# articles

feed_id: http://krebsonsecurity.com/?p=28774
title: Spam Nation Book Tour Highlights
uri: Spam-Nation-Book-Tour-Highlights
url: http://krebsonsecurity.com/2014/11/spam-nation-book-tour-highlights/
content:
<p>Greetings from sunny Austin, Texas, where I&#8217;m getting ready to wrap up a week-long book tour that began in New York City, then blazed through Chicago, San Francisco, and Seattle. I&#8217;ve been trying to tweet links to various media interviews about<strong> <em>Spam Nation</em></strong> over the past week, but wanted to offer a more comprehensive account and to share some highlights of the tour.</p>
<p>For three days starting last Sunday, I was in New York City &#8212; doing a series of back-to-back television and radio interviews. Prior to leaving for New York, I taped television interviews with <strong>Jeffrey Brown</strong> at the <strong>PBS NewsHour</strong>; the <a title="http://www.pbs.org/newshour/bb/spam-nation-your-outdated-internet-browser-is-a-gateway-for-cyber-attacks/" href="http://www.pbs.org/newshour/bb/spam-nation-your-outdated-internet-browser-is-a-gateway-for-cyber-attacks/" target="_blank">first segment</a> delves into some of the points touched on in the book, and the <a title="http://www.pbs.org/newshour/rundown/think-can-go-grid-harder-realize/" href="http://www.pbs.org/newshour/rundown/think-can-go-grid-harder-realize/" target="_blank">second piece</a> is titled &#8220;Why it&#8217;s harder than you think to go &#8216;off the grid&#8217;.&#8221;</p>
<p><a href="media/7f95c563.cbs-tm.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/cbs-tm.png"><img class="aligncenter size-large wp-image-28776" src="media/cf341f4e.cbs-tm-600x306.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/cbs-tm-600x306.png" alt="cbs-tm" width="600" height="306" /></a></p>
<p>On Monday, I was fortunate to once again be a guest on <strong>Terri Gross</strong>&#8216;s show <strong>Fresh Air</strong>, which you can hear at <a title="http://www.npr.org/blogs/alltechconsidered/2014/11/18/364730954/how-a-feud-between-two-russian-companies-fueled-a-spam-nation" href="http://www.npr.org/blogs/alltechconsidered/2014/11/18/364730954/how-a-feud-between-two-russian-companies-fueled-a-spam-nation" target="_blank">this link</a>. Tuesday morning began with a five-minute appearance on <strong>CBS This Morning</strong>, which included a sit-down with <strong>Charlie Rose</strong>, <strong>Gayle King</strong> and <strong>Norah O&#8217;Donnell</strong>. Later in the day, I was interviewed by the <a title="http://www.marketplace.org/shows/marketplace-tech/marketplace-tech-wednesday-november-19-2014" href="http://www.marketplace.org/shows/marketplace-tech/marketplace-tech-wednesday-november-19-2014" target="_blank">MarketPlace Tech Report</a>, <strong>MSNBC&#8217;s </strong><a title="http://www.msnbc.com/the-cycle/watch/use-these-tools-to-stop-cyber-criminals-360420931970" href="http://www.msnbc.com/the-cycle/watch/use-these-tools-to-stop-cyber-criminals-360420931970" target="_blank">The Cycle</a>, as well as the <strong>Tavis Smiley</strong> show. Wednesday was a mercifully light day, with just two interviews: <strong>KGO-AM</strong> and the <strong>Jim Bohannon Radio Show</strong>.<span id="more-28774"></span></p>
<p>Thursday&#8217;s round of media appearances began at around sunrise in the single-digit temperature Chicago suburbs. My driver from the hotel to all of these events took me aback at first. <strong>Roxanna</strong> was a petite blonde from Romania who could have just as easily been a supermodel. I thought for a moment someone was playing a practical joke when I first heard her &#8220;Gud mornink Meester Krebs&#8221; in a Eastern European accent upon stepping into <a title="http://krebsonsecurity.com/wp-content/uploads/2014/11/rox.jpg" href="media/2649cdf3.rox.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/rox.jpg" target="_blank">her Town Car</a>, but Roxanna was a knowledgeable driver who got us everywhere on time and didn&#8217;t take any crap from anyone on the road.</p>
<p><a href="media/718d0be1.wcl-ji.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/wcl-ji.png"><img class="alignright  wp-image-28785" src="media/5436602a.wcl-ji-285x362.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/wcl-ji-285x362.png" alt="wcl-ji" width="219" height="278" /></a> The first of those interviews was a television segment for <a title="http://wgntv.com/2014/11/20/how-to-protect-yourself-against-spam-emails/" href="http://wgntv.com/2014/11/20/how-to-protect-yourself-against-spam-emails/" target="_blank">WGN News</a> and a taped interview with <strong>TouchVision</strong>, followed by my first interview <a title="http://windycitylive.com/episodes/Brian-Krebs--cybersecurity-expert/9544217" href="http://windycitylive.com/episodes/Brian-Krebs--cybersecurity-expert/9544217" target="_blank">in front of a studio audience at Windy City Live</a>.  The guest who went on right before me was none other than the motivational speaker/life coach <a title="http://en.wikipedia.org/wiki/Tony_Robbins" href="http://en.wikipedia.org/wiki/Tony_Robbins" target="_blank">Tony Robbins</a>, who is a tough act to follow and was also on the show to promote his new book. At six feet seven inches, Robbins is a larger-than-life guy whose mere presence almost took up half the green room. Anyway Mr. Robbins had quite the security detail, so I took <a title="http://krebsonsecurity.com/wp-content/uploads/2014/11/stealthie.png" href="media/8404de96.stealthie.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/stealthie.png" target="_blank">this stealthie</a> of Tony as he was confined to the makeup chair prior to his appearance.</p>
<p>On Thursday afternoon, after an <a title="http://krebsonsecurity.com/wp-content/uploads/2014/11/cheeburger.jpg" href="media/2a5fbc5f.cheeburger.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/cheeburger.jpg" target="_blank">obligatory lunch</a> at the infamous Billy Goat burger joint (the inspiration for the &#8220;<a title="https://screen.yahoo.com/gilda-radner-snl-skits/olympia-restaurant-000000640.html" href="https://screen.yahoo.com/gilda-radner-snl-skits/olympia-restaurant-000000640.html" target="_blank">Cheezborger, cheezborger, cheezborger</a>&#8221; Saturday Night Live skit) I visited the Sourcebooks office in Naperville, met many of the folks who worked on Spam Nation, signed a metric ton of books and<a title="https://twitter.com/toddstocke/status/535820729749889024/photo/1" href="https://twitter.com/toddstocke/status/535820729749889024/photo/1" target="_blank"> the company&#8217;s author wall</a>.</p>
<div id="attachment_28792" style="width: 295px" class="wp-caption alignleft"><a href="media/a5ea6fbd.naperville-e1416857473969.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/naperville-e1416857473969.jpg"><img class="size-medium wp-image-28792" src="media/3452243a.naperville-e1416857473969-285x213.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/naperville-e1416857473969-285x213.jpg" alt="The Spam Nation signing in Naperville, IL." width="285" height="213" /></a><p class="wp-caption-text">The Spam Nation signing in Naperville, IL.</p></div>
<p>After an amazing dinner with my sister and the CEO of Sourcebooks, we headed to my first book signing event just down the street. It was a well-attended event with some passionate readers and fans, including quite a few folks from <a title="https://twitter.com/burbsecwest" href="https://twitter.com/burbsecwest" target="_blank">@BurbsecWest</a> with whom I had beers afterwards.</p>
<p>On Friday, I hopped a plane to San Francisco and sat down for taped interviews with <strong>USA Today</strong> and <strong>Bloomberg News</strong>. The book signing that night at <a title="http://www.booksinc.net/book/9781402295614" href="http://www.booksinc.net/book/9781402295614" target="_blank">Books Inc.</a> drew a nice crowd and also was followed by some after-event celebration.</p>
<p>Departed for Seattle the next morning, and sat down for a studio interview with longtime newsman (and general mensch) <strong>Herb Weisbaum</strong> at <strong>KOMO-AM</strong>. The signing in Seattle, at <a title="http://www.thirdplacebooks.com/book/%5Bmodel%5D-243" href="http://www.thirdplacebooks.com/book/%5Bmodel%5D-243" target="_blank">Third Place Books</a>, was the largest turnout of all, and included a very inquisitive crowd that bought up all of the copies of Spam Nation that the store had on hand.</p>
<div id="attachment_28798" style="width: 610px" class="wp-caption aligncenter"><a href="media/ec4c6e9b.seattlesigning-a-e1416858309241.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/seattlesigning-a-e1416858309241.jpg"><img class="size-large wp-image-28798" src="media/376cdcb0.seattlesigning-a-e1416858309241-600x337.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/seattlesigning-a-e1416858309241-600x337.jpg" alt="Yours Truly at a book signing in Seattle's Third Place Books." width="600" height="337" /></a><p class="wp-caption-text">Book signing at Seattle&#8217;s Third Place Books.</p></div>
<p>If you&#8217;re planning to be in Austin tonight &#8212; Nov. 24 &#8212; consider stopping by <strong>B&amp;N Arboretum</strong> at 7:00 p.m. and get your copy of Spam Nation signed. I&#8217;ll be holding one more signing &#8212; 7:00 p.m. in Washington, D.C.&#8217;s <a title="http://www.politics-prose.com/event/book/brian-krebs-spam-nation-inside-story-of-organized-cybercrime-global-epidemic-to-your-fron" href="http://www.politics-prose.com/event/book/brian-krebs-spam-nation-inside-story-of-organized-cybercrime-global-epidemic-to-your-fron" target="_blank">Politics &amp; Prose</a> on Dec. 4.</p>
<p>For those on the fence about buying Spam Nation, <a title="http://www.slate.com/articles/technology/future_tense/2014/11/spam_nation_meet_the_russian_cybercrooks_behind_the_digital_threats_in_your.html" href="http://www.slate.com/articles/technology/future_tense/2014/11/spam_nation_meet_the_russian_cybercrooks_behind_the_digital_threats_in_your.html" target="_blank">Slate</a> and <a title="https://www.linkedin.com/pulse/article/20141122122943-2460067-why-spammy-online-pharmacies-actually-have-amazing-customer-service?trk=object-title" href="https://www.linkedin.com/pulse/article/20141122122943-2460067-why-spammy-online-pharmacies-actually-have-amazing-customer-service?trk=object-title" target="_blank">LinkedIn</a> both ran excerpts of the book. Other reviews and interviews are available at <a title="http://fortune.com/2014/11/21/brian-krebs-spam-nation-organized-cybercrime/?utm_content=buffer1d6d9&amp;utm_medium=social&amp;utm_source=facebook.com&amp;utm_campaign=buffer" href="http://fortune.com/2014/11/21/brian-krebs-spam-nation-organized-cybercrime/?utm_content=buffer1d6d9&amp;utm_medium=social&amp;utm_source=facebook.com&amp;utm_campaign=buffer" target="_blank">Fortune.com</a>, <a title="http://news.yahoo.com/spam-nation-cybercrime-spam-far-224128994.html" href="http://news.yahoo.com/spam-nation-cybercrime-spam-far-224128994.html" target="_blank">Yahoo News</a>, and <a title="http://www.creditcards.com/credit-card-news/spam-nation-brian-krebs-data-black-market-1278.php" href="http://www.creditcards.com/credit-card-news/spam-nation-brian-krebs-data-black-market-1278.php" target="_blank">CreditCards.com</a>. Also, I was interviewed at length several times over the past month by <strong>CBS&#8217;s 60 Minutes</strong>, which is doing a segment on retail data breaches. That interview could air as early as Nov. 30. On that note, the <em>Minneapolis Star Tribune</em> ran <a title="http://www.startribune.com/local/283597021.html?page=1&amp;c=y" href="http://www.startribune.com/local/283597021.html?page=1&amp;c=y" target="_blank">a lengthy story</a> on Sunday that followed up on some information I first reported a year ago about a Ukrainian man thought to be tied to the Target breach, among others.</p>


feed_id: http://krebsonsecurity.com/?p=28755
title: Convicted ID Thief, Tax Fraudster Now Fugitive
uri: Convicted-ID-Thief-Tax-Fraudster-Now-Fugitive
url: http://krebsonsecurity.com/2014/11/convicted-id-thief-tax-fraudster-now-fugitive/
content:
<p>In April 2014, this blog featured <a title="http://krebsonsecurity.com/2014/04/an-allegation-of-harm/" href="http://krebsonsecurity.com/2014/04/an-allegation-of-harm/" target="_blank">a story</a> about <strong>Lance Ealy</strong>, an Ohio man arrested last year for buying Social Security numbers and banking information from an underground identity theft service that relied in part on data obtained through a company owned by big-three credit bureau <strong>Experian</strong>. Earlier this week, Ealy was convicted of using the data to fraudulently claim tax refunds with the IRS in the names of more than 175 U.S. citizens, but not before he snipped his monitoring anklet and skipped town.</p>
<div id="attachment_28760" style="width: 295px" class="wp-caption alignright"><a href="media/e03bc509.ealydope.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/ealydope.jpg"><img class="size-medium wp-image-28760" src="media/f0e26199.ealydope-285x378.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/ealydope-285x378.jpg" alt="Lance Ealy, in self-portrait he uploaded to twitter before absconding." width="285" height="378" /></a><p class="wp-caption-text">Lance Ealy, in selfie he uploaded to Twitter before absconding.</p></div>
<p>On Nov. 18, a jury in Ohio convicted Ealy, 28, on all 46 charges, including aggravated identity theft, and wire and mail fraud. Government prosecutors presented evidence that Ealy had purchased Social Security numbers and financial data on hundreds of consumers, using an identity theft service called <strong>Superget.info</strong> (later renamed <strong>Findget.me</strong>). The jury found that Ealy used that information to fraudulently file at least 179 tax refund requests with the Internal Revenue Service, and to open up bank accounts in other victims&#8217; names &#8212; accounts he set up to receive and withdraw tens of thousand of dollars in refund payments from the IRS.</p>
<p>The identity theft service that Ealy used was dismantled in 2013, after investigators with the U.S. Secret Service arrested its proprietor and began tracking and finding many of his customers. Investigators later discovered that the service&#8217;s owner had obtained much of the consumer data from data brokers by posing as a private investigator based in the United States.</p>
<p>In reality, the owner of Superget.info was a Vietnamese man paying for his accounts at data brokers using cash wire transfers from a bank in Singapore. Among the companies that Ngo signed up with was Court Ventures, a California company that was <a title="http://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/" href="http://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/" target="_blank">bought by credit bureau Experian</a> nine months before the government shut down Superget.info.</p>
<p>Court records show that Ealy went to great lengths to delay his trial, and even reached out to this reporter hoping that I would write about his allegations that everyone from his lawyer to the judge in the case was somehow biased against him or unfit to participate in his trial. Early on, Ealy fired his attorney, and opted to represent himself. When the court appointed him a public defender, Ealy again choose to represent himself.</p>
<p>&#8220;Mr. Ealy&#8217;s motions were in a lot of respects common delay tactics that defendants use to try to avoid the inevitability of a trial,&#8221; said <strong>Alex Sistla</strong>, an assistant U.S. attorney in Ohio who helped prosecute the case.</p>
<p>Ealy also continued to steal peoples&#8217; identities while he was on trial (although no longer buying from Superget.info), according to the government. His bail was revoked for several months, but in October the judge in the case ordered him released on a <a title="http://en.wikipedia.org/wiki/Surety_bond" href="http://en.wikipedia.org/wiki/Surety_bond">surety bond</a>.<span id="more-28755"></span></p>
<p>It is said that a man who represents himself in court has a fool for a client, and this seems doubly true when facing criminal charges by the U.S. government. Ealy&#8217;s trial lasted 11 days, and involved more than 70 witnesses &#8212; many of the ID theft victims. His last appearance in court was on Friday. When investigators checked in on Ealy at his home over the weekend, they found his electronic monitoring bracelet but not Ealy.</p>
<p><span class="il">Ealy</span> faces up to 10 years in prison on each count of possessing 15 or more unauthorized access devices with intent to defraud and using unauthorized access devices to obtain items of $1,000 or more in value; up to five years in prison on each count of filing false claims for income tax refunds with the IRS; up to 20 years in prison on each count of wire fraud and each count of mail fraud; and mandatory two-year sentences on each count of aggravated identity theft that must run consecutive to whatever sentence may ultimately be handed down. Each count of conviction also carries a fine of up to $250,000.</p>
<p>I hope they find Mr. Ealy soon and lock him up for a very long time. Unfortunately, he is one of countless fraudsters perpetrating <a title="http://krebsonsecurity.com/?s=tax+fraud&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=tax+fraud&amp;x=0&amp;y=0" target="_blank">this costly and disruptive form of identity theft</a>. In 2014, both my sister and I were the victims of tax ID theft, learning that unknown fraudsters had already filed tax refunds in our names when we each filed our taxes with the IRS.</p>
<p>I would advise all U.S. readers to request a tax filing PIN from the IRS (sadly, it turns out that I applied for mine in Feburary, only days after the thieves filed my tax return). If approved, the PIN is required on any tax return filed for that consumer before a return can be accepted. To start the process of applying for a tax return PIN from the IRS, check out the steps at <a title="http://www.irs.gov/uac/Identity-Protection" href="http://www.irs.gov/uac/Identity-Protection" target="_blank">this link</a>. You will almost certainly need to file an <a title="http://www.irs.gov/pub/irs-pdf/f14039.pdf" href="media/bfc069d5.f14039.pdf" data-original-source="http://www.irs.gov/pub/irs-pdf/f14039.pdf" target="_blank">IRS form 14039</a> (PDF), and provide scanned or photocopied records, such a drivers license or passport.</p>
<p>To read more about other ID thieves who were customers of Superget.info that the Secret Service has nabbed and put on trial, check out the stories in <a title="http://krebsonsecurity.com/?s=superget&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=superget&amp;x=0&amp;y=0" target="_blank">this series</a>. Ealy&#8217;s <a title="https://twitter.com/yung_lance_" href="https://twitter.com/yung_lance_" target="_blank">account on Twitter</a> is an also an eye-opener.</p>


