the agency might be doing to track and combat SIM swapping.</p>
<p><img class="aligncenter size-full wp-image-50124" src="media/934d3f06.fccltr.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/01/fccltr.png" alt="" width="626" height="327" /></p>
<p>On Thursday, a half-dozen Democrats in the House and Senate sent a letter to <strong>FCC Chairman Ajit Pai</strong>, asking the agency to require the carriers to offer more protections for consumers against unauthorized SIM swaps.</p>
<p>&#8220;Consumers have no choice but to rely on phone companies to protect them against SIM swaps &#8212; and they need to be able to count on the FCC to hold mobile carriers accountable when they fail to sure their systems and thus harm consumers,&#8221; reads <a href="https://www.wyden.senate.gov/download/010920-sim-swap-scam-letter-to-ftc" target="_blank" rel="noopener">the letter</a>, signed by <strong>Sens. Ron Wyden</strong> (OR), <strong>Sherrod Brown</strong> (OH) and <strong>Edward Markey</strong> (MA), and <strong>Reps. Ted Lieu</strong> (CA), <strong>Anna Eshoo </strong>(CA) and <strong>Yvette Clarke</strong> (NY).</p>
<p>SIM swapping is an insidious form of mobile phone fraud that is often used to steal large amounts of cryptocurrencies and other items of value from victims. All too frequently, the scam involves bribing or tricking employees at mobile phone stores into seizing control of the target’s phone number and diverting all texts and phone calls to the attacker’s mobile device.</p>
<p>Once in control of the stolen phone number, the attacker can then reset the password for any online account that allows password resets and/or two-factor verification requests via text messages or automated phone calls (i.e. most online services, including many of the mobile carrier Web sites).</p>
<p>From there, the scammers can pivot in a variety of directions, including: Plundering the victim&#8217;s financial accounts; hacking their identities on social media platforms;  viewing the victim&#8217;s email and call history; and abusing that access to harass and scam their friends and family.</p>
<p>The lawmakers asked the FCC to divulge whether it tracks consumer complaints about fraudulent SIM swapping and number &#8220;port-outs,&#8221; which involve moving the victim&#8217;s phone number to another carrier. The legislators demanded to know whether the commission offers <em>any</em> guidance for consumers or carriers on this important issue, and if the FCC has initiated any investigations or taken enforcement actions against carriers that failed to secure customer accounts.</p>
<p>The letter also requires the FCC to respond as to whether there is anything in federal regulations that prevents mobile carriers from sharing with banks information about the most recent SIM swap date of a customer as a way to flag potentially suspicious login attempts &#8212; a method already used by financial institutions in other countries, including Australia, the United Kingdom and several nations in Africa.</p>
<p>&#8220;Some carriers, both in the U.S. and abroad, have adopted policies that better protect consumers from SIM swaps, such as allowing customers to add optional security protections to their account that prevent SIM swaps unless the customer visits a store and shows ID,&#8221; the letter continues. &#8220;Unfortunately, implementation of these additional security measures by wireless carriers in the U.S. is still spotty and consumers are not likely to find out about the availability of these obscure, optional security features until it is too late.&#8221;</p>
<p>The FCC did not immediately respond to requests for comment.<span id="more-50106"></span></p>
<h4>SIM SWAP (CRIM)INNOVATIONS</h4>
<p>Legitimate SIM swaps are a common request for all carriers, and they usually happen when a customer has lost their mobile phone or when they need to upgrade to a newer model that requires a different-sized SIM card (the small, removable smart chip that ties the customer&#8217;s device to their phone number).</p>
<p>But unauthorized SIM swaps enable even low-skilled thieves to quickly turn a victim&#8217;s life upside down and wrest control over a great deal of their online identities and finances. What&#8217;s more, the security options available to wireless customers concerned about SIM swapping &#8212; such as personal identification number (PIN) codes &#8212; are largely ineffective against crooked or clueless mobile phone store employees.</p>
<p>A successful SIM swap may allow tormentors to access a victim&#8217;s email inbox even after the target has changed his or her password. For example, some email services allow customers to reset their passwords just by providing a piece of information that would likely only be known to the legitimate account holder, such as the month and year the account was created, or the name of a custom folder or label in the account previously created by the user.</p>
<p>One technique used by SIM swappers to regain access to hacked inboxes is to jot down this information once a SIM swap affords them the ability to reset the account&#8217;s password. Alternatively, SIM swappers have been known to create their own folders or labels in the hacked account to facilitate backdoor access later on.</p>
<p>A number of young men have recently been criminally charged with using SIM swapping to steal accounts and cryptocurrencies like Bitcoin from victims. This week, a court in New York unsealed <a href="media/c58a1e7b.121919-USA-v-TRUGLIA.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/01/121919-USA-v-TRUGLIA.pdf" target="_blank" rel="noopener">a grand jury indictment</a> against 22-year-old alleged serial SIM swapper <strong>Nicholas Truglia</strong>, who stands accused of using the technique <a href="https://krebsonsecurity.com/2019/01/stole-24-million-but-still-cant-keep-a-friend/" target="_blank" rel="noopener">to siphon $24 million worth of cryptocurrencies from blockchain investor <strong>Michael Terpin</strong></a>.</p>
<p>But experts say the few arrests that have been made in conjunction with SIM swapping attacks have pushed many involved in this crime to enlist help from co-conspirators who are minors and thus largely outside the reach of federal prosecutors.</p>
<p>For his part, Terpin <a href="https://www.coindesk.com/michael-terpin-urges-fcc-to-curb-crypto-fraud-that-cost-him-24-million" target="_blank" rel="noopener">sent an open letter to FCC commissioners in October 2019</a>, urging them to mandate that wireless carriers provide a way for customers to truly lock down their accounts against SIM swapping, even if that means requiring an in-person visit to a store or conversation with the carrier&#8217;s fraud department.</p>
<p>In an interview with KrebsOnSecurity, Terpin said the FCC has so far abdicated its responsibility over the carriers on this matter.</p>
<p>&#8220;It took them a long time to get around to taking robocalls seriously, but those scams rarely cost people millions of dollars,&#8221; Terpin said. &#8220;Imagine going into a bank and you don&#8217;t remember your PIN and the teller says, &#8216;Oh, that&#8217;s okay I can look it up for you.&#8217; The fact that a $9-an-hour mobile store employee can see your high security password or PIN is shocking.&#8221;</p>
<p>&#8220;The carriers should also have to inform every single current and future customer that there is this high security option available,&#8221; Terpin continued. &#8220;That would stop a lot of this fraud and would take away the ability of these ne&#8217;er-do-well 19-year-old store employees who get bribed into helping out with the scam.&#8221;</p>
<p>Want to read more about SIM swapping? Check out <a href="https://krebsonsecurity.com/2018/11/busting-sim-swappers-and-sim-swap-myths/" target="_blank" rel="noopener">Busting SIM Swappers and SIM Swap Myths</a>, or view <a href="https://krebsonsecurity.com/category/sim-swapping/" target="_blank" rel="noopener">the entire catalog of stories on the topic here</a>.</p>