feed_id: http://krebsonsecurity.com/?p=28744
title: Microsoft Releases Emergency Security Update
uri: Microsoft-Releases-Emergency-Security-Update
url: http://krebsonsecurity.com/2014/11/microsoft-releases-emergency-security-update/
content:
<p><strong>Microsoft</strong> today deviated from its regular pattern of releasing security updates on the second Tuesday of each month, pushing out an emergency patch to plug a security hole in all supported versions of<strong> Windows</strong>. The company urged Windows users to install the update as quickly as possible, noting that miscreants already are exploiting the weaknesses to launch targeted attacks.</p>
<p><a href="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png"><img class="alignright size-full wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="229" height="240" /></a>The update (<a title="https://technet.microsoft.com/library/security/MS14-068" href="https://technet.microsoft.com/library/security/MS14-068" target="_blank">MS14-068</a>) addresses a bug in a Windows component called <a title="http://msdn.microsoft.com/en-us/library/windows/desktop/aa378747(v=vs.85).aspx" href="http://msdn.microsoft.com/en-us/library/windows/desktop/aa378747(v=vs.85).aspx" target="_blank">Microsoft Windows Kerberos KDC</a>, which handles authenticating Windows PCs on a local network. It is somewhat less of a problem for Windows home users (it is only rated critical for server versions of Windows) but it poses a serious threat to organizations. According to security vendor <strong>Shavlik</strong>, the flaw allows an attacker to elevate domain user account privileges to those of the domain administrator account.</p>
<p>&#8220;The attacker could forge a Kerberos Ticket and send that to the Kerberos KDC which claims the user is a domain administrator,&#8221; writes <strong>Chris Goettl</strong>, product manager with Shavlik. &#8220;From there the attacker can impersonate any domain accounts, add themselves to any group, install programs, view\change\delete date, or create any new accounts they wish.  This could allow the attacker to then compromise any computer in the domain, including domain controllers.  If there is a silver lining in this one it is in the fact that the attacker must have a valid domain user account to exploit the vulnerability, but once they have done so, they have the keys to the kingdom.&#8221;</p>
<p>The patch is one of two that Microsoft had expected to release on Patch Tuesday earlier this month, but unexpectedly pulled at the last moment.  &#8220;This is pretty severe and definitely explains why Microsoft only delayed the release and did not pull it from the November Patch <span class="aBn" tabindex="0" data-term="goog_1714116355"><span class="aQJ">Tuesday</span></span> release all together,&#8221; Goettl said.<span id="more-28744"></span></p>
<p>On a separate note, security experts are warning those who haven&#8217;t yet fully applied the updates from Patch Tuesday to get on with it already. Researchers with vulnerability exploit development firm <strong>Immunity</strong> have been <a title="https://twitter.com/daveaitel/status/533064909387747328" href="https://twitter.com/daveaitel/status/533064909387747328" target="_blank">detailing</a> their work in devising reliable ways to exploit <a title="https://technet.microsoft.com/library/security/MS14-066" href="https://technet.microsoft.com/library/security/MS14-066" target="_blank">a critical flaw in Microsoft Secure Channel</a> (a.k.a. &#8220;Schannel&#8221;), a security package in Windows that handles SSL/TLS encryption &#8212; which protects the privacy and security of Web browsing for Windows users. More importantly, there are signs that malicious hackers are devising their own methods of exploiting the flaw to seize control over unpatched Windows systems.</p>
<p><strong>Wolfgang Kandek</strong>, chief technology officer at <strong>Qualys</strong>, said security researchers were immediately driven to this bulletin as it updates Microsoft&#8217;s SSL/TLS implementation fixing Remote Code Execution and Information Leakage that were found internally at Microsoft during a code audit.</p>
<p>&#8220;More information has not been made available, but in theory this sounds quite similar in scope to April&#8217;s Heartbleed problem in OpenSSL, which was widely publicized and had a number of documented abuse cases,&#8221; Kandek <a title="https://community.qualys.com/blogs/laws-of-vulnerabilities/2014/11/18/november-patch-tuesday--part-2" href="https://community.qualys.com/blogs/laws-of-vulnerabilities/2014/11/18/november-patch-tuesday--part-2" target="_blank">wrote</a> in a blog post today. &#8220;The dark side is certainly making progress in finding an exploit for these vulnerabilities. It is now high time to patch.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=28739
title: Link Found in Staples, Michaels Breaches
uri: Link-Found-in-Staples-Michaels-Breaches
url: http://krebsonsecurity.com/2014/11/link-found-in-staples-michaels-breaches/
content:
<p>The <a title="http://krebsonsecurity.com/2014/10/banks-credit-card-breach-at-staples-stores/" href="http://krebsonsecurity.com/2014/10/banks-credit-card-breach-at-staples-stores/" target="_blank">breach</a> at office supply chain <strong>Staple</strong>s impacted roughly 100 stores and was powered by some of the same criminal infrastructure seen in the intrusion disclosed earlier this year at <strong>Michaels</strong> craft stores, according to sources close to the investigation.</p>
<p><a href="media/093be403.staples.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/10/staples.png"><img class="alignright size-medium wp-image-28406" src="media/d828f72c.staples-285x180.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/10/staples-285x180.png" alt="staples" width="285" height="180" /></a>Multiple banks interviewed by this author say they&#8217;ve received alerts from <strong>Visa</strong> and <strong>MasterCard</strong> about cards impacted in the breach at Staples, and that to date those alerts suggest that a subset of Staples stores were compromised between July and September 2014.</p>
<p>Sources briefed on the ongoing investigation say it involved card-stealing malicious software that the intruders installed on cash registers at approximately 100 Staples locations. Framingham, Mass.-based Staples has more than 1,800 stores nationwide.</p>
<p>In response to questions about these details, Staples spokesman <strong>Mark Cautela</strong> would say only that the company believes it has found and removed the malware responsible for the attack. <span id="more-28739"></span></p>
<p>&#8220;We are continuing to investigate a data security incident involving an intrusion into some of our retail point of sale and computer systems,&#8221; Cautela said in a statement emailed to KrebsOnSecurity. &#8220;We believe we have eradicated the malware used in the intrusion and have taken steps to further enhance the security of our network.  The Company is working with law enforcement and is investigating whether any retail transaction data may have been compromised. It is important to note that customers are not responsible for any fraudulent activity on their credit cards that is reported on a timely basis.&#8221;</p>
<p>A source close to the investigation said the malware found in Staples stores was communicating with some of the same control networks that attackers used in the intrusion at Michaels, another retail breach that was <a title="http://krebsonsecurity.com/2014/01/sources-card-breach-at-michaels-stores/" href="http://krebsonsecurity.com/2014/01/sources-card-breach-at-michaels-stores/" target="_blank">first disclosed</a> on this blog. Michaels would later <a title="http://krebsonsecurity.com/2014/04/3-million-customer-credit-debit-cards-stolen-in-michaels-aaron-brothers-breaches/" href="http://krebsonsecurity.com/2014/04/3-million-customer-credit-debit-cards-stolen-in-michaels-aaron-brothers-breaches/" target="_blank">acknowledge</a> that the incident was actually two separate, eight-month long breaches that resulted in the theft of more than three million customer credit and debit cards.</p>
<p>The same source compared the breach at Staples to the intrusion recently disclosed at the nationwide grocer chain <a title="http://www.albertsons.com/recent-update/" href="http://www.albertsons.com/recent-update/" target="_blank">Albertsons</a>, noting that both breaches resulted in the theft of far fewer customer credit and debit cards that thieves might have stolen in these attacks. It remains unclear what factors may have limited the number of cards stolen in these breaches, particularly compared to tens of millions of cards stolen in breaches at similar nationwide retail chains like <a title="http://krebsonsecurity.com/?s=target+breach&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=target+breach&amp;x=0&amp;y=0" target="_blank">Target</a> and <a title="http://krebsonsecurity.com/?s=home+depot+breach&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=home+depot+breach&amp;x=0&amp;y=0" target="_blank">Home Depot</a>.</p>
<p>I fully expect that we&#8217;ll hear about another major retail chain getting hacked as we approach another Black Friday. Any retailers that are still handling unencrypted credit card data on their networks remain an attractive and lucrative target for attackers.</p>


feed_id: http://krebsonsecurity.com/?p=28701
title: Amazon: Spam Nation one of “Best of Month”
uri: Amazon-Spam-Nation-one-of-Best-of-Month
url: http://krebsonsecurity.com/2014/11/amazon-spam-nation-one-of-best-of-month/
content:
<p>A quick update on my new book, <em>Spam Nation, The Inside Story of Organized Cybercrime — From Global Epidemic to Your Front Door </em>debuting on bookstore shelves  <span class="aBn" tabindex="0" data-term="goog_642680628"><span class="aQJ">Tuesday, Nov. 18</span></span>:<em> </em>Amazon has selected Spam Nation as one of their “<a title="http://www.amazon.com/Best-Books-of-the-Month/b/ref=amb_link_360217662_2?ie=UTF8&amp;node=390919011&amp;pf_rd_m=ATVPDKIKX0DER&amp;pf_rd_s=merchandised-search-top-1&amp;pf_rd_r=1QX8Q3W17Q684TRCFTQE&amp;pf_rd_t=101&amp;pf_rd_p=1348433382&amp;pf_rd_i=4919327011" href="http://www.amazon.com/Best-Books-of-the-Month/b/ref=amb_link_360217662_2?ie=UTF8&amp;node=390919011&amp;pf_rd_m=ATVPDKIKX0DER&amp;pf_rd_s=merchandised-search-top-1&amp;pf_rd_r=1QX8Q3W17Q684TRCFTQE&amp;pf_rd_t=101&amp;pf_rd_p=1348433382&amp;pf_rd_i=4919327011" target="_blank">Best Books of the Month</a>” picks for November, listed alongside such notable authors as <strong>Stephen King</strong> and <strong>Nora Roberts</strong>.</p>
<p><a href="media/d18c89c6.abbotm-c.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/abbotm-c.jpg"><img class="alignright size-medium wp-image-28724" src="media/d6c87b93.abbotm-c-285x188.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/abbotm-c-285x188.jpg" alt="abbotm-c" width="285" height="188" /></a>In addition, my publisher has graciously extended the free<a title="http://krebsonsecurity.com/2014/07/wireless-live-cd-alternative-zeusgard/" href="http://krebsonsecurity.com/2014/07/wireless-live-cd-alternative-zeusgard/" target="_blank">ZeusGard</a> offer until <span class="aBn" tabindex="0" data-term="goog_642680629"><span class="aQJ">Nov. 25</span></span> for the next 500 people who order more than one copy of the book.</p>
<p>In early October we <a title="http://krebsonsecurity.com/2014/10/spam-nation-book-offer-tour-details/" href="http://krebsonsecurity.com/2014/10/spam-nation-book-offer-tour-details/" target="_blank">launched a promotion</a> in which the first 1,000 readers to preorder more than one copy of the book, audio recording and/or e-book version of Spam Nation would receive a free, <a title="http://krebsonsecurity.com/wp-content/uploads/2014/10/zg-ke-285x213.jpg" href="media/ddec7f7d.zg-ke-285x213.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/10/zg-ke-285x213.jpg" target="_blank">KrebsOnSecurity-branded ZeusGard</a>, a USB-based technology that’s designed to streamline the process of adopting the Live CD approach for online banking.</p>
<p>Approximately 500 readers took us up on this offer, but that means we still have about 500 left! Thankfully, my publisher (Sourcebooks) has agreed to extend this offer by one week (until <span class="aBn" tabindex="0" data-term="goog_642680630"><span class="aQJ">Nov. 25, 2014</span></span>).</p>
<p>Finally, if you live in Chicago, San Francisco, Seattle or Austin and would like a personalized copy of Spam Nation, please consider joining me this week as I drop by a local bookstore near you! See <a title="http://krebsohttp://krebsonsecurity.com/spam-nation-book-tour-schedule/nsecurity.com/2014/10/spam-nation-book-offer-tour-details/ " href="http://krebsonsecurity.com/spam-nation-book-tour-schedule/" target="_blank">the tour schedule</a> for dates, times and locations.</p>


feed_id: http://krebsonsecurity.com/?p=28570
title: ‘Microsoft Partner’ Claims Fuel Support Scams
uri: Microsoft-Partner-Claims-Fuel-Support-Scams
url: http://krebsonsecurity.com/2014/11/microsoft-partner-claims-fuel-support-scams/
content:
<p>You can&#8217;t make this stuff up: A tech support company based in the United States that outsources its work to India says its brand is being unfairly maligned by &#8212; wait for it&#8230;..tech support scammers based in India. In an added twist, the U.S.-based tech support firm acknowledges that the trouble may be related to its admittedly false statements about being a <strong>Microsoft Certified Partner</strong> &#8212; the same false statements made by most telephone-based tech support scams.</p>
<p>Tech support scams are, unfortunately, an extremely common scourge. Most such scams are the telephonic equivalent of rogue antivirus attacks, which try to frighten consumers into purchasing worthless security software and services. Both types of scams try to make the consumer believe that the caller is somehow associated with Microsoft <a title="http://krebsonsecurity.com/?s=iyogi&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=iyogi&amp;x=0&amp;y=0" target="_blank">or with a security company</a>, and each caller tries to cajole or scare the consumer into giving up control over his or her PC.</p>
<p>Earlier this month, a reader shared a link to <a title="https://www.youtube.com/watch?v=GVQoAlQrnSg" href="https://www.youtube.com/watch?v=GVQoAlQrnSg" target="_blank">a lengthy Youtube video</a> by freelance journalist <strong>Carey Holzman</strong>, in which Holzman turns the tables on the tech support scammers. During the video, Holzman plays along and gives the scammer remote control access to a test computer he&#8217;s set up specifically for this video.  The scammer, who speaks with a strong Indian accent but calls himself &#8220;Steve Wilson&#8221; from the &#8220;Microsoft technical department,&#8221; tries to convince Holzman that he works for a company that is a legitimate Microsoft support partner.</p>
<p>&#8220;Let me show you who we are,&#8221; the scammer says, opening up Google.com and typing <strong>SB3 Inc.</strong> Clicking on the first result brings up sb3inc[dot]com, which proudly displays an icon in the upper right corner of its home page stating that it is a Microsoft Certified Partner. &#8220;This is our mother company. Can you see that we are a Microsoft certified partner?&#8221;</p>
<p><center><iframe src="//www.youtube.com/embed/GVQoAlQrnSg" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></center></p>
<p>When Holzman replies that this means nothing and that anyone can just put a logo on their site saying they&#8217;re associated with Microsoft, the scammer runs a search on <strong>Microsoft.com</strong> for SB3. The scammer shows true chutzpah when he points to the first result, which &#8212; if clicked &#8212; leads to a page on Microsoft&#8217;s community site where members try to warn the poster away from SB3 as a scam.</p>
<p>When Holzman tries to get the scammer to let him load the actual search result link about SB3 on Microsoft.com, the caller closes the browser window and proceeds to enable <a title="http://www.thewindowsclub.com/inbuilt-syskey-utility-lock-windows-7-computer-usb-stick" href="http://www.thewindowsclub.com/inbuilt-syskey-utility-lock-windows-7-computer-usb-stick" target="_blank">the SysKey utility on Windows</a>, which allows the scammer to set a secret master password that must be entered before the computer will boot into Windows (effectively an attempt at locking Holzman out of his test computer if he tries to reboot).</p>
<p>The video goes on for some time more, but I decided to look more closely at SB3. The Web site registration records for the company state that it is based in New Jersey, and it took less than a minute to find <a title="https://www.facebook.com/suvajitusa.basu" href="https://www.facebook.com/suvajitusa.basu" target="_blank">the Facebook page of the company&#8217;s owner</a> &#8212; a <strong>Suvajit</strong> <a title="http://mediastarventures.com/sbasu.html" href="http://mediastarventures.com/sbasu.html" target="_blank">&#8220;Steve&#8221;</a> <strong>Basu</strong> in Ridgewood, NJ. Basu&#8217;s Facebook feed has him traveling the world, visiting the World Cup in Brazil in 2014, the Ryder Cup in 2012, and more recently taking delivery on a brand new Porsche.<span id="more-28570"></span></p>
<p>Less than 24 hours after reaching out to him on Facebook and by phone, Basu returns my call and says he&#8217;s working to get to the bottom of this. Before I let him go, I tell Basu that I can&#8217;t find on <a title="https://mspartner.microsoft.com//en/us/Pages/index.aspx" href="https://mspartner.microsoft.com//en/us/Pages/index.aspx" target="_blank">Microsoft&#8217;s Partner Site</a> any evidence to support SB3&#8217;s claim that it is a Microsoft Certified Partner. Basu explains that while the company at one time was in fact a partner, this stopped being the case &#8220;a few months ago.&#8221; For its part, Microsoft would only confirm that SB3 is not currently a Microsoft partner of any kind.</p>
<div id="attachment_28649" style="width: 295px" class="wp-caption alignright"><a href="media/5635a913.sb3homepage.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/sb3homepage.png"><img class="size-medium wp-image-28649" src="media/12397628.sb3homepage-285x189.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/sb3homepage-285x189.png" alt="SB3's homepage, before it removed the false &quot;Microsoft Partner&quot; claim." width="285" height="189" /></a><p class="wp-caption-text">SB3&#8217;s homepage, before it removed the false &#8220;Microsoft Partner&#8221; claim.</p></div>
<p>Basu explained that Microsoft revoked SB3&#8217;s partner status after receiving complaints that customers were being cold-called by SB3 technicians claiming to be associated with Microsoft. &#8220;Microsoft had gotten complaints and we took out all references to Microsoft as part of our script,&#8221; that the company gives to tech support callers, Basu said.</p>
<p>As for why SB3 still falsely claimed to be a Microsoft Partner, Basu said his instructions to take the logo down from the site had apparently been ignored by his site&#8217;s administrators.</p>
<p>&#8220;That was a mistake for which we do take the blame and responsibility,&#8221; Basu said in a follow-up email. &#8220;We have corrected this immediately on hearing from you and you will no longer find a mention of Microsoft on our SB3Inc Website.&#8221;</p>
<p>Basu said SB3 is a legitimate company based in the USA which uses off-shore manpower and expertise to sell tech support services through its <strong>iFixo</strong> arm, and that the company never participates in the sort of scammy activities depicted in Holzman&#8217;s video. Basu maintains that scammers are impersonating the company and taking advantage of its good name, and points to a section of the video where the scammer loads a payment page at <strong>support2urpc[dot]com</strong>, suggesting that Support to Your PC is the real culprit (the latter company did not return messages seeking comment).</p>
<p>&#8220;After viewing your video it is obvious to us that one or more persons out there are misusing our brand and good-will,&#8221; Basu wrote.&#8221;We feel horrible and feel that along with the unknowing consumers we are also victims. This is corporate identity theft.&#8221;</p>
<p>SB3 may well be a legitimate company that is being scammed by the scammers, but if that&#8217;s true the company has done itsself and its reputation no favors by falsely stating it is a Microsoft partner. What&#8217;s more, complaints about tech support scammers claiming to be from SB3 are numerous and date back more than a year. I find it remarkable that a tech support company with the uncommon distinction of having secured a good name in this line of work would not act more zealously to guard that reputation. Alas, a simple Internet search on the SB3 brand would have alerted the company to these shenanigans.</p>
<p>SB3 has since removed the Microsoft Certified Partner logo from its home page, but <a href="media/cf1c6d90.ms-partner-logo.jpg" data-original-source="http://sb3inc.com/images/ms-partner-logo.jpg" title="http://sb3inc.com/images/ms-partner-logo.jpg" target="_blank">the image</a> is still on its server. Running a search on that image at <a title="http://www.tineye.com" href="http://www.tineye.com" target="_blank">Tineye.com</a> &#8212; an extremely useful image search Web site &#8212; produces more than 11,700 results. No doubt Microsoft and other scam hunters have used this investigative tool to locate tech support scams, which may explain why support2urpc[dot]com does not appear to include the same image on its site but instead claims association with sites that do.</p>


feed_id: http://krebsonsecurity.com/?p=28654
title: Network Hijackers Exploit Technical Loophole
uri: Network-Hijackers-Exploit-Technical-Loophole
url: http://krebsonsecurity.com/2014/11/network-hijackers-exploit-technical-loophole/
content:
<p>Spammers have been working methodically to hijack large chunks of Internet real estate by exploiting a technical and bureaucratic loophole in the way that various regions of the globe keep track of the world&#8217;s Internet address ranges.</p>
<p>Last week, KrebsOnSecurity featured <a title="http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/" href="http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/" target="_blank">an in-depth piece</a> about a well-known junk email artist who acknowledged sending from <a title="http://bgp.he.net/AS201640#_whois" href="http://bgp.he.net/AS201640#_whois" target="_blank">two Bulgarian</a> <a title="http://bgp.he.net/AS200002#_whois" href="http://bgp.he.net/AS200002#_whois" target="_blank">hosting providers</a>. These two providers had commandeered tens of thousands of Internet addresses from ISPs around the globe, including Brazil, China, India, Japan, Mexico, South Africa, Taiwan and Vietnam.</p>
<p>For example, a closer look <a title="https://stat.ripe.net/widget/routing-history#w.resource=AS201640" href="https://stat.ripe.net/widget/routing-history#w.resource=AS201640" target="_blank">at the Internet addresses hijacked by one of the Bulgarian providers</a> &#8212; aptly named &#8220;<strong>Mega-Spred</strong>&#8221; with an email contact of &#8220;abuse@grimhosting&#8221; &#8212; shows that this provider has been slowly  gobbling up far-flung IP address ranges since late August 2014.</p>
<div id="attachment_28685" style="width: 609px" class="wp-caption aligncenter"><a href="media/7dd0dcd1.Mega-SpredAS201640.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/Mega-SpredAS201640.png"><img class="size-full wp-image-28685" src="media/7dd0dcd1.Mega-SpredAS201640.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/Mega-SpredAS201640.png" alt="This table, with data from the RIPE NCC -- of the regional Internet Registries, shows IP address hijacking activity by Bulgarian host Mega-Spred." width="599" height="731" /></a><p class="wp-caption-text">This table, with data from the RIPE NCC &#8212; of the regional Internet Registries, shows IP address hijacking activity by Bulgarian host Mega-Spred.</p></div>
<p>According to several security and anti-spam experts who&#8217;ve been following this activity, Mega-Spred and the other hosting provider in question (known as <a title="http://krebsonsecurity.com/wp-content/uploads/2014/11/Kandi-AS200002.png" href="media/aba058cd.Kandi-AS200002.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/Kandi-AS200002.png" target="_blank">Kandi EOOD</a>) have been taking advantage of an administrative weakness in the way that some countries and regions of the world keep tabs on the IP address ranges assigned to various hosting providers and ISPs. Neither Kandi nor Mega-Spred responded to requests for comment.</p>
<p>IP address hijacking is hardly a new phenomenon. Spammers sometimes hijack Internet address ranges that go unused for periods of time. Dormant or “unannounced” address ranges are ripe for abuse partly because of the way the global routing system works: Miscreants can “announce” to the rest of the Internet that their hosting facilities are the authorized location for given Internet addresses. If nothing or nobody objects to the change, the Internet address ranges fall into the hands of the hijacker.</p>
<p>Experts say the hijackers also are exploiting a fundamental problem with record-keeping activities of <a title="http://en.wikipedia.org/wiki/RIPE_NCC" href="http://en.wikipedia.org/wiki/RIPE_NCC" target="_blank">RIPE NCC</a>, the regional Internet registry (RIR) that oversees the allocation and registration of IP addresses for Europe, the Middle East and parts of Central Asia. RIPE is one of several RIRs, including ARIN (which handles mostly North American IP space) and APNIC (Asia Pacific), LACNIC (Latin America) and AFRINIC (Africa).<span id="more-28654"></span></p>
<p><b>Ron Guilmette</b>, an anti-spam crusader who is active in numerous Internet governance communities, said the problem is that a network owner in RIPE&#8217;s region can hijack Internet addresses that belong to network owners in regions managed by other RIRs, and if the hijackers then claim to RIPE that they&#8217;re the rightful owners of those hijacked IP ranges, RIPE will simply accept that claim without verifying or authenticating it.</p>
<p>Worse yet, Guilmette and others say, those bogus entries &#8212; once accepted by RIPE &#8212; get exported to other databases that are used to check the validity of global IP address routing tables, meaning that parties all over the Internet who are checking the validity of a route may be doing so against bogus information created by the hijacker himself.</p>
<p>&#8220;RIPE is now acutely aware of what is going on, and what has been going on, with the blatantly crooked activities of this rogue provider,&#8221; Guilmette said. &#8220;However, due to the exceptionally clever way that the proprietors of Mega-Spred have performed their hijacks, the people at RIPE still can&#8217;t even agree on how to even undo this mess, let alone how to prevent it from happening again in the future.&#8221;</p>
<p>And here is where the story perhaps unavoidably warps into Geek Factor 5. For its part, RIPE said in an emailed statement to KrebsOnSecurity that the <span class="il">RIPE</span> NCC has no knowledge of the agreements made between network operators or with address space holders.</p>
<blockquote><p>&#8220;It’s important to note the distinction between an Internet Number Registry (INR) and an <a title="http://www.irr.net/" href="http://www.irr.net/" target="_blank">Internet Routing Registry</a> (<span class="il">IRR</span>). The RIPE Database (and many of the other RIR databases) combine these separate functionalities. An INR records who holds which Internet number resources, and the sub-allocations and assignments they have made to End Users.</p>
<p>On the other hand, an <span class="il">IRR</span>contains route and other objects — which detail a network&#8217;s policies regarding who it will peer with, along with the Internet number resources reachable through a specific ASN/network. There are 34 separate IRRs globally — therefore, this isn’t something that happens at the RIR level, but rather at the <a title="https://www.ripe.net/data-tools/db/the-ripe-routing-registry" href="https://www.ripe.net/data-tools/db/the-ripe-routing-registry" target="_blank">Internet Routing Registry</a> level.&#8221;</p></blockquote>
<p>&#8220;It is not possible therefore for the RIRs to verify the routing information entered into Internet Routing Registries or monitor the accuracy of the route objects,&#8221; the organization concluded.</p>
<p>Guilmette said RIPE&#8217;s response seems crafted to draw attention away from RIPE&#8217;s central role in this mess.</p>
<p>&#8220;That it is somewhat disingenuous, I think for this RIPE representative to wave this whole mess off as a problem with the<br />
IRRs when in this specific case, the <span class="il">IRR</span> that first accepted and then promulgated these bogus routing validation records was RIPE,&#8221; he said.</p>
<p>RIPE notes that network owners can reduce the occurrence of IP address hijacking by taking advantage of <a title="http://en.wikipedia.org/wiki/Resource_Public_Key_Infrastructure" href="http://en.wikipedia.org/wiki/Resource_Public_Key_Infrastructure" target="_blank">Resource Certification (RPKI)</a>, a free service to RIPE members and non-members that allows network operators to request a digital certificate listing the Internet number resources they hold. This allows other network operators to verify that routing information contained in this system is published by the legitimate holder of the resources. In addition, the system enables the holder to receive notifications when a routing prefix is hijacked, RIPE said.</p>
<p>While RPKI (and other solutions to this project, such as <a title="http://www.dnssec-deployment.org/2012/04/leveraging-dnssec-to-protect-bgp/" href="http://www.dnssec-deployment.org/2012/04/leveraging-dnssec-to-protect-bgp/" target="_blank">DNSSEC</a>) have been around for years, obviously not all network providers currently deploy these security methods. <strong>Erik Bais</strong>, a director at <strong>A2B Internet BV</strong> &#8212; a Dutch ISP &#8212; said while broader adoption of solutions like RPKI would certainly help in the long run, one short-term fix is for RIPE to block its Internet providers from claiming routes in address ranges managed by other RIRs.</p>
<p>&#8220;This is a quick fix, but it will break things in the future for legitimate usage,&#8221; Bais said.</p>
<p>According to RIPE, this very issue was <a title="https://ripe69.ripe.net/archives/video/10089/" href="https://ripe69.ripe.net/archives/video/10089/" target="_blank">discussed at length</a> at the recent <span class="il">RIPE</span> 69 Meeting in London last week.</p>
<p>&#8220;The <span class="il">RIPE</span> NCC is now working with the <span class="il">RIPE</span> community to investigate ways of making such improvements,&#8221; RIPE said in a statement.</p>
<p>This is a complex problem to be sure, but I think this story is a great reminder of two qualities about Internet security in general that are fairly static (for better or worse): First, much of the Internet works thanks to the efforts of a relatively small group of people who work very hard to balance openness and ease-of-use with security and stability concerns. Second, global Internet address routing issues are extraordinarily complex &#8212; not just in technical terms but also because they also require coordination and consensus between and among multiple stakeholders with sometimes radically different geographic and cultural perspectives. Unfortunately, complexity is the enemy of security, and spammers and other ne&#8217;er-do-wells understand and exploit this gap as often as possible.</p>


feed_id: http://krebsonsecurity.com/?p=28583
title: Adobe, Microsoft Issue Critical Security Fixes
uri: Adobe-Microsoft-Issue-Critical-Security-Fixes
url: http://krebsonsecurity.com/2014/11/adobe-microsoft-issue-critical-security-fixes-3/
content:
<p><strong>Adobe</strong> and <strong>Microsoft today</strong> each issued security updates to fix critical vulnerabilities in their software. Microsoft pushed 14 patches to address problems in <strong>Windows</strong>,<strong> Office</strong>, <strong>Internet Explorer</strong> and <strong>.NET</strong>, among other products. Separately, Adobe issued an update for its <strong>Flash Player</strong> software that corrects at least 18 security issues.</p>
<p><a href="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png"><img class="alignright size-full wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="229" height="240" /></a>Microsoft <a title="https://technet.microsoft.com/library/security/ms14-nov" href="https://technet.microsoft.com/library/security/ms14-nov" target="_blank">announced 16 bulletins</a>, but curiously two of those are listed as pending. Topping the list of critical updates from Microsoft is a fix for a zero-day vulnerability disclosed last month that hackers have been using in targeted cyber espionage attacks. Another critical patch targets 17 weaknesses in Internet Explorer, including a remotely exploitable vulnerability in all supported versions of Windows that earned a <a title="http://www.first.org/cvss" href="http://www.first.org/cvss" target="_blank">CVSS score</a> of 9.3 (meaning it is highly likely to be exploited in drive-by attacks, and probably soon).</p>
<p>That flaw is a rare &#8220;unicorn-like&#8221; bug according to <strong>IBM X-Force</strong>, which discovered and reported the issue privately to Microsoft. In <a title="http://securityintelligence.com/ibm-x-force-researcher-finds-significant-vulnerability-in-microsoft-windows/" href="http://securityintelligence.com/ibm-x-force-researcher-finds-significant-vulnerability-in-microsoft-windows/" target="_blank">a blog post</a> published today, IBM researchers described how the vulnerability can be used to sidestep the <a title="http://support.microsoft.com/kb/2864914" href="http://support.microsoft.com/kb/2864914" target="_blank">Enhanced Protected Mode</a> sandbox in IE11, as well as Microsoft&#8217;s <a title="http://krebsonsecurity.com/2013/06/windows-security-101-emet-4-0/" href="http://krebsonsecurity.com/2013/06/windows-security-101-emet-4-0/" target="_blank">EMET anti-exploitation tool</a> that Microsoft offers for free.</p>
<p>&#8220;In this case, the buggy code is at least 19 years old, and has been remotely exploitable for the past 18 years,&#8221; writes IBM researcher <strong>Robert Freeman</strong>. &#8220;Looking at the original release code of Windows 95, the problem is present. In some respects this vulnerability has been sitting in plain sight for a long time, despite many other bugs being discovered and patched in the same Windows library (OleAut32).&#8221;</p>
<p>Freeman said while unpatched Internet Explorer users are most at risk from this bug, the vulnerability also could be exploited through Microsoft Office files. &#8220;The other attack vectors this vulnerability could work with are Microsoft Office with script macros, for example in Excel documents,&#8221; Freeman told KrebsOnSecurity. &#8220;Most versions of Office (since about 2003) have macros disabled by default so the user would have to enable them (which can be a fairly mindless YES click at the top of the screen). Or if a user is using an old enough version of Office, the macros will be enabled by default.&#8221;</p>
<p><a href="media/db4a5adc.macrosms.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/macrosms.png"><img class="aligncenter size-large wp-image-28673" src="media/29cdcc7d.macrosms-600x350.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/macrosms-600x350.png" alt="macrosms" width="600" height="350" /></a></p>
<p><span id="more-28583"></span></p>
<p>According to Shavlik, the two pending patches, MS14-068 and MS14-075, are both listed on the bulletin summary page as &#8220;release date to be determined,&#8221; which apparently is an anomaly we haven&#8217;t seen before. &#8220;Typically, a pulled patch is removed from the list entirely,&#8221; wrote Chris Goettl, product manager at Shavlik. &#8220;This could mean it may still come this month, but not today. These two patches were likely an OS and the Exchange patch based on the advanced notification list,&#8221; That is at least one less major product admins will need to be concerned about this Patch <span class="aBn" tabindex="0" data-term="goog_1120962818"><span class="aQJ">Tuesday</span></span>, although the date to be determined could come at any time.&#8221;</p>
<p>As I&#8217;ve noted in previous posts, the few times I&#8217;ve experienced troubles after applying Microsoft updates have almost all included a fix for Microsoft&#8217;s widely-installed .NET platform. If you have .NET installed, it&#8217;s probably a good idea to install this one separately after applying the other updates and rebooting.</p>
<p><a title="http://helpx.adobe.com/security/products/flash-player/apsb14-24.html" href="http://helpx.adobe.com/security/products/flash-player/apsb14-24.html" target="_blank">Adobe&#8217;s update</a> addresses a whopping 18 security holes in Flash Player and <strong>Adobe AIR</strong>. Updates are available for Windows, Mac and Linux versions of Flash. Adobe says Adobe Flash Player users should update the program to the <em>version 15.0.0.223</em>. To see which version of Flash you have installed, check <a title="https://www.adobe.com/software/flash/about/" href="https://www.adobe.com/software/flash/about/" target="_blank">this link</a>. IE10/IE11 on Windows 8.x and Chrome should auto-update their versions of Flash.</p>
<p>The most recent versions of Flash are available from the <a title="http://get.adobe.com/flashplayer/" href="http://get.adobe.com/flashplayer/" target="_blank">Flash home page</a>, but beware potentially unwanted add-ons, like McAfee Security Scan. To avoid this, uncheck the pre-checked box before downloading, or grab your OS-specific Flash download from <a title="http://www.adobe.com/products/flashplayer/distribution3.html" href="http://www.adobe.com/products/flashplayer/distribution3.html" target="_blank">here</a>.</p>
<p>Windows users who browse the Web with anything other than Internet Explorer may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.). If you have Adobe AIR installed, you’ll want to update this program. AIR ships with an auto-update function that should prompt users to update when they start an application that requires it; the newest, patched version is v. 15.0.0.356 for Windows, Mac, and Android.</p>
<p><a href="media/eabfd04c.adobeflash15-0-0-223.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/adobeflash15-0-0-223.png"><img class="aligncenter size-large wp-image-28676" src="media/fab6579f.adobeflash15-0-0-223-600x265.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/adobeflash15-0-0-223-600x265.png" alt="adobeflash15-0-0-223" width="600" height="265" /></a></p>


feed_id: http://krebsonsecurity.com/?p=28634
title: Home Depot: Hackers Stole 53M Email Addresses
uri: Home-Depot-Hackers-Stole-53M-Email-Addresses
url: http://krebsonsecurity.com/2014/11/home-depot-hackers-stole-53m-email-addreses/
content:
<p>As if the credit card breach at <strong>Home Depot</strong> didn&#8217;t already look enough like the <strong>Target breach</strong>: Home Depot said yesterday that the hackers who stole 56 million customer credit and debit card accounts also made off with 53 million customer email addresses.</p>
<p><a href="media/a4dab1eb.pwnddepot.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/09/pwnddepot.png"><img class="alignright  wp-image-27817" src="media/21f6c9c1.pwnddepot-285x285.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/09/pwnddepot-285x285.png" alt="pwnddepot" width="228" height="228" /></a>In <a title="https://corporate.homedepot.com/MediaCenter/Documents/Press%20Release.pdf" href="media/cffd523f.Press20Release.pdf" data-original-source="https://corporate.homedepot.com/MediaCenter/Documents/Press%20Release.pdf" target="_blank">an update</a> (PDF) released to its site on Thursday, Home Depot warned customers about the potential for thieves to use the email addresses in phishing attacks (think a Home Depot &#8220;survey&#8221; that offers a gift card for the first 10,000 people who open the booby-trapped attachment, for example). Home Depot stressed that the files containing the stolen email addresses did not contain passwords, payment card information or other sensitive personal information.</p>
<p>Home Depot said the crooks initially broke in using credentials stolen from a third-party vendor. The company said thieves used the vendor’s user name and password to enter the perimeter of Home Depot’s network, but that these stolen credentials alone did not provide direct access to the company’s point-of-sale devices. For that, they had to turn to a vulnerability in Microsoft Windows that was patched only after the breach occurred, according to a story in Thursday&#8217;s <em>Wall Street Journal</em>.</p>
<p>Recall that the Target breach also started with <a title="http://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/" href="http://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/" target="_blank">a hacked vendor</a> &#8212; a heating and air conditioning company in Pennsylvania that was relieved of remote-access credentials after someone inside the company <a title="http://krebsonsecurity.com/2014/02/email-attack-on-vendor-set-up-breach-at-target/" href="http://krebsonsecurity.com/2014/02/email-attack-on-vendor-set-up-breach-at-target/" target="_blank">opened a virus-laden email attachment</a>. Target also came out in the days after the breach became public and revealed that the attackers had stolen more than 70 million customer email addresses.<span id="more-28634"></span></p>
<p>Home Depot also confirmed that thieves targeted its self-checkout systems, a pattern <a title="http://krebsonsecurity.com/2014/09/in-home-depot-breach-investigation-focuses-on-self-checkout-lanes/" href="http://krebsonsecurity.com/2014/09/in-home-depot-breach-investigation-focuses-on-self-checkout-lanes/" target="_blank">first reported on this blog on Sept. 18</a>. <em>The Wall Street Journal r</em>eported that the intruders targeted the 7,500 self-checkout lanes at Home Depot because those terminals were clearly referenced by the company&#8217;s internal computer system as payment terminals, whereas another 70,000 regular registers were identified simply by a number.</p>
<p>News of the Home Depot breach <a title="http://krebsonsecurity.com/2014/09/banks-credit-card-breach-at-home-depot/" href="http://krebsonsecurity.com/2014/09/banks-credit-card-breach-at-home-depot/" target="_blank">broke on this blog on Sept. 2</a>, after multiple banks confirmed that tens of thousands of their cards had just shown up for sale on the underground cybercrime shop rescator[dot]cc. That same carding shop was <a title="http://krebsonsecurity.com/2013/12/sources-target-investigating-data-breach/" href="http://krebsonsecurity.com/2013/12/sources-target-investigating-data-breach/" target="_blank">also the tip-off for the breach at Target</a>, which came only after <a title="http://krebsonsecurity.com/2013/12/whos-selling-credit-cards-from-target/" href="http://krebsonsecurity.com/2013/12/whos-selling-credit-cards-from-target/" target="_blank">Rescator and his band of thieves</a> pushed millions of cards stolen from Target shoppers onto the black market.</p>


feed_id: http://krebsonsecurity.com/?p=28608
title: Feds Arrest Alleged ‘Silk Road 2′ Admin, Seize Servers
uri: Feds-Arrest-Alleged-Silk-Road-2-Admin-Seize-Servers
url: http://krebsonsecurity.com/2014/11/feds-arrest-alleged-silk-road-2-admin-seize-servers/
content:
<p>Federal prosecutors in New York today announced the arrest and charging of a San Francisco man they say ran the online drug bazaar and black market known as <strong>Silk Road 2.0</strong>. In conjunction with the arrest, U.S. and European authorities have jointly seized control over the servers that hosted Silk Road 2.0 marketplace.</p>
<div id="attachment_28610" style="width: 590px" class="wp-caption aligncenter"><a href="media/335fd4d9.sr20.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/sr20.png"><img class="size-full wp-image-28610" src="media/335fd4d9.sr20.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/sr20.png" alt="The home page of the Silk Road 2.0 market has been replaced with this message indicating the community's Web servers were seized by authorities. " width="580" height="398" /></a><p class="wp-caption-text">The home page of the Silk Road 2.0 market has been replaced with this message indicating the community&#8217;s Web servers were seized by authorities.</p></div>
<p>On Wednesday, agents with the FBI and the Department of Homeland Security arrested 26-year-old <strong>Blake Benthall</strong>, a.k.a. &#8220;Defcon,&#8221; in San Francisco, charging him with drug trafficking, conspiracy to commit computer hacking, and money laundering, among other alleged crimes.</p>
<p>Benthall&#8217;s <a title="https://www.linkedin.com/profile/view?id=11796569&amp;authType=NAME_SEARCH&amp;authToken=H1fo&amp;locale=en_US&amp;trk=tyah2&amp;trkInfo=tarId%3A1415290372772%2Ctas%3Ablake%20ben%2Cidx%3A1-1-1" href="https://www.linkedin.com/profile/view?id=11796569&amp;authType=NAME_SEARCH&amp;authToken=H1fo&amp;locale=en_US&amp;trk=tyah2&amp;trkInfo=tarId%3A1415290372772%2Ctas%3Ablake%20ben%2Cidx%3A1-1-1" target="_blank">LinkedIn profile</a> says he is a native of Houston, Texas and was a programmer and &#8220;construction worker&#8221; at <a title="http://codespike.co" href="http://codespike.co" target="_blank">Codespike</a>, a company he apparently founded using another company, <a title="http://www.benthallgroup.com/" href="http://www.benthallgroup.com/" target="_blank">Benthall Group, Inc.</a> Benthall&#8217;s LinkedIn and <a title="https://www.facebook.com/blakeeb?fref=ts" href="https://www.facebook.com/blakeeb?fref=ts" target="_blank">Facebook profiles</a> both state that he was a software engineer at <strong>Space Exploration Technologies Corp. (SpaceX)</strong>, although this could not be immediately confirmed. Benthall <a title="https://twitter.com/blakeeb" href="https://twitter.com/blakeeb" target="_blank">describes himself on Twitter</a> as a &#8220;rocket scientist&#8221; and a &#8220;bitcoin dreamer.&#8221;</p>
<div id="attachment_28612" style="width: 610px" class="wp-caption aligncenter"><a href="media/24dfe788.benthall-LI.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/benthall-LI.png"><img class="size-large wp-image-28612" src="media/e5e4d720.benthall-LI-600x425.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/benthall-LI-600x425.png" alt="Blake Benthall's public profile page at LinkedIn.com" width="600" height="425" /></a><p class="wp-caption-text">Blake Benthall&#8217;s public profile page at LinkedIn.com</p></div>
<p>Benthall&#8217;s arrest comes approximately a year after the launch of Silk Road 2.0, which came online less than a month after federal agents shut down the original Silk Road community and arrested its alleged proprietor &#8212; <strong>Ross William Ulbricht</strong>, a/k/a “Dread Pirate Roberts.” Ulbricht is currently fighting similar charges, and made a final pre-trial appearance in a New York court earlier this week.</p>
<p>According to federal prosecutors, since about December 2013, Benthall has secretly owned and operated Silk Road 2.0, which the government describes as &#8220;one of the most extensive, sophisticated, and widely used criminal marketplaces on the Internet today.&#8221; Like its predecessor, Silk Road 2.0 operated on the “Tor” network, a special network of computers on the Internet, distributed around the world, designed to conceal the true IP addresses of the computers on the network and thereby the identities of the network’s users.</p>
<p>&#8220;Since its launch in November 2013, Silk Road 2.0 has been used by thousands of drug dealers and other unlawful vendors to distribute hundreds of kilograms of illegal drugs and other illicit goods and services to buyers throughout the world, as well as to launder millions of dollars generated by these unlawful transactions,&#8221;reads a statement released today by <strong>Preet Bharara</strong>, the United States Attorney for the Southern District of New York. &#8220;As of September 2014, Silk Road 2.0 was generating sales of at least approximately $8 million per month and had approximately 150,000 active users.&#8221;</p>
<div id="attachment_28623" style="width: 203px" class="wp-caption alignright"><a href="media/5b3c1b25.benthall-github.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/benthall-github.png"><img class="size-medium wp-image-28623" src="media/c0dc90dc.benthall-github-193x400.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/benthall-github-193x400.png" alt="Benthall's profile on Github." width="193" height="400" /></a><p class="wp-caption-text">Benthall&#8217;s profile on Github.</p></div>
<p>The complaint against Benthall claims that by October 17, 2014, Silk Road 2.0 had over 13,000 listings for controlled substances, including, among others, 1,783 listings for “Psychedelics,” 1,697 listings for “Ecstasy,” 1,707 listings for “Cannabis,” and 379 listings for “Opioids.” Apart from the drugs, Silk Road 2.0 also openly advertised fraudulent identification documents and computer-hacking tools and services. The government alleges that in October 2014, the Silk Road 2.0 was generating at least approximately $8 million in monthly sales and at least $400,000 in monthly commissions.</p>
<p>The complaint describes how federal agents infiltrated Silk Road 2.0 from the very start, after an undercover agent working for Homeland Security investigators managed to infiltrate the support staff involved in the administration of the Silk Road 2.0 website.</p>
<p>&#8220;On or about October 7, 2013, the HSI-UC [the Homeland Security Investigations undercover agent] was invited to join a newly created discussion forum on the Tor network, concerning the potential creation of a replacement for the Silk Road 1.0 website,&#8221; the complaint recounts. &#8220;The next day, on or about October 8, 2013, the persons operating the forum gave the HSI‐UC moderator privileges, enabling the HSI‐UC to access areas of the forum available only to forum staff. The forum would later become the discussion forum associated with the Silk Road 2.0 website.&#8221;</p>
<p>The complaint also explains how the feds located <em>and copied data from</em> the Silk Road 2.0 servers. &#8220;In May 2014, the FBI identified a server located in a foreign country that was believed to be hosting the Silk Road 2.0 website at the time. On or about May 30, 2014, law enforcement personnel from that country imaged the Silk Road 2.0 Server and conducted a forensic analysis of it. Based on posts made to the SR2 Forum, complaining of service outages at the time the imaging was conducted, I know that once the Silk Road 2.0 server was taken offline for imaging, the Silk Road 2.0 website went offline as well, thus confirming that the server was used to host the Silk Road 2.0 website.&#8221;<span id="more-28608"></span></p>
<p>The government&#8217;s documents detail how Benthall allegedly hatched a selfless plan to help the Silk Road 2.0 community recover from an incident in February 2014, wherein <a title="http://www.forbes.com/sites/andygreenberg/2014/02/13/silk-road-2-0-hacked-using-bitcoin-bug-all-its-funds-stolen/" href="http://www.forbes.com/sites/andygreenberg/2014/02/13/silk-road-2-0-hacked-using-bitcoin-bug-all-its-funds-stolen/" target="_blank">thieves stole millions of dollars worth of Bitcoins</a> from community users.</p>
<blockquote><p><span id=":1f2" dir="ltr">&#8220;On or about September 11, 2014, Defcon had an online conversation with the HSI-UC, in which he discussed, in sum and substance, his intention to reopen the Silk Road 2.0 marketplace, and his plan to recoup the deficit of Bitcoins that had been stolen from Silk Road 2.0. Specifically, Defcon confirmed that the site needed to recoup approximately 2,900 Bitcoins to cover the loss, and stated that he intended to donate approximately 1,000 of his own Bitcoins to return liquidity to Silk Road 2.0 (“I’m planning to throw my 1000 BTC to kickstart the thing.”).&#8221;</span></p>
<p><span id=":1f2" dir="ltr">&#8220;Defcon further acknowledged that the site had approximately 150,000 monthly active users (“We have 150,000 monthly active users. That&#8217;s why we have to save this thing.”). The HSI‐UC asked how long it would take to recover from the theft, and Defcon replied that it would take approximately three months’ worth of commission payments, if sales on Silk Road 2.0 continued at a steady rate (“Three months if sales continue at current pace and we don’t bottom out”). Thus, Defcon appears to have expected Silk Road 2.0 to generate approximately $6 million in monthly sales over the next three months, which would have resulted in commissions over that three‐month period totaling approximately $900,000 ‐ equal to approximately 1,900 Bitcoins at the then prevailing exchange rate.</span>&#8220;</p></blockquote>
<p>Benthall&#8217;s biggest mistake may have been using his own personal email to register the servers used for the Silk Road 2.0 marketplace. In the complaint against Benthall, an undercover agent who worked the case said that &#8220;based on a review of records provided by the service provider for the Silk Road 2.0 Server, I have discovered that the server was controlled and maintained during the relevant time by an individual using the email account blake@benthall.net.&#8221;</p>
<p>&#8220;To me, it appears that both the human element, an undercover agent, plus technical attacks in discovering the hidden service, both played a key part in this arrest,&#8221; said Nicholas Weaver, a researcher at the <strong>International Computer Science Institute</strong> (ICSI) and at the <strong>University of California, Berkeley.</strong></p>
<p>Federal agents also say they tracked Benthall administering the Silk Road 2.0 from his own computer, and using Bitcoin exchanges to make large cash withdrawals. In one instance, he allegedly cashed out $270,000, and used $70,000 for a down payment on <a title="http://www.teslamotors.com/models" href="http://www.teslamotors.com/models" target="_blank">a Tesla Model S</a>, a luxury electric car worth approximately USD $127,000.</p>
<p>Benthall faces a raft of serious charges that could send him to federal prison for life. He is facing one count of conspiring to commit narcotics trafficking, which carries a maximum sentence of life in prison and a mandatory minimum sentence of 10 years in prison; one count of conspiring to commit computer hacking, which carries a maximum sentence of five years in prison; one count of conspiring to traffic in fraudulent identification documents, which carries a maximum sentence of 15 years in prison; and one count of money laundering conspiracy, which carries a maximum sentence of 20 years in prison.</p>
<p>A copy of the complaint against Benthall is available <a title="http://www.scribd.com/doc/245744857/Blake-Benthall-Criminal-Complaint" href="http://www.scribd.com/doc/245744857/Blake-Benthall-Criminal-Complaint" target="_blank">here</a>.</p>
<p><strong>Update, Nov 7, 9:01 a.m. ET: The National Crime Agency</strong> in the United Kingdom is reporting that the demise of Silk Road 2.0 was part of a much larger operation targeting more than 400 &#8220;dark web&#8221; sites. From their press release:</p>
<p>&#8220;The six people arrested on suspicion of being concerned in the supply of controlled drugs were a 20-year-old man from Liverpool city centre, a 19-year-old man from New Waltham, Lincolnshire; a 30-year-old man from Cleethorpes; a 29-year-old man from Aberdovey, Wales; a 58-year-old man from Aberdovey, Wales; and a 58-year-old woman from Aberdovey, Wales. All six were interviewed and have been bailed pending further enquiries.&#8221; Read more <a title="http://www.nationalcrimeagency.gov.uk/news/news-listings/483-international-law-enforcement-deals-major-blow-to-dark-web-markets" href="http://www.nationalcrimeagency.gov.uk/news/news-listings/483-international-law-enforcement-deals-major-blow-to-dark-web-markets" target="_blank">here</a>.</p>


feed_id: http://krebsonsecurity.com/?p=28811
title: Adobe Pushes Critical Flash Patch
uri: Adobe-Pushes-Critical-Flash-Patch
url: http://krebsonsecurity.com/2014/11/adobe-pushes-critical-flash-patch/
content:
<p>For the second time this month, <strong>Adobe</strong> has issued a security update for its <strong>Flash Player</strong> software. New versions are available for <strong>Windows</strong>, <strong>Mac</strong> and <strong>Linux</strong> versions of Flash. The patch provides additional protection on a vulnerability that Adobe fixed earlier this year for which attackers appear to have devised unique and active exploits.</p>
<p><a href="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png"><img class="alignright  wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="190" height="162" /></a>Adobe recommends users of the Adobe Flash Player desktop runtime for Windows and Macintosh update to <em>v. 15.0.0.239</em> by visiting the Adobe Flash Player Download Center, or via the update mechanism within the product when prompted. Adobe Flash Player for Linux has been updated to <em>v. 11.2.202.424. </em></p>
<p>According to Adobe, these updates provide additional hardening against CVE-2014-8439, which was fixed in a Flash patch that the company released in <a title="http://helpx.adobe.com/security/products/flash-player/apsb14-22.html" href="http://helpx.adobe.com/security/products/flash-player/apsb14-22.html" target="_blank">October 2014</a>. The bulletin for this update is <a title="http://helpx.adobe.com/security/products/flash-player/apsb14-26.html" href="http://helpx.adobe.com/security/products/flash-player/apsb14-26.html" target="_blank">here</a>. Finnish security firm <strong>F-Secure</strong> <a title="https://www.f-secure.com/weblog/archives/00002768.html" href="https://www.f-secure.com/weblog/archives/00002768.html" target="_blank">says</a> it reported the flaw to Adobe after receiving information from independent researcher <a title="http://malware.dontneedcoffee.com/" href="http://malware.dontneedcoffee.com/" target="_blank">Kafeine</a> that indicated the vulnerability was being exploited in-the-wild by an exploit kit (malicious software designed to be stitched into hacked Web sites and foist malware on visitors via browser flaws like this one).<span id="more-28811"></span></p>
<p>To see which version of Flash you have installed, check <a title="https://www.adobe.com/software/flash/about/" href="https://www.adobe.com/software/flash/about/" target="_blank">this link</a>. IE10/IE11 on Windows 8.x and Chrome should auto-update their versions of Flash.</p>
<p>The most recent versions of Flash are available from the <a title="http://get.adobe.com/flashplayer/" href="http://get.adobe.com/flashplayer/" target="_blank">Flash home page</a>, but beware potentially unwanted add-ons, like McAfee Security Scan. To avoid this, uncheck the pre-checked box before downloading, or grab your OS-specific Flash download from <a title="http://www.adobe.com/products/flashplayer/distribution3.html" href="http://www.adobe.com/products/flashplayer/distribution3.html" target="_blank">here</a>.</p>
<p>Windows users who browse the Web with anything other than Internet Explorer may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>
<p><a href="media/bede1b97.adobeflash11-14.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/adobeflash11-14.png"><img class="aligncenter size-large wp-image-28814" src="media/338daccc.adobeflash11-14-600x189.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/adobeflash11-14-600x189.png" alt="adobeflash11-14" width="600" height="189" /></a></p>


feed_id: http://krebsonsecurity.com/?p=28816
title: Skimmer Innovation: ‘Wiretapping’ ATMs
uri: Skimmer-Innovation-Wiretapping-ATMs
url: http://krebsonsecurity.com/2014/11/skimmer-innovation-wiretapping-atms/
content:
<p>Banks in Europe are warning about the emergence of a rare, virtually invisible form of ATM skimmer involving a so-called &#8220;wiretapping&#8221; device that is inserted through a tiny hole cut in the cash machine&#8217;s front. The hole is covered up by a fake decal, and the thieves then use custom-made equipment to attach the device to ATM&#8217;s internal card reader.</p>
<p>According to the <a title="https://www.european-atm-security.eu/" href="https://www.european-atm-security.eu/" target="_blank">European ATM Security Team</a> (EAST), a nonprofit that represents banks in 29 countries, financial institutions in two countries recently reported ATM attacks in which the card data was compromised internally by &#8220;wire-tapping&#8221; or &#8220;eavesdropping&#8221; on the customer transaction. The image below shows some criminal equipment used to perpetrate these eavesdropping attacks.</p>
<div id="attachment_28817" style="width: 610px" class="wp-caption aligncenter"><a href="media/e5d64775.wiretapping.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/wiretapping.png"><img class="size-large wp-image-28817" src="media/5cd1bd0b.wiretapping-600x421.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/wiretapping-600x421.png" alt="Equipment used by crooks to conduct &quot;eavesdropping&quot; or &quot;wiretapping&quot; attacks on ATMs." width="600" height="421" /></a><p class="wp-caption-text">Equipment used by crooks to conduct &#8220;eavesdropping&#8221; or &#8220;wiretapping&#8221; attacks on ATMs. Source: EAST.</p></div>
<p>&#8220;The criminals cut a hole in the fascia around the card reader where the decal is situated,&#8221; EAST described in a recent, non-public report. &#8220;A device is then inserted and connected internally onto the card reader, and the hole covered with a fake decal&#8221;<br />
[pictured, bottom right].</p>
<p>Pictured above are what appear to be wires that are fed into the machine with some custom-made rods. It looks like the data is collected by removing the decal, fishing out the wire attached to the ATM&#8217;s card reader, and connecting it to a handheld data storage device.</p>
<p>I sought clarification from EAST about how the device works. Most skimmers are card slot overlay devices that work by using a built-in component which reads the account data off of the magnetic stripe when the customer inserts the card. But <strong>Lachlan Gunn</strong>, EAST&#8217;s executive director, suggested that this device intercepts the card data from the legitimate card reader on the inside of the ATM. He described the wiretapping device this way:</p>
<p>&#8220;It&#8217;s where a tap is attached to the pre-read head or read head of the card reader,&#8221; Lachlan said. &#8220;The card data is then read through the tap. We still classify it as skimming, but technically the magnetic stripe [on the customer/victim&#8217;s card] is not directly skimmed as the data is intercepted.&#8221;</p>
<p>The <a title="http://krebsonsecurity.com/2014/08/stealthy-razor-thin-atm-insert-skimmers/" href="http://krebsonsecurity.com/2014/08/stealthy-razor-thin-atm-insert-skimmers/" target="_blank">last report in my ATM skimming series</a> showcased some major innovations in so-called &#8220;insert skimmers,&#8221; card-skimming devices made to fix snugly and invisibly inside the throat of the card acceptance slot. EAST&#8217;s new report includes another, slightly more advanced, insert skimmer that&#8217;s being called an &#8220;insert transmitter skimmer.&#8221;</p>
<p>Like the one pictured below, an insert transmitter skimmer is made up of two steel plates and an internal battery that lasts approximately one to two weeks. &#8220;They do not store data, but transmit it directly to a receiving device &#8212; probably placed less than 1 meter from the ATM.<span id="more-28816"></span></p>
<div id="attachment_28818" style="width: 610px" class="wp-caption aligncenter"><a href="media/c21edb22.insertskim11-14.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/insertskim11-14.png"><img class="size-large wp-image-28818" src="media/21a4b4e3.insertskim11-14-600x279.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/insertskim11-14-600x279.png" alt="An insert transmitter skimmer. Source: EAST." width="600" height="279" /></a><p class="wp-caption-text">An insert transmitter skimmer. Source: EAST.</p></div>
<p>Both of these card skimming technologies rely on hidden cameras to steal customer PIN codes. In a typical skimming attack involving devices that lay directly on top of the card acceptance slot, the hidden camera is a pinhole spy cam that is embedded inside the card slot overlay and angled toward the PIN pad. Just as often, the camera is hidden in a false panel affixed directly above the PIN pan with the pinhole pointed downward.</p>
<p>According to east, the use of false sidebar panels is becoming more prevalent (see image below for an example). It is not unusual for hidden cameras to be <a title="http://krebsonsecurity.com/wp-content/uploads/2010/01/lmpinhole.jpg" href="media/9e6239cd.lmpinhole.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2010/01/lmpinhole.jpg" target="_blank">obscured inside of phony brochure racks as well</a>.</p>
<p><a href="media/15f3e0eb.sidepanels.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/sidepanels.png"><img class="aligncenter size-full wp-image-28825" src="media/15f3e0eb.sidepanels.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/sidepanels.png" alt="sidepanels" width="551" height="750" /></a></p>
<p>As this and <a title="http://krebsonsecurity.com/2014/07/the-rise-of-thin-mini-and-insert-skimmers/" href="http://krebsonsecurity.com/2014/07/the-rise-of-thin-mini-and-insert-skimmers/" target="_blank">other insert skimmer attacks</a> show, it’s getting tougher to spot ATM skimming devices. It’s best to focus instead on protecting your own physical security while at the cash machine. If you visit an ATM that looks strange, tampered with, or out of place, try to find another ATM. Use only machines in public, well-lit areas, and avoid ATMs in secluded spots.</p>
<p>Last, but certainly not least, cover the PIN pad with your hand when entering your PIN: That way, if even if the thieves somehow skim your card, there is less chance that they will be able to snag your PIN as well. You’d be amazed at <a title="http://krebsonsecurity.com/2012/09/a-handy-way-to-foil-atm-skimmer-scams/" href="http://krebsonsecurity.com/2012/09/a-handy-way-to-foil-atm-skimmer-scams/" target="_blank">how many people fail to take this basic precaution</a>. Yes, there is still a chance that thieves could use a PIN-pad overlay device to capture your PIN, but in my experience these are far less common than hidden cameras (and quite a bit more costly for thieves who aren’t making their own skimmers).</p>
<p><center><iframe src="//www.youtube.com/embed/JbDdsUh_sTg" width="420" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></center>Are you as fascinated by ATM skimmers as I am? Check out my series on this topic, <a title="http://krebsonsecurity.com/all-about-skimmers/" href="http://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers</a>.</p>


feed_id: http://krebsonsecurity.com/?p=28841
title: Black Friday, Cyber Monday for Crooks, Too!
uri: Black-Friday-Cyber-Monday-for-Crooks-Too
url: http://krebsonsecurity.com/2014/11/black-friday-cyber-monday-for-crooks-too/
content:
<p>Underground cybercrime shops that sell credit and debit card accounts stolen from retailers are slashing prices and promoting their own Black Friday and Cyber Monday sales as fraudsters gear up for the busy holiday shopping season.</p>
<p>Card data stolen from main street retailers, a.k.a. &#8220;dumps,&#8221; is sold to crooks who encode the numbers onto new plastic and go shopping for high-priced electronics and gift cards at big box stores. Other shops sell mainly stolen card numbers, expiration dates and card security codes that can only be used to shop at online retailers. </p>
<p>Have a look at the slide show below, which features multiple advertisements pushed out by some of the most bustling crime shops competing for buyers with discounts and promotions. You might have to scroll down a bit to see the slideshow. Advance the slides by hovering over the right edge of the image and clicking the arrow that appears.</p>
<p><iframe src='http://cdn.knightlab.com/libs/timeline/latest/embed/index.html?source=0Au2brCFyl25KdHh3YkNQbElOeWhza0RPdmllc3RlS2c&#038;font=Bevan-PotanoSans&#038;maptype=toner&#038;lang=en&#038;start_zoom_adjust=10&#038;height=900' width='100%' height='900' frameborder='0'></iframe></p>
<p>It&#8217;s nearly impossible for consumers to tell how secure a main street or online merchant is, so it&#8217;s best just to shop as if they&#8217;re all compromised. That is, if you have the choice between using a credit or debit card, shop with your credit card. <span id="more-28841"></span></p>
<p>Sure, the card associations and your bank will be quick to point out that you&#8217;re not liable for fraudulent charges that you report in a timely manner, but this assurance rings hollow for many who find their checking accounts emptied by card thieves after shopping at a breached merchant with a debit card. Who pays for the fees levied against you by different merchants when your checks bounce? You do. Does the bank reimburse you when your credit score takes a ding because your mortgage or car payment was late? Don&#8217;t hold your breath.</p>
<p>Also, if you&#8217;re shopping online this holiday season, be wary of phantom stores. If you don’t know much about the seller that has the item you want to buy, take a few minutes to investigate its online reputation. It’s not uncommon for bargain basement, phantom Web sites to materialize during the holiday season and vanish forever not long afterward. If you’re buying merchandise from an online store that is brand new, the risk that you will get scammed increases significantly. But how do you know the lifespan of a site selling that must-have gadget at the lowest price? One easy way to get a quick idea is to run <a href="http://whois.domaintools.com/krebsonsecurity.com" title="http://whois.domaintools.com/krebsonsecurity.com">a basic WHOIS search</a> on the site’s domain name. The more recent the site&#8217;s &#8220;creation date,&#8221; the more likely it is a phantom store.</p>
<p>Be careful what you agree to: Check to make sure you know how long the item will take to be shipped, and that you understand the store’s return policies. Also, keep an eye out for hidden surcharges, and be wary of blithely clicking “ok” during the checkout process. </p>


feed_id: http://krebsonsecurity.com/?p=28872
title: KrebsOnSecurity on CBS’s ’60 Minutes’
uri: KrebsOnSecurity-on-CBS-s-60-Minutes
url: http://krebsonsecurity.com/2014/12/krebsonsecurity-on-cbss-60-minutes/
content:
<p>In case any of you loyal readers missed it, <strong>KrebsOnSecurity.com</strong> and its author were featured in a<em> 60 Minutes</em> interview last night on the credit and debit card breaches that have hit countless retailers and consumers over the past year.</p>
<p><a href="media/e1058b83.60mk.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/60mk.png"><img class="aligncenter size-large wp-image-28873" src="media/33146643.60mk-600x343.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/60mk-600x343.png" alt="60mk" width="600" height="343" /></a></p>
<p>I spent more than a dozen hours with 60 Minutes producers, film crews and the host of this segment &#8212; CBS&#8217;s <a title="http://www.cbsnews.com/team/bill-whitaker/" href="http://www.cbsnews.com/team/bill-whitaker/" target="_blank">Bill Whitaker</a>, so I&#8217;m glad they were able to use as much footage as they did. Leading up to the filming, the producer of the show asked some very incisive questions &#8212; some of which I didn&#8217;t know the answers to myself &#8212; and I was hoping the segment would address some of the less discussed issues that contribute to this epidemic of card breaches. But, alas, I hope to explore some of those questions in future posts.</p>
<p>A link to a video and transcript of the program is <a title="http://www.cbsnews.com/news/swiping-your-credit-card-and-hacking-and-cybercrime/" href="http://www.cbsnews.com/news/swiping-your-credit-card-and-hacking-and-cybercrime/" target="_blank">here</a>.<span id="more-28872"></span></p>
<p>Much of the segment was shot in a nearby hotel. The rest of it was filmed right in my living room. The 60 Minutes crew had so much camera, sound and lighting gear set up in that room that they actually had to put a ton of other equipment in our kitchen (see the admittedly blurry picture below).</p>
<div id="attachment_28874" style="width: 610px" class="wp-caption aligncenter"><a href="media/b898b9c0.60mcrew.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/60mcrew.jpg"><img class="size-large wp-image-28874" src="media/0c5e96fe.60mcrew-600x800.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/60mcrew-600x800.jpg" alt="Film crew working for CBS, in my kitchen." width="600" height="800" /></a><p class="wp-caption-text">Film crew working for CBS, in my kitchen.</p></div>


feed_id: http://krebsonsecurity.com/?p=28882
title: Sony Breach May Have Exposed Employee Healthcare, Salary Data
uri: Sony-Breach-May-Have-Exposed-Employee-Healthcare-Salary-Data
url: http://krebsonsecurity.com/2014/12/sony-breach-may-have-exposed-employee-healthcare-salary-data/
content:
<p>The recent hacker break-in at <strong>Sony Pictures Entertainment</strong> appears to have involved the theft of far more than unreleased motion pictures: According to multiple sources, the intruders also stole more than 25 gigabytes of sensitive data on tens of thousands of Sony employees, including Social Security numbers, medical and salary information. What&#8217;s more, it&#8217;s beginning to look like the attackers may have destroyed data on an unknown number of internal Sony systems. </p>
<div id="attachment_28884" style="width: 295px" class="wp-caption alignright"><a class="lightbox" href="media/90c8450b.pwc-sony.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/pwc-sony.png"><img class="size-medium wp-image-28884" src="media/3d7836a2.pwc-sony-285x185.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/pwc-sony-285x185.png" alt="Screen shot from an internal audit report allegedly stolen from Sony." width="285" height="185" /></a><p class="wp-caption-text">Screen shot from an internal audit report allegedly stolen from Sony and circulating on file-trading networks.</p></div>
<p>Several files being traded on torrent networks seen by this author include a global Sony employee list, a Microsoft Excel file that includes the name, location, employee ID, network username, base salary and date of birth for more than 6,800 individuals.</p>
<p>Sony officials could not be immediately reached for comment; a press hotline for the company rang for several minutes without answer, and email requests to the company went unanswered.  But a comprehensive search on <strong>LinkedIn</strong> for dozens of the names in the list indicate virtually all correspond to current or former Sony employees.</p>
<p>Another file being traded online appears to be a status report from April 2014 listing the names, dates of birth, SSNs and health savings account data on more than 700 Sony employees. Yet another apparently purloined file&#8217;s name suggests it was the product of an internal audit from accounting firm <strong>Pricewaterhouse Coopers</strong>, and includes screen shots of dozens of employee federal tax records and other compensation data.</p>
<p>The latest revelations come more than a week after a cyberattack on Sony Pictures Entertainment brought down the company&#8217;s corporate email systems. A Sony spokesperson <a title="http://www.reuters.com/article/2014/12/02/us-sony-cybersecurity-malware-idUSKCN0JF3FE20141202" href="http://www.reuters.com/article/2014/12/02/us-sony-cybersecurity-malware-idUSKCN0JF3FE20141202" target="_blank">told Reuters</a> that the company has since &#8220;restored a number of important services&#8221; and was &#8220;working closely with law enforcement officials to investigate the matter.&#8221;</p>
<div id="attachment_28892" style="width: 295px" class="wp-caption alignleft"><a class="lightbox" href="media/450e8a2f.filesfromsony.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/filesfromsony.png"><img class="size-medium wp-image-28892" src="media/54ff0953.filesfromsony-285x386.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/filesfromsony-285x386.png" alt="Some of the files apparently taken from Sony that are now being traded on file-sharing networks." width="285" height="386" /></a><p class="wp-caption-text">Some of the files apparently taken from Sony that are now being traded on file-sharing networks.</p></div>
<p>Several media outlets reported at the time that Sony employees had been <a title="https://twitter.com/JamesDeanTimes/status/538253074876612608" href="https://twitter.com/JamesDeanTimes/status/538253074876612608" target="_blank">warned</a> not to connect to the company&#8217;s corporate network or to check email, and noted that Sony&#8217;s IT departments had instructed employees to turn off their computers as well as disable Wi-Fi on all mobile devices.&#8221; Other reports cited unnamed investigators pointing to North Korean hackers as the source of the attack, although those reports could not be independently confirmed.</p>
<p>Such extreme precautions would make sense if the company&#8217;s network was faced with a cyber threat designed to methodically destroy files on corporate computers. Indeed, the FBI this week released a restricted &#8220;Flash Alert&#8221; warning of just such a threat, about an unnamed attack group that has been using malware designed to wipe computer hard drives &#8212; and the underlying &#8220;<a title="http://en.wikipedia.org/wiki/Master_boot_record" href="http://en.wikipedia.org/wiki/Master_boot_record" target="_blank">master boot record</a>&#8221; (MBR) on the affected systems &#8212; of all data.</p>
<p>KrebsOnSecurity obtained a copy of the alert, which includes several file names and hashes (long strings of letters and numbers that uniquely identify files) corresponding to the file-wiping malware. The FBI does not specify where the malware was found or against whom it might have been used, noting only that &#8220;the FBI has high confidence that these indicators are being used by CNE [computer network exploitation] operators for further network exploitation.&#8221; The report also says the language pack referenced by the malicious files is Korean.</p>
<p><span id="more-28882"></span></p>
<p>The FBI alert references several network traffic &#8220;signatures&#8221; that organizations can use to detect the traffic seen in previous attacks from this malware &#8212; traffic that appears to beacon back to (most likely compromised) systems in Thailand, Poland and Italy. But the alert also says this type of vigilance may only serve to let organizations know that their files are currently in the process of being deleted.</p>
<p>&#8220;The following <a title="http://en.wikipedia.org/wiki/Snort_%28software%29" href="http://en.wikipedia.org/wiki/Snort_%28software%29" target="_blank">Snort</a> signature can be used to detect the beacon traffic, though by the time the beacons occur, the destructive process of wiping the files has begun,&#8221; the alert warned.</p>
<p>Here&#8217;s the Snort signature, in case this is useful for any readers who didn&#8217;t get this memo:</p>
<p>Alert tcp any any &#8211; &gt; [88.53.215.64, 217.96.33.164, 203.131.222.102] [8080, 8000] (msg: “wiper_callout”;<br />
dsize:42;  content:  “|ff  ff  ff  ff|”;  offset:  26;  depth:  4;  sid:  314;</p>
<p><strong>Update: 1:58 p.m. ET:</strong> Multiple sources are reporting that the links to the torrents for the stolen Sony internal data were posted on Pastebin late Monday morning. Less than an hour after that post went live, the individual hosts that were sharing copies of the Sony data came under sustained denial-of-service attacks apparently aimed at keeping the files from being shared with other torrent users.</p>
<p>Also, the security guys over at Packetninjas have posted <a title="http://logfile.packetninjas.net/related-malware-to-sony-breach/" href="http://logfile.packetninjas.net/related-malware-to-sony-breach/" target="_blank">a useful write-up</a> on a malware sample they spotted from early July 2014 that matches the file name of the malware described in the FBI&#8217;s Flash alert about the file-wiping malware. Packetninjas notes that the file also was calling home to the same control server in Thailand that was documented in this week&#8217;s FBI alert.</p>
<p><a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/tree.txt" href="http://krebsonsecurity.com/wp-content/uploads/2014/12/tree.txt" target="_blank">This file directory tree</a>, included in the leaked data, offers a glimpse into the sheer volume of files apparently compromised in this breach.</p>
<p>This is a developing story. More to come. Stay tuned.</p>


feed_id: http://krebsonsecurity.com/?p=28907
title: Be Wary of ‘Order Confirmation’ Emails
uri: Be-Wary-of-Order-Confirmation-Emails
url: http://krebsonsecurity.com/2014/12/be-wary-of-order-confirmation-emails/
content:
<p>If you receive an email this holiday season asking you to &#8220;confirm&#8221; an online e-commerce order or package shipment, please resist the urge to click the included link or attachment: Malware purveyors and spammers are blasting these missives by the millions each day in a bid to trick people into giving up control over their computers and identities.</p>
<div id="attachment_28909" style="width: 610px" class="wp-caption aligncenter"><a href="media/93999e61.hd-asprox.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/hd-asprox.png"><img class="size-large wp-image-28909" src="media/0ba1147f.hd-asprox-600x273.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/hd-asprox-600x273.png" alt="An &quot;order confirmation&quot; malware email blasted out by the Asprox spam botnet recently. " width="600" height="273" /></a><p class="wp-caption-text">An &#8220;order confirmation&#8221; malware email blasted out by the Asprox spam botnet recently.</p></div>
<p>Seasonal scams like these are a perennial scourge of the holidays, mainly because the methods they employ are reliably successful. Crooks understand that it&#8217;s easier to catch would-be victims off-guard during the holidays. This goes even for people who generally know better than to click on links and attachments in emails that spoof trusted brands and retailers, because this is a time of year when many people are intensely focused on making sure their online orders arrive before Dec. 25.</p>
<div id="attachment_28910" style="width: 610px" class="wp-caption aligncenter"><a href="media/328c35ae.wm-asprox.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/wm-asprox.png"><img class="size-large wp-image-28910" src="media/ceea239f.wm-asprox-600x308.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/wm-asprox-600x308.png" alt="This Asprox malware email poses as a notice about a wayward package from a WalMart  order." width="600" height="308" /></a><p class="wp-caption-text">This Asprox malware email poses as a notice about a wayward package from a WalMart order.</p></div>
<p>According to <a title="http://www.malcovery.com" href="http://www.malcovery.com" target="_blank">Malcovery</a>, a company that closely tracks email-based malware attacks, these phony &#8220;order confirmation&#8221; spam campaigns began around Thanksgiving, and use both booby-trapped links and attached files in a bid to infect recipients&#8217; Windows PCs with the malware that powers the <strong>Asprox spam botnet</strong>.<span id="more-28907"></span></p>
<p>Asprox is a nasty Trojan that harvests email credentials and other passwords from infected machines, turns the host into a zombie for relaying junk email (such as the pharmaceutical spam detailed in <a title="http://krebsonsecurity.com/2014/07/pre-order-your-copy-of-spam-nation-now/" href="http://krebsonsecurity.com/2014/07/pre-order-your-copy-of-spam-nation-now/" target="_blank">my new book Spam Nation</a>), and perpetuates additional Asprox malware attacks. Asprox also deploys a scanning module that forces hacked PCs to scan websites for vulnerabilities that can be used to hack the sites and foist malware on visitors to that site. For an exhaustive and fairly recent analysis of Asprox, see <a title="http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-asprox-reborn.pdf" href="media/84fbc6d5.wp-asprox-reborn.pdf" data-original-source="http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-asprox-reborn.pdf" target="_blank">this writeup</a> (PDF) from <strong>Trend Micro</strong>.</p>
<div id="attachment_28911" style="width: 610px" class="wp-caption aligncenter"><a href="media/f5717644.tg-asprox.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/tg-asprox.png"><img class="size-large wp-image-28911" src="media/8b0b3d56.tg-asprox-600x373.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/tg-asprox-600x373.png" alt="Target is among the many brands being spoofed by Asprox this holiday season." width="600" height="373" /></a><p class="wp-caption-text">Target is among the many brands being spoofed by Asprox this holiday season.</p></div>
<p>Malcovery notes that the Asprox spam emails use a variety of subject lines, including &#8220;Acknowledgment of Order,&#8221; &#8220;Order Confirmation,&#8221; &#8220;Order Status,&#8221; &#8220;Thank you for buying from [insert merchant name here]&#8221;, and a &#8220;Thank you for your order.&#8221;</p>
<p>If you receive an email from a recognized brand that references an issue with an online or in-store order and you think it might be legitimate, <em>do not click the embedded links or attachment</em>. Instead, open up a Web browser and visit the merchant site in question. Generally speaking, legitimate communications about order issues will reference an order number and/or some other data points specific to the transaction &#8212; information that can be used to look up the order status at the merchant&#8217;s Web site. I know I&#8217;m probably preaching to the choir for the loyal readers of this site, but I&#8217;m sure most of you have friends and relatives who could use a reminder about all of this. Please feel free to forward them a link to this story.</p>
<div id="attachment_28918" style="width: 610px" class="wp-caption aligncenter"><a href="media/5017e869.cc-asprox.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/cc-asprox.png"><img class="size-large wp-image-28918" src="media/663fbe3e.cc-asprox-600x300.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/cc-asprox-600x300.png" alt="Image: Malcovery" width="600" height="300" /></a><p class="wp-caption-text">Image: Malcovery</p></div>


feed_id: http://krebsonsecurity.com/?p=28924
title: Banks: Credit Card Breach at Bebe Stores
uri: Banks-Credit-Card-Breach-at-Bebe-Stores
url: http://krebsonsecurity.com/2014/12/banks-credit-card-breach-at-bebe-stores/
content:
<p>Data gathered from several financial institutions and at least one underground cybercrime shop suggest that thieves have stolen credit and debit card data from <strong>Bebe Stores Inc.</strong>, a nationwide chain of some 200 women&#8217;s clothing stores.</p>
<div id="attachment_28933" style="width: 295px" class="wp-caption alignright"><a class="lightbox" href="media/c5e8632f.bebewiki.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/bebewiki.png"><img src="media/e10e41f3.bebewiki-285x212.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/bebewiki-285x212.png" alt="Image: Wikipedia." width="285" height="212" class="size-medium wp-image-28933" /></a><p class="wp-caption-text">Image: Wikipedia.</p></div>
<p>Earlier this week, KrebsOnSecurity began hearing from different banks about a pattern of fraudulent charges on customer credit cards that all had one thing in common: the cards were recently used at Bebe (pronounced &#8220;bee bee&#8221;) locations across the country.</p>
<p>This author reached out to Bebe via email and phone early Wednesday. Officials from Bebe Stores have not yet responded to requests for comment.</p>
<p>On Wednesday, this author heard from an East Coast bank which had purchased several of its customers cards that were being sold on a relatively new cybercrime shop called (<strong>goodshop[dot]bz]</strong>). The bank acquired cards from a batch that Goodshop released on Dec. 1, called &#8220;Happy Winter Update.&#8221; The prices from that Happy Winter batch range from $10 to $27 per card.</p>
<p>The bank found that all of the cards had been used at Bebe Stores in the United States between Nov. 18 and Nov. 28. It is not clear if the breach at Bebe stores is ongoing, or if it extends prior to mid-November 2014. </p>
<div id="attachment_28930" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/73ba8d50.goodshophappywinter.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/goodshophappywinter.png"><img class="size-large wp-image-28930" src="media/4c1fc7ba.goodshophappywinter-600x356.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/goodshophappywinter-600x356.png" alt="The card fraud shop &quot;goodshop[dot]bz&quot; is selling thousands of cards in its &quot;Happy Winter Update.&quot;" width="600" height="356" /></a><p class="wp-caption-text">The card fraud shop &#8220;goodshop[dot]bz&#8221; is selling thousands of cards in its &#8220;Happy Winter Update.&#8221;</p></div>
<p><span id="more-28924"></span></p>
<p>There is no data to suggest that the apparent card breach at Bebe extends to the company&#8217;s online store. The items for sale at Goodshop are not cards, per se, but instead data copied from the magnetic stripe on the backs of credit cards. Armed with this information, thieves can re-encode the data onto new plastic and then use the counterfeit cards to buy high-priced items at big box stores, goods that can be quickly resold for cash (think iPads and gift cards, for example).</p>
<p>The most common way that thieves steal this type of card data is by hacking into cash registers at retail locations and planting malicious software that surreptitiously records mag stripe data when cards are swiped through the machines. The breaches at Home Depot, Target, Neiman Marcus, Michaels and other break-ins first detailed on this blog were all powered by malware that thieves planted on point-of-sale systems. </p>


feed_id: http://krebsonsecurity.com/?p=28951
title: Treasury Dept: Tor a Big Source of Bank Fraud
uri: Treasury-Dept-Tor-a-Big-Source-of-Bank-Fraud
url: http://krebsonsecurity.com/2014/12/treasury-dept-tor-a-big-source-of-bank-fraud/
content:
<p>A new report from the <strong>U.S. Treasury Department</strong> found that a majority of bank account takeovers by cyberthieves over the past decade might have been thwarted had affected institutions known to look for and block transactions coming through <a title="https://www.torproject.org/" href="https://www.torproject.org/" target="_blank">Tor</a>, a global communications network that helps users maintain anonymity by obfuscating their true location online.</p>
<p>The findings come in a non-public report obtained by KrebsOnSecurity that was produced by the <a title="http://en.wikipedia.org/wiki/Financial_Crimes_Enforcement_Network" href="http://en.wikipedia.org/wiki/Financial_Crimes_Enforcement_Network" target="_blank">Financial Crimes Enforcement Network</a> (FinCEN), a Treasury Department bureau responsible for collecting and analyzing data about financial transactions to combat domestic and international money laundering, terrorist financing and other financial crimes.</p>
<p>In the report, released on Dec. 2, 2014, FinCEN said it examined some 6,048 suspicious activity reports (SARs) filed by banks between August 2001 and July 2014, searching the reports for those involving one of more than 6,000 known Tor network nodes. Investigators found 975 hits corresponding to reports totaling nearly $24 million in likely fraudulent activity.</p>
<p>&#8220;Analysis of these documents found that few filers were aware of the connection to Tor, that the bulk of these filings were related to cybercrime, and that Tor related filings were rapidly rising,&#8221; the report concluded. &#8220;Our BSA [<a title="http://www.fincen.gov/statutes_regs/bsa/" href="http://www.fincen.gov/statutes_regs/bsa/" target="_blank">Bank Secrecy Act</a>] analysis of 6,048 IP addresses associated with the Tor <a title="http://en.wikipedia.org/wiki/Darknet_(file_sharing)" href="http://en.wikipedia.org/wiki/Darknet_(file_sharing)" target="_blank">darknet</a> [link added] found that in the majority of the SAR filings, the underlying suspicious activity &#8212; most frequently account takeovers &#8212; might have been prevented if the filing institution had been aware that their network was being accessed via Tor IP addresses.&#8221;</p>
<div id="attachment_28952" style="width: 610px" class="wp-caption aligncenter"><a href="media/09d1c675.fincen-bsa.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/fincen-bsa.png"><img class="size-large wp-image-28952" src="media/b4edd0bd.fincen-bsa-600x541.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/fincen-bsa-600x541.png" alt="Tables from the FinCEN report." width="600" height="541" /></a><p class="wp-caption-text">Tables from the FinCEN report.</p></div>
<p>FinCEN said it was clear from the SAR filings that most financial institutions were unaware that the IP address where the suspected fraudulent activity occurred was in fact a Tor node.</p>
<p>&#8220;Our analysis of the type of suspicious activity indicates that a majority of the SARs were filed for account takeover or identity theft,&#8221; the report noted. &#8220;In addition, analysis of the SARs filed with the designation &#8216;Other revealed that most were filed for &#8216;Account Takeover,&#8217; and at least five additional SARs were filed incorrectly and should have been &#8216;Account Takeover.'&#8221;</p>
<p>The government also notes that there has been a fairly recent and rapid rise in the number of SAR filings over the last year involving bank fraud tied to Tor nodes.</p>
<p>&#8220;From October 2007 to March 2013, filings increased by 50 percent,&#8221; the report observed. &#8220;During the most recent period &#8212; March 1, 2013 to July 11, 2014 &#8212; filings rose 100 percent.&#8221;<span id="more-28951"></span></p>
<p>While banks may be able to detect and block more fraudulent transactions by paying closer attention to or outright barring traffic from Tor nodes, such an approach is unlikely to have a lasting impact on fraud, said <strong>Nicholas Weaver</strong>, a researcher at the <strong>International Computer Science Institute</strong> (ICSI) and at the <strong>University of California, Berkeley</strong>.</p>
<p>&#8220;I’m not surprised by this: Tor is easy for bad actors to use to isolate their identity,&#8221; Weaver said &#8220;Yet blocking all Tor will do little good, because there are many other easy ways for attackers to hide their source address.&#8221;</p>
<p>Earlier this summer, the folks who maintain the Tor Project identified this problem &#8212; that many sites and even ISPs are increasingly blocking Tor traffic because of its abuse by fraudsters &#8212; as an existential threat to the anonymity network. The organization used this trend as<a title="https://blog.torproject.org/blog/call-arms-helping-internet-services-accept-anonymous-users" href="https://blog.torproject.org/blog/call-arms-helping-internet-services-accept-anonymous-users" target="_blank"> a rallying cry</a> for Tor users to consider lending their brainpower to help the network thrive in spite of these threats.</p>
<p>&#8220;<span class="pullquote pqright">A growing number of websites treat users from anonymity services differently Slashdot doesn&#8217;t let you post comments over Tor, Wikipedia won&#8217;t let you edit over Tor</span>, and Google sometimes gives you a captcha when you try to search (depending on what other activity they&#8217;ve seen from that exit relay lately),&#8221; wrote Tor Project Leader <strong>Roger Dingledine</strong>. &#8220;Some sites like Yelp go further and refuse to even serve pages to Tor users.&#8221;</p>
<p>Dingledine continued:</p>
<p>&#8220;The result is that the Internet as we know it is siloing. Each website operator works by itself to figure out how to handle anonymous users, and generally neither side is happy with the solution. The problem isn&#8217;t limited to just Tor users, since these websites face basically the same issue with users from open proxies, users from AOL, users from Africa, etc.</p>
<p>Weaver said the problem of high volumes of fraudulent activity coming through the Tor Network presents something of a no-win situation for any website dealing with Tor users.</p>
<p>&#8220;If you treat Tor as hostile, you cause collateral damage to real users, while the scum use many easy workarounds.  If you treat Tor as benign, the scum come flowing through,&#8221; Weaver said. &#8220;For some sites, such as Wikipedia, there is perhaps a middle ground. But for banks? That&#8217;s another story.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=28945
title: Bebe Stores Confirms Credit Card Breach
uri: Bebe-Stores-Confirms-Credit-Card-Breach
url: http://krebsonsecurity.com/2014/12/bebe-stores-confirms-credit-card-breach/
content:
<p>In a statement released this morning, women&#8217;s clothier chain <strong>bebe stores inc.</strong> confirmed news first reported on this blog Thursday: That hackers had stolen customer card data from stores across the country in a breach that persisted for several weeks last month.</p>
<div id="attachment_28933" style="width: 295px" class="wp-caption alignright"><a href="media/c5e8632f.bebewiki.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/bebewiki.png"><img class="size-medium wp-image-28933" src="media/e10e41f3.bebewiki-285x212.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/bebewiki-285x212.png" alt="Image: Wikipedia." width="285" height="212" /></a><p class="wp-caption-text">Image: Wikipedia.</p></div>
<p>Bebe stores said its investigation indicates that the breach impacted payment cards swiped in its U.S., Puerto Rico and U.S. Virgin Islands stores between Nov. 8, 2014 and Nov. 26, 2014. The data may have included cardholder name, account number, expiration date, and verification code.</p>
<p>The company emphasized that purchases made though its web site, mobile site/application, or in Canada or other international stores were not affected, and that customers should feel confident in continuing to use their payment cards in bebe stores.</p>
<p>&#8220;Our relationship with our customers is of the highest importance,&#8221; said bebe CEO <strong>Jim Wiggett</strong>, in a statement. &#8220;We moved quickly to block this attack and have taken steps to further enhance our security measures.&#8221;</p>
<p>Predictably, bebe stores is offering free credit monitoring services for one year to customers impacted by this incident, even though credit monitoring services do nothing to help consumers block fraud on existing accounts &#8212; such as credit and debit card accounts that may have been stolen in this breach.<br />
Consumers still need to keep a close eye on monthly statements, and report any unauthorized charges as quickly as possible.<span id="more-28945"></span></p>
<p>On Thursday, KrebsOnSecurity <a title="http://krebsonsecurity.com/2014/12/banks-credit-card-breach-at-bebe-stores/" href="http://krebsonsecurity.com/2014/12/banks-credit-card-breach-at-bebe-stores/" target="_blank">reported</a> that several banks had complained about a pattern of fraudulent charges on customer credit cards that all had one thing in common: They&#8217;d all been used at bebe locations across the country. One bank contacted by this reporter also found several of its cards for sale in a brand new batch of stolen cards pushed onto the market in an underground &#8220;carding&#8221; shop, cards that all turned out to have been used at bebe stores during a two week period in the latter half of November.</p>
<p>Interestingly, when I first accessed <a title="http://www.bebe.com/content.jsp?pageName=protectingcustomers" href="http://www.bebe.com/content.jsp?pageName=protectingcustomers" target="_blank">the breach notification page</a> at bebe stores this morning, Kaspersky Antivirus flagged the page as a possible phishing attack (see screenshot below). This is most likely a false positive, but I thought it was worth mentioning anyway.</p>
<div id="attachment_28946" style="width: 610px" class="wp-caption aligncenter"><a href="media/25dcd6ca.bebe-kav.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/bebe-kav.png"><img class="size-large wp-image-28946" src="media/e2c472b4.bebe-kav-600x546.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/bebe-kav-600x546.png" alt="Kaspersky Antivirus popped up this phishing page warning when I first tried to access the bebe stores breach alert." width="600" height="546" /></a><p class="wp-caption-text">Kaspersky Antivirus popped up this phishing page warning when I first tried to access the bebe stores breach alert.</p></div>


feed_id: http://krebsonsecurity.com/?p=28927
title: Toward a Breach Canary for Data Brokers
uri: Toward-a-Breach-Canary-for-Data-Brokers
url: http://krebsonsecurity.com/2014/12/toward-a-breach-canary-for-data-brokers/
content:
<p>When a retailer&#8217;s credit card systems get breached by hackers, banks usually can tell which merchant got hacked soon after those card accounts become available for purchase at underground cybercrime shops. But when companies that collect and sell sensitive consumer data get hacked or are tricked into giving that information to identity thieves, there is no easy way to tell who leaked the data when it ends up for sale in the black market. In this post, we&#8217;ll examine one idea to hold consumer data brokers more accountable.</p>
<p><a href="media/20e6388a.breachcanary.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/breachcanary.png"><img class="alignright size-medium wp-image-28979" src="media/43365e9d.breachcanary-285x161.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/breachcanary-285x161.png" alt="breachcanary" width="285" height="161" /></a>Some of the biggest retail credit card breaches of the past year &#8212; including the break-ins at <a title="http://krebsonsecurity.com/tag/target-data-breach/" href="http://krebsonsecurity.com/tag/target-data-breach/" target="_blank">Target</a> and <a title="http://krebsonsecurity.com/tag/home-depot-breach/" href="http://krebsonsecurity.com/tag/home-depot-breach/" target="_blank">Home Depot</a> &#8212; were detected by banks well before news of the incidents went public. When cards stolen from those merchants go up for sale on underground cybercrime shops, the banks often can figure out which merchant got hacked by acquiring a handful of their cards and analyzing the customer purchase history of those accounts. The merchant that is common to all stolen cards across a given transaction period is usually the breached retailer.</p>
<p>Sadly, this process of working backwards from stolen data to breach victim generally does not work in the case of breached data brokers that trade in Social Security information and other data, because too often there are no unique markers in the consumer data that would indicate from where the information was obtained.</p>
<p>Even in the handful of cases where underground crime shops selling consumer personal data have included data points in the records they sell that would permit that source analysis, it has taken years&#8217; worth of very imaginative investigation by law enforcement to determine which data brokers were at fault. In Nov. 2011, I <a title="http://krebsonsecurity.com/2011/11/how-much-is-your-identity-worth/" href="http://krebsonsecurity.com/2011/11/how-much-is-your-identity-worth/" target="_blank">wrote about</a> an identity theft service called <strong>Superget[dot]info,</strong> noting that &#8220;each purchasable record contains a two- to three-letter “sourceid,” which may provide clues as to the source of this identity information.&#8221;</p>
<p>Unfortunately, the world didn&#8217;t learn the source of that ID theft service&#8217;s data until 2013, a year after <strong>U.S. Secret Service</strong> agents arrested the site&#8217;s proprietor &#8212; a 24-year-old from Vietnam who was posing as a private investigator based in the United States. Only then were investigators able to determine that the source ID data matched information being <a title="http://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/" href="http://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/" target="_blank">sold by a subsidiary of big-three credit bureau <strong>Experian</strong></a> (among other data brokers that were selling to the ID theft service). But federal agents made that connection only after an elaborate investigation that lured the proprietor of that shop out of Vietnam and into a U.S. territory.</p>
<p>Meanwhile, during the <em>more than six years</em> that this service was in operation, Superget.info attracted more than 1,300 customers who paid at least $1.9 million to look up Social Security numbers, dates of birth, addresses, previous addresses, email addresses and other sensitive information on consumers, much of it used for new account fraud and tax return fraud.</p>
<p>Investigators got a lucky break in determining the source of another ID theft service that was busted up and has since changed its name (more on that in a moment). That service &#8212; known as &#8220;<strong>ssndob[dot]ru</strong>&#8221; &#8212; was <a title="http://krebsonsecurity.com/2013/03/credit-reports-sold-for-cheap-in-the-underweb/" href="http://krebsonsecurity.com/2013/03/credit-reports-sold-for-cheap-in-the-underweb/" target="_blank">the service used by <strong>exposed[dot]su</strong></a>, a site that proudly displayed the Social Security, date of birth, address history and other information on dozens of Hollywood celebrities, as well as public officials such as <strong>First Lady Michelle Obama</strong>, then <strong>FBI Director Robert Mueller</strong>, and <strong>CIA Director John Brennan</strong>.</p>
<p>As I explained in <a title="http://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/" href="http://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/" target="_blank">a 2013 exclusive</a>, civilian fraud investigators working with law enforcement gained access to the back-end server that was being used to handle customer requests for consumer information. That database showed that the site’s 1,300 customers had spent hundreds of thousands of dollars looking up SSNs, birthdays, drivers license records, and obtaining unauthorized credit and background reports on more than four million Americans.</p>
<p>Although four million consumer records may seem like a big number, that figure did not represent the total number of consumer records available through ssndob[dot]ru. Rather, four million was merely the number of consumer records that the service&#8217;s customers had paid the service to look up. In short, it appeared that the ID theft service was drawing on active customer accounts inside of major consumer data brokers.</p>
<p>Investigators working on that case later determined that the same crooks who were running ssndob[dot]ru also were operating a small, custom botnet of hacked computers inside of several major data brokers, including <strong>LexisNexis</strong>, <strong>Dun &amp; Bradstreet</strong>, and <strong>Kroll</strong>. All three companies acknowledged infections from the botnet, but shared little else about the incidents.</p>
<p>Despite their apparent role in facilitating (albeit unknowingly) these ID theft services, to my knowledge the data brokers involved have never been held publicly accountable in any court of law or by Congress.</p>
<p><span style="text-decoration: underline;">CURRENT ID THEFT SERVICES</span></p>
<p>At present, there are multiple shops in the cybercrime underground that sell everything one would need to steal someone&#8217;s identity in the United States or apply for new lines of credit in their name &#8212; including Social Security numbers, addresses, previous addresses, phone numbers, dates of birth, and in some cases full credit history. The price of this information is shockingly low &#8212; about $3 to $5 per record.</p>
<p>KrebsOnSecurity conducted an exhaustive review of consumer data on sale at some of the most popular underground cybercrime sites. The results show that personal information on some of the most powerful Americans remains available for just a few dollars. And of course, if one can purchase this information on these folks, one can buy it on just about anyone in the United States today.</p>
<p>As an experiment, this author checked two of the most popular ID theft services in the underground for the availability of Social Security numbers, phone numbers, addresses and previous addresses on all members of the <strong>Senate Commerce Committee</strong>&#8216;s <a title="http://www.commerce.senate.gov/public/index.cfm?p=ConsumerProtectionProductSafetyandInsurance" href="http://www.commerce.senate.gov/public/index.cfm?p=ConsumerProtectionProductSafetyandInsurance" target="_blank">Subcommittee on Consumer Protection, Product Safety and Insurance</a>. That data is currently on sale for all thirteen Democrat and Republican lawmakers on the panel.</p>
<p>Between these two ID theft services, the same personal information was for sale on <strong>Edith Ramirez</strong> and <strong>Richard Cordray</strong>, the heads of the <strong>Federal Trade Commission</strong> (FTC) and the <strong>Consumer Financial Protection Bureau</strong> (CFPB), respectively.<span id="more-28927"></span></p>
<p><a class="lightbox" href="media/a5bfe050.ssndob-found.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/ssndob-found.png"><img class="aligncenter size-large wp-image-28980" src="media/e9e3e57f.ssndob-found-600x513.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/ssndob-found-600x513.png" alt="ssndob-found" width="600" height="513" /></a></p>
<p>Getting these ID theft service Web sites shut down might feel good, but it is not a long-term solution. Both services used to conduct these lookups of the public figures mentioned above are second- and third-generation shops that have re-emerged from previous takedown efforts. In fact, at least one of them appears to be a reincarnation of ssndob[dot]ru, while the other seems little more than a reseller of that service.</p>
<p>Rather, it seems clear that what we need is more active oversight of the data broker industry, and new tools to help law enforcement (and independent investigators) determine the source of data being resold by these identity theft services.</p>
<p>Specifically, if there were a way for federal investigators to add &#8220;breach canaries&#8221; &#8212; unique, dummy identities &#8212; to records maintained by the top data brokers, it could make it far easier to tell which broker is leaking consumer data either through breaches or hacked/fraudulent accounts.</p>
<p>Data brokers like Experian have strongly resisted calls from regulators for greater transparency in their operations and in the data that they hold about consumers. When the FTC recommended the creation of a central website where data brokers would be listed &#8212; with links to these companies, their privacy policies and also choice options, giving consumers the capability to review/amend the data that companies maintain &#8212; Experian lobbied against the idea, charging that it would &#8220;have the unintended effect of confusing consumers and eroding trust in e-commerce.&#8221;</p>
<p>The company&#8217;s main sticking point was essentially that it was unfair to impose such requirements on the bigger data brokers and ignore the rest. Experian&#8217;s chief lobbyist <strong>Tony Hadley</strong> has made the argument that there are just too many companies that have and share all this consumer data, which seems precisely the problem.</p>
<p>&#8220;The Direct Marketing Association (DMA) estimates that even a narrow definition of a marketing information service provider is likely to include more than 2,500 companies from all sectors of the economy,&#8221; Hadley <a title="http://www.experian.com/blogs/news/2014/03/05/ftc-proposal/" href="http://www.experian.com/blogs/news/2014/03/05/ftc-proposal/" target="_blank">wrote</a> in a blog post earlier this year. &#8220;Simply put, the entire data industry – extremely vital to the US economy — cannot be neatly or accurately identified and then subjected to unrealistic requirements.&#8221;</p>
<p>My guess is that if the data broker giants are opposed to the idea of inserting dummy identities into their records to act as breach canaries, it is because such a practice could expose data-sharing relationships and record-keeping practices that these companies would rather not see the light of day. But barring any creative ideas to help investigators quickly learn the source of data being sold by identity theft services online, data brokers will remain free to facilitate and even profit from an illicit market for sensitive consumer information.</p>


feed_id: http://krebsonsecurity.com/?p=28993
title: More on Wiretapping ATM Skimmers
uri: More-on-Wiretapping-ATM-Skimmers
url: http://krebsonsecurity.com/2014/12/more-on-wiretapping-atm-skimmers/
content:
<p>Last month, this blog featured <a title="http://krebsonsecurity.com/2014/11/skimmer-innovation-wiretapping-atms/" href="http://krebsonsecurity.com/2014/11/skimmer-innovation-wiretapping-atms/" target="_blank">a story</a> about an innovation in ATM skimming known as wiretapping, which I said involves a &#8220;tiny&#8221; hole cut in the ATM&#8217;s front through which thieves insert devices capable of eavesdropping on and recording the ATM user&#8217;s card data. Turns out, the holes the crooks make to insert their gear tend to be anything but tiny.</p>
<p>Not long after that post went live, I heard from the folks at <strong>NCR</strong>, one of the world&#8217;s largest cash machine manufacturers. NCR had put out a bulletin on the emergence of this very threat in Sept. 2014, saying the activity had first been spotted in the United Kingdom against NCR 5877 and 5887 models.</p>
<p>As I noted in my original story, the attackers use a plastic decal to cover up the hole, but NCR&#8217;s photos of one ATM compromised by this method offer a better look at what&#8217;s going on here. Take a look at the size of that hole:</p>
<div id="attachment_28995" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/3ce3d38a.ncr-decal-wiretap.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/ncr-decal-wiretap.png"><img class="size-large wp-image-28995" src="media/d2d6a09c.ncr-decal-wiretap-600x283.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/ncr-decal-wiretap-600x283.png" alt="A hole left by crooks who added &quot;wiretapping&quot; or &quot;eavesdropping&quot; theft devices to a compromised ATM." width="600" height="283" /></a><p class="wp-caption-text">A hole left by crooks who added &#8220;wiretapping&#8221; or &#8220;eavesdropping&#8221; theft devices to a compromised ATM. Image: NCR.</p></div>
<p>&#8220;In this attack, the ATM fascia is penetrated close to the card reader to create a hole large enough for the attacker to reach inside the ATM and place a tap directly onto the card reader in order to skim card data as it is read by the ATM,&#8221; NCR said in an advisory it produced on the increasingly common attacks.</p>
<p>According to NCR, the emergence of this type of skimming attack is a response to the widespread availability of third party anti-skimming technology which is successful at preventing the operation of a traditional skimmer, placed on the outside of the ATM.</p>
<p>&#8220;Card reader eavesdropping skimmers are placed in a location that third party anti-skimming technology necessarily cannot protect, since the ATM must be capable of reading the card,&#8221; the advisory notes. &#8220;This [technique] has previously been seen in Ireland and the Netherlands, and can be expected to grow as traditional skimming is prevented.&#8221;</p>
<p>NCR observed that crooks employing this attack are using a variety of methods to create the hole in the front of the ATM. Modern ATMs often now include sensors that can detect vibrations consistent with drilling or cutting tools, so some thieves have taken to melting the ATM fascia in some cases.</p>
<p>&#8220;Melting techniques have been observed which can circumvent seismic anti-drilling sensors,&#8221; NCR said.</p>
<p>If the idea of ATM bandits taking a blowtorch to the cash machine sounds extreme, <em>at least they&#8217;re not trying to blow the ATM to smithereens</em>. According to quarterly reports from the European ATM Security Team (EAST), ATM <em>attacks in which the fraudsters attempt to blast open the machine with explosive gas are on the rise.</em><span id="more-28993"></span></p>
<div id="attachment_28997" style="width: 274px" class="wp-caption alignright"><a class="lightbox" href="media/a37ecfd7.atmgasattack.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/atmgasattack.png"><img class="size-full wp-image-28997" src="media/a37ecfd7.atmgasattack.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/atmgasattack.png" alt="A gas cylinder and pipe found fitted at a compromised ATM before it could be detonated. Source: EAST." width="264" height="359" /></a><p class="wp-caption-text">A gas cylinder and pipe fitted at a compromised ATM. Source: EAST.</p></div>
<p>EAST reports that explosive gas attacks were reported by eight countries in Europe this year. Why would thieves risk their lives and that of innocent passers-by on such a brute-force attack? EAST says the attacks are generally successful at busting open the ATM about 40 percent of the time.</p>
<p>&#8220;Two of the countries also reported attacks using solid explosives,&#8221; EAST warned. &#8220;Collateral damage for solid explosive attacks is a major concern. In one country, the average overall frequency of ATM related physical attacks is five incidents per week. Three countries reported significant collateral damage from physical attacks, in addition to cash losses suffered.&#8221;</p>
<p>Fortunately, many countries in Europe are fighting back against these incredibly dangerous skimming attacks, both with improved ATM technology and stiffer sentences for crooks caught in the act.</p>
<p>&#8220;In one country no such attack s have been reported since the introduction of ink staining technology,&#8221; EAST noted. &#8220;In another, significant sentences have been given to criminals convicted of such attacks (the longest was 18 years in prison and the shortest 14 years!). This is an important step for Europe as, overall, sentences for such attacks are deemed by the industry to be too lenient.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=29008
title: Unencrypted Data Lets Thieves ‘Charge Anywhere’
uri: Unencrypted-Data-Lets-Thieves-Charge-Anywhere
url: http://krebsonsecurity.com/2014/12/unencrypted-data-lets-thieves-charge-anywhere/
content:
<p><strong>Charge Anywhere LLC</strong>, a mobile payments provider, today disclosed that malicious software planted on its networks may have jeopardized credit card data from transactions the company handled between November 2009 and September 2014.</p>
<p><a href="media/d99328db.chargeanywhere.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/chargeanywhere.png"><img class="alignright size-full wp-image-29016" src="media/d99328db.chargeanywhere.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/chargeanywhere.png" alt="chargeanywhere" width="238" height="118" /></a>In <a title="https://www.chargeanywhere.com/notice/_defaultmerchant.aspx" href="https://www.chargeanywhere.com/notice/_defaultmerchant.aspx" target="_blank">a statement</a> released today, the South Plainfield, N.J. electronic payment provider said it launched investigation after receiving complaints about fraudulent charges on cards that had been legitimately used at certain merchants. The information stolen includes the customer name, card number, expiration date and verification code.</p>
<p>&#8220;The investigation revealed that an unauthorized person initially gained access to the network and installed sophisticated malware that was then used to create the ability to capture segments of outbound network traffic,&#8221; the company explained. &#8220;Much of the outbound traffic was encrypted. However, the format and method of connection for certain outbound messages enabled the unauthorized person to capture and ultimately then gain access to plain text payment card transaction authorization requests.&#8221;<span id="more-29008"></span></p>
<p>Charge Anywhere said it believes that &#8220;only files containing the segments of captured network traffic from August 17, 2014 through September 24, 2014 were identified,&#8221; although the company allowed that the unauthorized person had the ability to capture network traffic <em>as early as November 5, 2009.</em></p>
<p>The incident is the latest reminder of what happens to businesses that handle credit card data and other sensitive information and yet fail to full encrypt the data as it traverses their network. The company has provided <a title="https://www.chargeanywhere.com/notice/search.aspx" href="https://www.chargeanywhere.com/notice/search.aspx" target="_blank">a searchable list</a> of merchants who may have been affected by the breach.</p>


feed_id: http://krebsonsecurity.com/?p=29024
title: Microsoft, Adobe Push Critical Security Fixes
uri: Microsoft-Adobe-Push-Critical-Security-Fixes
url: http://krebsonsecurity.com/2014/12/microsoft-adobe-push-critical-security-fixes-2/
content:
<p>If you use <strong>Microsoft</strong> or <strong>Adobe</strong> software products, chances are that software is now dangerously out of date. Microsoft today released seven update bundles to fix two dozen security vulnerabilities in Windows and supported software. Adobe pushed patches to correct critical flaws in <strong>Acrobat</strong>, <strong>Reader </strong>and<strong> </strong><strong>Flash Player</strong>, including a bug in Flash that already is being exploited.</p>
<p><a href="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png"><img class="alignright  wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="203" height="213" /></a>Four of the seven updates from Microsoft earned a &#8220;critical&#8221; rating, which means the patches on fix vulnerabilities that can be exploited by malware or attackers to seize control over vulnerable systems without any help from users (save for perhaps visiting a hacked or malicious Web site). One of those critical patches &#8212; for <strong>Internet Explorer</strong> &#8212; plugs at least <a title="http://go.microsoft.com/fwlink/?LinkID=521659" href="http://go.microsoft.com/fwlink/?LinkID=521659" target="_blank">14 holes</a> in the default Windows browser.</p>
<p>Another <a title="https://technet.microsoft.com/library/security/ms14-081" href="https://technet.microsoft.com/library/security/ms14-081" target="_blank">critical patch</a> plugs two vulnerabilities in <strong>Microsoft Word</strong> and <strong>Office Web Apps</strong> (including <strong>Office for Mac 2011</strong>). There are actually three patches this month that address Microsoft Office vulnerabilities, including <a title="https://technet.microsoft.com/library/security/ms14-082" href="https://technet.microsoft.com/library/security/ms14-082" target="_blank">MS14-082</a> and <a title="http://go.microsoft.com/fwlink/?LinkId=519133" href="http://go.microsoft.com/fwlink/?LinkId=519133" target="_blank">MS-14-083</a>, both of which are rated &#8220;<a title="http://technet.microsoft.com/en-US/security/gg309177.aspx" href="http://technet.microsoft.com/en-US/security/gg309177.aspx" target="_blank">important</a>.&#8221; A full breakdown of these and other patches released by Microsoft today is <a title="https://technet.microsoft.com/library/security/ms14-dec" href="https://technet.microsoft.com/library/security/ms14-dec" target="_blank">here</a>.</p>
<p>Adobe&#8217;s Flash Player update brings the player to<em> v. 16.0.0.235</em> for Windows and Mac users, and fixes at least six critical bugs in the software. Adobe said an exploit for one of the flaws, <a title="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9163" href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9163" target="_blank">CVE-2014-9163</a>, already exists in the wild.</p>
<p>&#8220;These updates address vulnerabilities that could potentially allow an attacker to take over the affected system,&#8221; the company said in its <a title="http://helpx.adobe.com/security/products/flash-player/apsb14-27.html" href="http://helpx.adobe.com/security/products/flash-player/apsb14-27.html" target="_blank">advisory</a>.<span id="more-29024"></span></p>
<p><a href="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png"><img class="alignleft  wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="190" height="162" /></a>To see which version of Flash you have installed, check <a title="https://www.adobe.com/software/flash/about/" href="https://www.adobe.com/software/flash/about/" target="_blank">this link</a>. IE10/IE11 on Windows 8.x and Chrome should auto-update their versions of Flash. If your version of Chrome doesn&#8217;t show the latest version of Flash, you may need to restart the browser or manually force Chrome to check for updates (click the three-bar icon to the right of the address bar, select &#8220;About Google Chrome&#8221; and it should check then).</p>
<p>The most recent versions of Flash are available from the Flash <a title="http://get.adobe.com/flashplayer/" href="http://get.adobe.com/flashplayer/" target="_blank">home page</a>, but beware potentially unwanted add-ons, like McAfee Security Scan. To avoid this, uncheck the pre-checked box before downloading, or grab your OS-specific Flash download from <a title="http://www.adobe.com/products/flashplayer/distribution3.html" href="http://www.adobe.com/products/flashplayer/distribution3.html" target="_blank">here</a>.</p>
<p>Windows users who browse the Web with anything other than Internet Explorer may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>
<p>Adobe Acrobat and Adobe Reader users will need to apply a critical update that fixes at least 20 critical security in these programs. See Adobe&#8217;s <a title="http://helpx.adobe.com/security/products/reader/apsb14-28.html" href="http://helpx.adobe.com/security/products/reader/apsb14-28.html" target="_blank">Reader advisory</a> for more details on that. The latest updates live <a title="http://www.adobe.com/support/downloads/product.jsp?product=10&amp;platform=Windows" href="http://www.adobe.com/support/downloads/product.jsp?product=10&amp;platform=Windows" target="_blank">here</a>.</p>


feed_id: http://krebsonsecurity.com/?p=29036
title: ‘Poodle’ Bug Returns, Bites Big Bank Sites
uri: Poodle-Bug-Returns-Bites-Big-Bank-Sites
url: http://krebsonsecurity.com/2014/12/poodle-bug-returns-bites-big-bank-sites/
content:
<p>Many of the nation&#8217;s top banks, investment firms and credit providers are vulnerable to a newly-discovered twist on a known security flaw that exposes Web site traffic to eavesdropping. The discovery has prompted renewed warnings from the U.S. Department of Homeland Security advising vulnerable Web site owners to address the flaw as quickly as possible.</p>
<p><a href="media/7315e73c.chasepoodle.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/chasepoodle.png"><img class="alignright size-medium wp-image-29038" src="media/728575ac.chasepoodle-285x220.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/chasepoodle-285x220.png" alt="chasepoodle" width="285" height="220" /></a>In mid-October, the world learned about &#8220;POODLE,&#8221; an innocuous acronym for a serious security flaw in a specific version (version 3.0) of <a title="http://en.wikipedia.org/wiki/Transport_Layer_Security" href="http://en.wikipedia.org/wiki/Transport_Layer_Security" target="_blank">Secure Sockets Layer</a> (SSL), the technology that most commercial Web sites use to protect the privacy and security of communications with customers.</p>
<p>When you visit a site that begins with &#8220;https://&#8221; you can be sure that the data that gets transmitted between that site and your browser cannot be read by anyone else. That is, unless those sites are still allowing traffic over SSL 3.0, in which case an attacker could exploit the POODLE bug to decrypt and extract information from inside an encrypted transaction &#8212; including passwords, cookies and other data that can be used to impersonate the legitimate user.</p>
<p>On Dec. 8, researchers found that the POODLE flaw also extends to certain versions of a widely used SSL-like encryption standard known as TLS (short for <a title="http://en.wikipedia.org/wiki/Transport_Layer_Security" href="http://en.wikipedia.org/wiki/Transport_Layer_Security" target="_blank">Transport Layer Security</a>).</p>
<p>&#8220;The impact of this problem is similar to that of POODLE, with the attack being slightly easier to execute,&#8221; <a title="https://community.qualys.com/blogs/securitylabs/2014/12/08/poodle-bites-tls" href="https://community.qualys.com/blogs/securitylabs/2014/12/08/poodle-bites-tls" target="_blank">wrote</a> <strong>Ivan Ristic</strong>, director of engineering at security firm <strong>Qualys</strong>, which made available online <a title="https://www.ssllabs.com/ssltest/" href="https://www.ssllabs.com/ssltest/" target="_blank">a free scanning tool</a> that evaluates Web sites for the presence of the POODLE vulnerability, among other problems. &#8220;The main target are browsers, because the attacker must inject malicious JavaScript to initiate the attack.&#8221;</p>
<p>A cursory review using Qualys&#8217;s SSL/TLS scanning tool indicates that the Web sites for some of the world&#8217;s largest financial institutions are vulnerable to the new POODLE bug, including <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/bofa-poodle.png" href="media/22f5dce1.bofa-poodle.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/bofa-poodle.png" target="_blank">Bank of America</a>, <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/chasepoodle.png" href="media/7315e73c.chasepoodle.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/chasepoodle.png" target="_blank">Chase.com</a>, <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/citi-poodle.png" href="media/ddb8badd.citi-poodle.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/citi-poodle.png" target="_blank">Citibank</a>, <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/hsbc.png" href="media/21d2aab7.hsbc.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/hsbc.png" target="_blank">HSBC</a>, <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/suntrust-poodle.png" href="media/d3643e61.suntrust-poodle.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/suntrust-poodle.png" target="_blank">Suntrust</a> &#8212; as well as retirement and investment giants <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/qualyspoodle.png" href="media/63a86780.qualyspoodle.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/qualyspoodle.png" target="_blank">Fidelity.com</a> and <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/vanguard-poodle.png" href="media/423860a8.vanguard-poodle.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/vanguard-poodle.png" target="_blank">Vanguard</a> (click links to see report). <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/expperian-poodle.txt" href="http://krebsonsecurity.com/wp-content/uploads/2014/12/expperian-poodle.txt" target="_blank">Dozens of sites</a> offering consumer credit protection and other services run by <strong>Experian</strong> also are vulnerable, according to SSL Labs. Qualys estimates that about 10 percent of Web servers are vulnerable to the POODLE attack against TLS.<span id="more-29036"></span></p>
<p>According to <a title="https://www.us-cert.gov/ncas/alerts/TA14-290A" href="https://www.us-cert.gov/ncas/alerts/TA14-290A" target="_blank">an advisory</a> from the <strong>U.S. Computer Emergency Readiness Team</strong> (US-CERT), a partnership run in conjunction with the U.S. Department of Homeland Security, although there is currently no fix for the vulnerability SSL 3.0 itself, disabling SSL 3.0 support in Web applications is the most viable solution currently available. US-CERT notes that some of the same researchers who <a title="https://www.imperialviolet.org/2014/12/08/poodleagain.html" href="https://www.imperialviolet.org/2014/12/08/poodleagain.html" target="_blank">discovered</a> the Poodle vulnerability also developed a fix for the TLS-related issues.</p>
<p>Until vulnerable sites patch the issue, there isn&#8217;t a lot that regular users can do to protect themselves from this bug, aside from exercising some restraint when faced with the desire to log in to banking and other sensitive sites over untrusted networks, such as public Wi-Fi hotspots.</p>
<p>&nbsp;</p>


feed_id: http://krebsonsecurity.com/?p=29033
title: ‘Security by Antiquity’ Bricks Payment Terminals
uri: Security-by-Antiquity-Bricks-Payment-Terminals
url: http://krebsonsecurity.com/2014/12/security-by-antiquity-bricks-payment-terminals/
content:
<p>Last week, several thousand credit card payment terminals at various retailers across the country suddenly stopped working, their LCD displays showing blank screens instead of numbers and letters. Puzzled merchants began to worry that this was perhaps part of some sophisticated hacker attack on their cash registers. It turns out that the incident was indeed security-related, but for once it had nothing to do with cyber thieves.</p>
<div id="attachment_29064" style="width: 261px" class="wp-caption alignright"><a href="media/3c706641.e4250.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/e4250.png"><img class="size-full wp-image-29064" src="media/3c706641.e4250.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/e4250.png" alt="Hypercom L4250 payment terminal." width="251" height="232" /></a><p class="wp-caption-text">Hypercom L4250 payment terminal.</p></div>
<p>On Dec. 7, 2014, certain older model payment terminals made by <strong>Hypercom</strong> stopped working due to the expiration of a cryptographic certificate used in the devices, according to Scottsdale, Ariz.-based <strong>Equinox Payments</strong>, the company that owns the Hypercom brand.</p>
<p>&#8220;The security mechanism was triggered by the rollover of the date and not by any attack on or breach of the terminal,&#8221; said <strong>Stuart Taylor</strong>, vice president of payment solutions at Equinox. &#8220;The certificate was created in 2004 with a 10 year expiry date.&#8221;</p>
<p>Taylor said Equinox is now working with customers, distributors and channel partners to replace the certificate to return terminals to an operational state. The company is pointing affected customers who still need assistance <a title="http://www.equinoxpayments.com/certhelp/" href="http://www.equinoxpayments.com/certhelp/" target="_blank">to this certificate expiry help page</a>.</p>
<p>&#8220;Many of these terminals have been successfully updated in the field,&#8221; Taylor said. &#8220;Unfortunately, a subset of them can’t be fixed in the field which means they’ll need to be sent to our repair facility.  We are working with our customers and distribution partners to track down where these terminals are and will provide whatever assistance we can to minimize any disruption as a result of this matter.&#8221;</p>
<p>According to two different merchants impacted by the incident that reached out to KrebsOnSecurity, the bricking of these payment terminals occurs only after the affected devices (in the 4x version of the terminals) are power-cycled or rebooted, which some merchants do daily.</p>
<p><strong>Michael Rochette</strong>, vice president at <a title="http://www.spencertech.com" href="http://www.spencertech.com" target="_blank">Spencer Technologies</a>, a Northborough, Mass.-based technology installation and support company, said his firm heard last week from an East Coast supermarket chain that opened for business on Monday morning only to find all of their payment terminals unresponsive. Rochette said that the supermarket chain and other retailers impacted by the incident across the country were immediately worried that the incident was part of a hacker attack on their payment infrastructure.</p>
<p>&#8220;Not all stores power cycle overnight, but for those that do, they came up all blank and inoperative,&#8221; Rochette said. &#8220;If that&#8217;s something that a retail chain does as a matter of policy across a whole chain of stores, that can be pretty damaging.&#8221;<span id="more-29033"></span></p>
<p>One retailer that contacted KrebsOnSecurity but asked to remain anonymous said technicians at its locations had spent three days trying without success to restore the devices.</p>
<p>&#8220;I use two different generations of their terminals and have spent the last three days trying to understand completely why I had zero impact,&#8221; a reader from the retailer said. &#8220;Mass extinction of my POS devices at the manufacturer level was never on my list of scenarios that would wreck my day at retail.  It is now.&#8221;</p>
<p>While designing your products so that they fail after 10 years seems like a less than brilliant idea, this incident is a reminder of just how much of the payments infrastructure in the United States relies on rapidly aging technology.</p>
<p>According to Rochette, at least one of the affected Hypercom devices is no longer allowed to be used in retail installations after 2014, per sunset provisions set out by the PCI Council, an industry group that sets security standards for payment systems. Other Hypercom models affected by this incident are perfectly acceptable to use for years to come.</p>
<p>As for why Equinox failed to warn its customers of the impending meltdown of these payment terminals? Rochette posits that it might have something to do with Hypercom&#8217;s rocky corporate history.</p>
<p>&#8220;I&#8217;ve never seen this before where a particular product all crashed on the same day, and as far as I can tell there was no advance warning about this from Equinox,&#8221; Rochette said. &#8220;Over the last few years, they were Hypercom, then part of Equinox, then part of Verifone for a while, so I suspect there&#8217;s been a lot of turnover in personnel there, and frankly they just lost sight of the fact that they had a pretty important expiration date coming.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=29058
title: SpamHaus, CloudFlare Attacker Pleads Guilty
uri: SpamHaus-CloudFlare-Attacker-Pleads-Guilty
url:
http://krebsonsecurity.com/2014/12/spamhaus-cloudflare-attacker-pleads-guilty-to-computer-abuse-child-porn-charges/

content:
<p>A 17-year-old male from London, England pleaded guilty this week to carrying out a massive denial-of-service attack last year against anti-spam outfit <a title="http://www.spamhaus.org" href="http://www.spamhaus.org" target="_blank">SpamHaus</a> and content delivery network <a title="http://www.cloudflare.com" href="http://www.cloudflare.com" target="_blank">CloudFlare</a>, KrebsOnSecurity has learned.</p>
<p><a class="lightbox" href="media/8b504326.narko-stophaus.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/narko-stophaus.png"><img class="alignright size-medium wp-image-29079" src="media/fa755335.narko-stophaus-285x194.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/narko-stophaus-285x194.png" alt="narko-stophaus" width="285" height="194" /></a>In late March 2013, a massive distributed denial-of-service (DDoS) attack hit the web site of SpamHaus, an organization that distributes a blacklist of spammers to email and network providers. When SpamHaus moved its servers behind CloudFlare, which specializes in blocking such attacks &#8212; the attackers pelted CloudFlare&#8217;s network. <em>The New York Times</em> <a title="http://www.nytimes.com/2013/03/28/technology/attacks-on-spamhaus-used-internet-against-itself.html?pagewanted=all" href="http://www.nytimes.com/2013/03/28/technology/attacks-on-spamhaus-used-internet-against-itself.html?pagewanted=all" target="_blank">called</a> the combined assault the largest known DDoS attack ever on the Internet at the time; for its part, CloudFlare <a title="http://blog.cloudflare.com/the-ddos-that-almost-broke-the-internet/" href="http://blog.cloudflare.com/the-ddos-that-almost-broke-the-internet/" target="_blank">dubbed</a> it &#8220;the attack that almost broke the Internet.&#8221;</p>
<p>In April 2013, an unnamed then-16-year-old male from London identified only by his hacker alias &#8220;<strong>Narko</strong>,&#8221; was arrested and charged with computer misuse and money laundering in connection with the attack.</p>
<p>Sources close to the investigation now tell KrebsOnSecurity that Narko has pleaded guilty to those charges, and that Narko&#8217;s real name is <strong>Sean Nolan McDonough</strong>. A spokesman for the <strong>U.K. National Crime Agency</strong> confirmed that a 17-year-old male from London had pleaded guilty to those charges on Dec. 10, but noted that &#8220;court reporting restrictions are in place in respect to a juvenile offender, [and] as a consequence the NCA will not be releasing further detail.&#8221;</p>
<p>During the assault on SpamHaus, Narko was listed as one of several moderators of the forum <strong>Stophaus[dot]com</strong>, a motley crew of hacktivists, spammers and <a title="http://krebsonsecurity.com/?s=bulletproof+host&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=bulletproof+host&amp;x=0&amp;y=0" target="_blank">bulletproof hosting providers</a> who took credit for organizing the attack on SpamHaus and CloudFlare.</p>
<p><span style="text-decoration: underline;">WHO RUNS STOPHAUS?</span></p>
<p>It is likely that McDonough/Narko was hired by someone else to conduct the attack. So, this seems as good a time as any to look deeper into who&#8217;s likely the founder and driving force behind the Stophaus movement itself. All signs point to an angry, failed spammer living in Florida who runs an organization that calls itself the <strong>Church of Common Good</strong>.</p>
<p><a class="lightbox" href="media/f1e4f225.cocg-fb.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/cocg-fb.png"><img class="alignleft size-medium wp-image-29080" src="media/1487275a.cocg-fb-265x400.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/cocg-fb-265x400.png" alt="cocg-fb" width="265" height="400" /></a>Not long after McDonough&#8217;s arrest, a new Facebook page went online called &#8220;<a title="https://www.facebook.com/pages/Freenarko/220586408106618?sk=timeline" href="https://www.facebook.com/pages/Freenarko/220586408106618?sk=timeline" target="_blank">Freenarko</a>,&#8221; which listed itself as &#8220;a solidarity support group to help in the legal defense and media stability for &#8216;Narko,&#8217; a 16-yr old brother in London who faces charges concerning the Spamhaus DDoS attack in March.&#8221;</p>
<p>Multiple posts on that page link to Stophaus propaganda, to <a title="https://www.facebook.com/CoCGMinistries" href="https://www.facebook.com/CoCGMinistries" target="_blank">the Facebook page for the Church of the Common Good</a>, and to a now-defunct Web site called &#8220;WeAreHomogeneous.org&#8221; (an eye-opening and archived copy of the site as it existed in early 2013 is available at <a title="https://web.archive.org/web/20131025044011/http://wearehomogeneous.org/" href="https://web.archive.org/web/20131025044011/http://wearehomogeneous.org/" target="_blank">archive.org</a>; for better or worse, the group&#8217;s <a title="https://www.facebook.com/politixremixd" href="https://www.facebook.com/politixremixd" target="_blank">Facebook page</a> lives on).</p>
<p>The Church of Common Good <a title="http://www.guidestar.org/organizations/46-1839939/church-common-good.aspx" href="http://www.guidestar.org/organizations/46-1839939/church-common-good.aspx" target="_blank">lists as its leader</a> a Gulfport, Fla. man named <strong>Andrew J. Stephens</strong>, whose <a title="https://www.linkedin.com/in/stephensboy" href="https://www.linkedin.com/in/stephensboy" target="_blank">LinkedIn page</a> says he is a &#8220;media mercenary&#8221; at the same organization (hours after this story was posted, large chunks of text were deleted from Stephens&#8217; profile; a PDF of the original profile is <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/Andrew-Stephens-_-LinkedIn.pdf" href="media/00b040eb.Andrew-Stephens-_-LinkedIn.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/Andrew-Stephens-_-LinkedIn.pdf" target="_blank">here</a>).</p>
<p>Stephens&#8217; CV lists a stint in 2012 as owner of an email marketing firm variously called <strong>Digital Dollars</strong> and <strong>IBT Inc</strong>, moneymaking schemes which Stephens describes as a &#8220;beginner to intermediate level guide to successful list marketing in today&#8217;s email environment. It incorporates the use of both white hat and some sketchy techniques you would find on black hat forums, but has avoided anything illegal or unethical&#8230;which you would also find on black hat forums.&#8221;</p>
<p>More recent entries in <a title="https://www.linkedin.com/in/stephensboy" href="https://www.linkedin.com/in/stephensboy" target="_blank">Andrew&#8217;s LinkedIn profile</a> show that he now sees his current job as a &#8220;social engineer.&#8221; From his page:</p>
<blockquote><p>&#8220;I am a what you may call a &#8220;Social Engineer&#8221; and have done work for several information security teams. My most recent operation was with a research team doing propaganda analysis for a media firm. I have a unique ability to access data that is typically inaccessible through social engineering and use this ability to gather data for research purposes. I have a knack for data mining and analysis, but was not formally trained so am able to think outside the box and accomplish goals traditional infosec students could not. I am proficient at strategic planning and vulnerability analysis and am often busy dissecting malware and tracking the criminals behind such software. There&#8217;s no real title for what I do, but I do it well I am told.&#8221;</p></blockquote>
<p>Turns out, Andrew J. Stephens used to have his own Web site &#8212; <strong>andrewstephens.org</strong>. Here, the indispensable archive.org helps out again with <a title="http://web.archive.org/web/20110321025315/http://andrewstephens.org/" href="http://web.archive.org/web/20110321025315/http://andrewstephens.org/" target="_blank">a cache of his site</a> from back when it launched in 2011 (oddly enough, the same year that Stophaus claims to have been born). On his page, Mr. Stephens lists himself as an &#8220;internet entrepreneur&#8221; and his business as &#8220;IBT.&#8221; Under his &#8220;Featured Work&#8221; heading, he lists &#8220;The Stophaus Project,&#8221; &#8220;Blackhat Learning Center,&#8221; and a link to an spamming software tool called &#8220;Quick Send v.1.0.&#8221;</p>
<p>Stephens did not return requests for comment sent to his various contact addresses, although a combative individual who uses the Twitter handle @Stophaus and has been promoting the group&#8217;s campaign refused to answer direct questions about whether he was in fact Andrew J. Stephens.</p>
<p><span id="more-29058"></span></p>
<p>Helpfully, <a title="http://web.archive.org/web/20110321025315/http://andrewstephens.org/" href="http://web.archive.org/web/20110321025315/http://andrewstephens.org/" target="_blank">the cached version of Andrewstephens.org</a> lists a contact email address at the top of the page: <strong>stephensboy@gmail.com</strong> (&#8220;Stephensboy&#8221; is the short/informal name of the Andrew J. Stephens LinkedIn profile). A historic domain registration record lookup purchased from <a title="http://www.domaintools.com" href="http://www.domaintools.com" target="_blank">Domaintools.com</a> shows that same email address was used to register more than two dozen domains, including <strong>stophaus.org</strong> and s<strong>topthehaus.org</strong>. Other domains and businesses registered by that email include (hyperlinked domains below link to archive.org versions of the site):</p>
<p>-&#8220;<a title="http://web.archive.org/web/20090731111338/http://www.blackhatwebhost.com/plans.html" href="http://web.archive.org/web/20090731111338/http://www.blackhatwebhost.com/plans.html" target="_blank">blackhatwebhost.com</a>&#8220;;<br />
-&#8220;bphostingservers.com&#8221; (&#8220;BP&#8221; is a common abbreviation for &#8220;bulletproof hosting&#8221; services sold to -spammers and malware purveyors);<br />
-&#8220;conveyemail.com&#8221;;<br />
-&#8220;datapacketz.com&#8221; (another spam software product produced and marketed by Stephens);<br />
-&#8220;emailbulksend.com&#8221;;<br />
-&#8220;emailbulk.info&#8221;;<br />
-&#8220;escrubber.info&#8221; (tools to scrub spam email lists of dummy or decoy addresses used by anti-spam companies);<br />
-&#8220;esender.biz&#8221;;<br />
-&#8220;ensender.us&#8221;;<br />
-&#8220;<a title="https://web.archive.org/web/20101231071850/http://quicksendemail.com/?" href="https://web.archive.org/web/20101231071850/http://quicksendemail.com/?" target="_blank">quicksendemail.com</a>&#8220;;<br />
-&#8220;transmitemail.com&#8221;.</p>
<p>The physical address on many of the original registration records for the site names listed above show an address for one <strong>Michelle Kellison</strong>. The <a title="http://search.sunbiz.org/Inquiry/CorporationSearch/SearchResultDetail/EntityName/domnp-n13000001189-2d709c8e-ca68-4e89-a087-465f5c1cd0df/church%20of%20common%20good/Page1" href="http://search.sunbiz.org/Inquiry/CorporationSearch/SearchResultDetail/EntityName/domnp-n13000001189-2d709c8e-ca68-4e89-a087-465f5c1cd0df/church%20of%20common%20good/Page1" target="_blank">incorporation records</a> for the Church of Common Good filed with the Florida Secretary of State list a Michelle Kellison as the registered agent for that organization.</p>
<div id="attachment_29123" style="width: 610px" class="wp-caption aligncenter"><a href="media/3def6ec1.edataking.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/edataking.png"><img class="size-large wp-image-29123" src="media/4214fa5f.edataking-600x354.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/edataking-600x354.png" alt="Andrew's Skype profile, where he uses another of his favorite nicknames, &quot;eDataKing&quot;" width="600" height="354" /></a><p class="wp-caption-text">Andrew&#8217;s Skype profile, where he uses another of his favorite nicknames, &#8220;eDataKing&#8221;</p></div>
<p>Putting spammers and other bottom feeders in jail for DDoS attacks may be cathartic, but it certainly doesn&#8217;t solve the underlying problem: That the raw materials needed to launch attacks the size of the ones that hit SpamHaus and CloudFlare last year are plentiful and freely available online. As I noted in the penultimate chapter of my new book &#8212; <a title="http://www.amazon.com/Spam-Nation-Organized-Cybercrime---Epidemic/dp/1402295618/ref=sr_1_1?ie=UTF8&amp;qid=1400765293&amp;sr=8-1&amp;keywords=spam+nation" href="http://www.amazon.com/Spam-Nation-Organized-Cybercrime---Epidemic/dp/1402295618/ref=sr_1_1?ie=UTF8&amp;qid=1400765293&amp;sr=8-1&amp;keywords=spam+nation" target="_blank">Spam Nation</a> (now <a title="http://www.nytimes.com/best-sellers-books/crime-and-punishment/list.html" href="http://www.nytimes.com/best-sellers-books/crime-and-punishment/list.html" target="_blank">a New York Times bestseller</a>, thank you dear readers!), the bad news is that little has changed since these ultra-powerful attacks first surfaced more than a decade ago.</p>
<p><strong>Rodney Joffe</strong>, senior vice president and senior technologist at Neustar &#8211;a security company that also helps clients weather huge online attacks &#8212; estimates that there are approximately 25 million misconfigured or antiquated home and business routers that can be abused in these digital sieges. From the book:</p>
<blockquote><p>Most of these are home routers supplied by ISPs or misconfigured business routers, but a great many of the devices are at ISPs in developing countries or at Internet providers that see no economic upside to spending money for the greater good of the Internet.</p>
<p>“In almost all cases, it’s an option that’s configurable by the ISP, but you have to get the ISP to do it,” Joffe said. “Many of these ISPs are on very thin margins and have no interest in going through the process of protecting their end users— or the rest of the Internet’s users, for that matter.”</p>
<p>And therein lies the problem. Not long ago, if a spammer or hacker wanted to launch a massive Internet attack, he had to assemble a huge botnet that included legions of hacked PCs. These days, such an attacker need not build such a huge bot army. Armed with just a few hundred bot- infected PCs, Joffe said, attackers today can take down nearly any target on the Internet, thanks to the millions of misconfigured Internet routers that are ready to be conscripted into the attack at a moment’s notice.</p>
<p>“If the bad guys launch an attack, they might start off by abusing 20,000 of these misconfigured servers, and if the target is still up and online, they’ll increase it to 50,000,” Joffe said. “In most cases, they only need to go to 100,000 to take the bigger sites offline, but there are 25 million of these available.”</p></blockquote>
<p>If you run a network of any appreciable size, have a look for your Internet addresses in the <a title="http://openresolverproject.org/" href="http://openresolverproject.org/" target="_blank">Open Resolver Project</a>, which includes a searchable index of some <em>32 million</em> poorly configured or outdated device addresses that can be abused to launch these very damaging large-scale attacks.</p>


feed_id: http://krebsonsecurity.com/?p=29109
title: In Damage Control, Sony Targets Reporters
uri: In-Damage-Control-Sony-Targets-Reporters
url: http://krebsonsecurity.com/2014/12/in-damage-control-sony-targets-reporters/
content:
<p>Over the weekend I received a nice holiday letter from lawyers representing <strong>Sony Pictures Entertainment</strong>, demanding that I cease publishing detailed stories about the company&#8217;s recent hacking and delete any company data collected in the process of reporting on the breach. While I have not been the most prolific writer about this incident to date, rest assured such threats will not deter this reporter from covering important news and facts related to the breach.</p>
<div id="attachment_29111" style="width: 295px" class="wp-caption alignright"><a href="media/6cb7437e.sonyletter-2.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/sonyletter-2.png"><img class="size-medium wp-image-29111" src="media/4cdf216d.sonyletter-2-285x286.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/sonyletter-2-285x286.png" alt="A letter from Sony's lawyers." width="285" height="286" /></a><p class="wp-caption-text">A letter from Sony&#8217;s lawyers.</p></div>
<p>&#8220;SPE does not consent to your possession, review, copying, dissemination, publication, uploading, downloading, or making any use of the Stolen information, and to request your cooperation in destroying the Stolen Information,&#8221; wrote SPE&#8217;s lawyers, who hail from the law firm of <strong>Boies, Schiller &amp; Flexner</strong>.</p>
<p>This letter reminds me of one that I received several years back from the lawyers of <a title="http://krebsonsecurity.com/2011/09/pharma-wars-paying-for-prosecution/" href="http://krebsonsecurity.com/2011/09/pharma-wars-paying-for-prosecution/" target="_blank">Igor Gusev</a>, one of the main characters in my book, <a title="http://www.amazon.com/Spam-Nation-Organized-Cybercrime---Epidemic/dp/1402295618/ref=sr_1_1?ie=UTF8&amp;qid=1400765293&amp;sr=8-1&amp;keywords=spam+nation" href="http://www.amazon.com/Spam-Nation-Organized-Cybercrime---Epidemic/dp/1402295618/ref=sr_1_1?ie=UTF8&amp;qid=1400765293&amp;sr=8-1&amp;keywords=spam+nation" target="_blank">Spam Nation</a>. Mr. Gusev&#8217;s attorneys insisted that I was publishing stolen information &#8212; pictures of him, financial records from his spam empire &#8220;SpamIt&#8221; &#8212; and that I remove all offending items and publish an apology. My lawyer in that instance called Gusev&#8217;s threat a &#8220;blivit,&#8221; a term coined by the late, great author <strong>Kurt Vonnegut</strong>, who defined it as &#8220;two pounds of shit in a one-pound bag.&#8221;</p>
<p>For a more nuanced and scholarly look at whether reporters and bloggers who write about Sony&#8217;s hacking should be concerned after receiving this letter, I turn to an analysis by UCLA law professor <strong>Eugene Volokh</strong>, who posits that Sony &#8220;probably&#8221; does not have a legal leg to stand on here in demanding that reporters refrain from writing about the extent of SPE&#8217;s hacking in great detail. But Volokh includes some useful caveats to this conclusion (and exceptions to those exceptions), notably:</p>
<p>&#8220;Some particular publications of specific information in the Sony material might lead to a successful lawsuit,&#8221; Volokh <a title="http://www.washingtonpost.com/news/volokh-conspiracy/wp/2014/12/15/can-sony-sue-media-outlets-who-publish-the-stolen-sony-documents/" href="http://www.washingtonpost.com/news/volokh-conspiracy/wp/2014/12/15/can-sony-sue-media-outlets-who-publish-the-stolen-sony-documents/" target="_blank">writes</a>. &#8220;First, disclosure of facts about particular people that are seen as highly private (e.g., medical or sexual information) and not newsworthy might be actionable under the &#8216;disclosure of private facts&#8217; tort.&#8221;<span id="more-29109"></span></p>
<p>Volokh observes that if a publication were to publish huge troves of data stolen from Sony, doing so might be seen as copyright infringement. &#8220;The bottom line is that publication of short quotes, or disclosure of the facts from e-mails without the use of the precise phrasing from the e-mail, would likely not be infringement — it would either be fair use or the lawful use of facts rather than of creative expression,&#8221; he writes.</p>
<p>Volokh concludes that Sony is unlikely to prevail — &#8220;either by eventually winning in court, or by scaring off prospective publishers — especially against the well-counseled, relatively deep-pocketed, and insured media organizations that it’s threatening,&#8221; he writes. &#8220;Maybe the law ought to be otherwise (or maybe not). But in any event this is my sense of the precedents as they actually are.&#8221;</p>
<p>This is actually the second time this month I&#8217;ve received threatening missives from entities representing Sony Pictures. On Dec. 5, I got an email from a company called <strong>Entura</strong>, which requested that I remove a link from my story that the firm said &#8220;allowed for the transmission and/or downloading of the Stolen Files.&#8221; That link was in fact not even a Sony document; it was a derivative work &#8212; <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/tree.txt" href="http://krebsonsecurity.com/wp-content/uploads/2014/12/tree.txt" target="_blank">a lengthy text file</a> listing the directory tree of all the files stolen and leaked (at the time) from SPE. Needless to say, I did not remove that link or file.</p>
<p>Here is the <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/24-Krebs-on-Security.pdf" href="media/36c77c4a.24-Krebs-on-Security.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/24-Krebs-on-Security.pdf" target="_blank">full letter from SPE&#8217;s lawyers</a> (PDF).</p>


feed_id: http://krebsonsecurity.com/?p=29121
title: Banks: Park-n-Fly Online Card Breach
uri: Banks-Park-n-Fly-Online-Card-Breach
url: http://krebsonsecurity.com/2014/12/banks-park-n-fly-online-card-breach/
content:
<p>Multiple financial institutions say they are seeing a pattern of fraud that indicates an online credit card breach has hit <a title="http://www.pnf.com" href="http://www.pnf.com" target="_blank">Park-n-Fly</a>, an Atlanta-based offsite airport parking service that allows customers to reserve spots in advance of travel via an Internet-based reservation system. The security incident, if confirmed, would be the latest in a string of card breaches involving compromised payment systems at parking services nationwide.</p>
<p><a href="media/a62eaba8.park-n-fly.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/park-n-fly.png"><img class="alignright size-full wp-image-29129" src="media/a62eaba8.park-n-fly.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/park-n-fly.png" alt="park-n-fly" width="258" height="78" /></a>In response to questions from KrebsOnSecurity, Park-n-Fly said it recently engaged multiple outside security firms to investigate breach claims made by financial institutions, but so far has been unable to find a breach of its systems.</p>
<p>&#8220;We have been unable to find any specific issues related to the cards or transactions reported to us and by the financial institutions,&#8221; wrote <strong>Michael Robinson</strong>, the company&#8217;s senior director of information technology, said in an emailed statement. &#8220;While this kind of incident is rare for us based on our thousands of daily transactions, we do take every instance very seriously. Like any reputable company involved in e-commerce today we recognize that we must be constantly vigilant and research every claim to root out any vulnerabilities or potential gaps.&#8221;</p>
<p>Park-n-Fly&#8217;s statement continues:</p>
<p>&#8220;While we believe that our systems are very secure, including SLL encryption, <em>we have recently engaged multiple outside security firms to identify and resolve any possible gaps in our systems and as always will take any action indicated.</em> We have made all necessary precautionary upgrades and we just upgraded on 12/9 to the latest EV SSL certificate from Entrust, one of the leading certificate issuers in the industry.&#8221;</p>
<p>Nevertheless, two different banks shared information with KrebsOnSecurity that suggests Park-n-Fly &#8212; or some component of its online card processing system &#8212; has indeed experienced a breach. Both banks saw fraud on a significant number of customer cards that previously  &#8212; and quite recently &#8212; had been used online to make reservations at a number of more than 50 Park-n-Fly locations nationwide.<span id="more-29121"></span></p>
<p>Unlike card data stolen from main street retailers, which can be encoded onto new plastic and used to buy stolen goods in physical retail stores &#8212; cards stolen from online transactions can only be used by thieves for fraudulent online purchases. However, most online carding shops that sell stolen card data in underground stores market both types of cards, known in thief-speak as &#8220;dumps&#8221; and &#8220;CVVs,&#8221; respectively.</p>
<p>The CVVs stolen that bank sources traced back to Park-and-Fly are among thousands currently for sale in four large batches of card data (dubbed &#8220;Decurion&#8221;) being peddled at <a title="http://krebsonsecurity.com/?s=rescator&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=rescator&amp;x=0&amp;y=0" target="_blank"><strong>Rescator[dot]cm</strong></a>, the same crime shop that first moved cards stolen in the retail breaches at Home Depot and Target. The card data ranges in price from $6 to $9 per card, and include the card number, expiration date, 3-digit card verification code, as well as the cardholder&#8217;s name, address and phone number.</p>
<div id="attachment_29131" style="width: 610px" class="wp-caption aligncenter"><a href="media/4ab5f04b.decurion.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/decurion.png"><img class="size-large wp-image-29131" src="media/528e451f.decurion-600x247.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/decurion-600x247.png" alt="Cards that banks traced back to Park-n-Fly were all for sale at Rescator's shop." width="600" height="247" /></a><p class="wp-caption-text">Cards that banks traced back to Park-n-Fly were all for sale at Rescator&#8217;s shop.</p></div>
<p>Last month, <a title="http://www.spplus.com/sp-acts-block-payment-card-security-incident/" href="http://www.spplus.com/sp-acts-block-payment-card-security-incident/" target="_blank">SP Plus</a> &#8212; a Chicago-based parking facility provider &#8212; <a title="http://www.qconline.com/news/illinois/parking-garages-hacked-for-credit-card-data/article_dabd4256-2aa2-5005-b09e-30feecb95eb1.html" href="http://www.qconline.com/news/illinois/parking-garages-hacked-for-credit-card-data/article_dabd4256-2aa2-5005-b09e-30feecb95eb1.html" target="_blank">said</a> payment systems at 17 parking garages in Chicago, Philadelphia and Seattle that were hacked to capture credit card data after thieves installed malware to access credit card data from a remote location. Card data stolen from those SP+ locations ended up for sale on a competing cybercrime store called Goodshop.</p>
<p>In Missouri, the St. Louis Parking Company recently <a title="http://stlouisparking.com/press-release/" href="http://stlouisparking.com/press-release/" target="_blank">disclosed</a> that it learned of breach involving card data stolen from its Union Station Parking facility between Oct. 6, 2014 and Oct. 31, 2014.</p>


feed_id: http://krebsonsecurity.com/?p=29117
title: Complex Solutions to a Simple Problem
uri: Complex-Solutions-to-a-Simple-Problem
url: http://krebsonsecurity.com/2014/12/complex-solutions-to-a-simple-problem/
content:
<p>My inbox has been flooded of late with pitches for new technologies aimed at making credit cards safer and more secure. Many of these solutions are exceedingly complex and overwrought &#8212; if well-intentioned &#8212; responses to a problem that we already know how to solve. Here&#8217;s a look at a few of the more elaborate approaches.</p>
<div id="attachment_29151" style="width: 610px" class="wp-caption aligncenter"><a href="media/40122cb9.sirenswipe.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/sirenswipe.png"><img class="size-large wp-image-29151" src="media/4ca4ec75.sirenswipe-600x313.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/sirenswipe-600x313.png" alt="A promotion for the Siren Swipe technology." width="600" height="313" /></a><p class="wp-caption-text">A promotion for the Siren Swipe technology.</p></div>
<p>Some of these ideas may have benefited from additional research into where financial institutions actually experience most of their fraud losses. Hint: Lost-and-stolen fraud is minuscule compared to losses from other types of fraud, such as counterfeit cards and online fraud. Case in point: A new product called <strong>Safe Swipe</strong>. From their pitch:</p>
<p>&#8220;The basic premise of our solution, Safe Swipe&#8230;is a technology which &#8216;marries&#8217; your smart mobile device, phone, tablet and or computer to your credit/debit card(s). We&#8217;ve developed a Geo-Locator software program which triangulates your location with the POS device and your mobile phone so that if your phone and credit card are not within a certain predetermined range of one another the purchase would be challenged. In addition, we incorporated an ON/OFF type switch where you can &#8216;Lock Down&#8217; your credit/debit card from your mobile device making it useless should it ever be stolen.&#8221;</p>
<p>The truth is that you can &#8220;lock down&#8221; your credit card if it&#8217;s lost or stolen by calling your credit card company and reporting it as such.  Along these lines, I received multiple pitches from the folks who dreamed up a product/service called &#8220;<strong>Siren Swipe</strong>.&#8221; Check it out:</p>
<p>&#8220;The <span class="il">SIREN</span> <span class="il">SWIPE</span> system immediately notifies local police (via the local 911 center) of a thief’s location (ie merchant address) once he<span class="il">swipes</span> a card that has already been reported stolen,&#8221; the folks at this company said in an email pitch to KrebsOnSecurity. &#8220;<span class="il">SIREN</span> <span class="il">SWIPE</span> has the potential to drastically impact the credit card fraud landscape because although card credentials being stolen is a forgone conclusion, which cards thieves decide to actually use is not.  For a thief browsing a site like <a title="http://krebsonsecurity.com/?s=Rescator&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=Rescator&amp;x=0&amp;y=0" target="_blank">Rescator,</a> the knowledge that using certain banks’ cards could result in an immediate police response can make thieves avoid using these banks’ stolen cards over and over again.  And in the best case scenario, a carder site admin could just decide not to sell subscribing banks’ cards in the interest of customer service.&#8221;</p>
<p>The sad truth is that, for the most part, cops generally have more important things to do than chase around the street urchins who end up using stolen credit and debit cards, and they&#8217;re not going to turn on the dome lights and siren over something like this. Also, the signals for fraud are all backwards here: The fraudsters know to use criminal card-checking services before buying and/or using stolen cards, so they don&#8217;t generally end up using a pile of cards that have already been cancelled.</p>
<div id="attachment_29152" style="width: 295px" class="wp-caption alignright"><a href="media/ebd97f95.quantumsec.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/quantumsec.png"><img class="size-medium wp-image-29152" src="media/8150dad2.quantumsec-285x174.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/quantumsec-285x174.png" alt="A diagram explaining Quantum Secure Authentication." width="285" height="174" /></a><p class="wp-caption-text">A diagram explaining Quantum Secure Authentication.</p></div>
<p>My favorite overwrought solution to making credit cards more secure comes from researchers in the Netherlands, who recently put out <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/Pinske_etal_quantum-secure-authentication-of-a-physical-unclonabole-key-1.pdf" href="media/4b86925c.uantum-secure-authentication-of-a-physical-unclonabole-key-1.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/Pinske_etal_quantum-secure-authentication-of-a-physical-unclonabole-key-1.pdf" target="_blank">a paper</a> announcing a card security idea they&#8217;re calling <strong>Quantum-Secure Authentication</strong>. According to its creators, this approach relies on &#8220;the unique quantum properties of light to create a secure question-and-answer exchange that cannot be spoofed or copied. From their literature:</p>
<p>&#8220;Traditional magnetic-stripe-only cards are relatively simple to use but simple to copy. Recently, banks have begun issuing so-called ‘smart cards’ that include a microprocessor chip to authenticate, identify &amp; enhance security. But regardless of how complex the code or how many layers of security, the problem remains that an attacker who obtains the information stored inside the card can copy or emulate it. The new approach&#8230;avoids this risk entirely by using the peculiar quantum properties of photons that allow them to be in multiple locations at the same time to convey the authentication questions &amp; answers. Though difficult to reconcile with our everyday experiences, this strange property of light can create a fraud-proof Q&amp;A exchange, like those used to authorize credit card transactions.&#8221;<span id="more-29117"></span></p>
<p>The main reason so many of these newfangled technologies are even being proposed is that the United States lags 20 years behind Europe and the rest of the world in adopting chip/smartcard technology in credit and debit cards. This is starting to change on both the card-issuing side (the banks) and the merchant side. Most of the biggest banks are already issuing chip cards, with smaller institutions following suit next year. In October 2015, merchants that haven&#8217;t yet installed card swipe terminals that accept chip cards will be liable for all of the fraud costs on any fraudulent transaction involving a chip card.</p>
<p>It&#8217;s unclear how much appetite there is for new technology to help banks fight card fraud, when so many financial institutions have yet to roll out chip cards. A payments fraud survey released this week by the <strong>Federal Reserve Bank of Minneapolis</strong> found that &#8220;high percentages of surveyed financial institutions report that fraud prevention costs exceed actual losses for many types of payments, especially wire, cash, and ACH payments. This trend is even more striking for non-financial respondents. I<em>n every payment category, a higher percentage of such firms responded that prevention costs exceed fraud losses</em>.&#8221;</p>
<p>The <a title="http://www.minneapolisfed.org/about/whatwedo/payments/2014PaymentsFraudSurveySummaryofRegionalResults.pdf" href="media/57bc41f2.2014PaymentsFraudSurveySummaryofRegionalResults.pdf" data-original-source="http://www.minneapolisfed.org/about/whatwedo/payments/2014PaymentsFraudSurveySummaryofRegionalResults.pdf" target="_blank">Fed survey</a> (PDF), which quizzed both banks and corporations, found that about half of the financial institutions that experienced payment fraud losses reported increases in those losses, while three quarters of the non-financial firms responded that loss rates had remained about the same over the prior year.</p>
<p>&#8220;In keeping with previous surveys, signature debit transactions are the payment type cited by the largest number of financial institutions as accounting for high levels of payments fraud losses (92% of financial service companies), while checks are cited by 75% of non-financial companies,&#8221; the Fed concluded. &#8220;While this finding could suggest that companies are overcompensating in prevention vis-à-vis likely losses, it is also possible that risk mitigation strategies and fraud prevention investments have indeed been effective.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=29159
title: FBI: North Korea to Blame for Sony Hack
uri: FBI-North-Korea-to-Blame-for-Sony-Hack
url: http://krebsonsecurity.com/2014/12/fbi-north-korea-to-blame-for-sony-hack/
content:
<p>The <strong>FBI</strong> today said it has determined that the North Korean government is responsible for the devastating recent hack attack against <strong>Sony Pictures Entertainment</strong>. Here&#8217;s a brief look the FBI&#8217;s statement, what experts are learning about North Korea&#8217;s cyberattack capabilities, and what this incident means for other corporations going forward.</p>
<p>In <a title="http://www.fbi.gov/news/pressrel/press-releases/update-on-sony-investigation?utm_campaign=email-Immediate&amp;utm_medium=email&amp;utm_source=national-press-releases&amp;utm_content=386194" href="http://www.fbi.gov/news/pressrel/press-releases/update-on-sony-investigation?utm_campaign=email-Immediate&amp;utm_medium=email&amp;utm_source=national-press-releases&amp;utm_content=386194" target="_blank">a statement</a> released early Friday afternoon, the FBI said that its investigation &#8212; along with information shared by Sony and other U.S. government departments and agencies &#8212; found that the North Korean government was responsible.</p>
<p>The FBI said it couldn&#8217;t disclose all of its sources and methods, but that the conclusion was based, in part, on the following:</p>
<blockquote><p>-&#8220;Technical analysis of the data deletion malware used in this attack revealed links to other malware that the FBI knows North Korean actors previously developed. For example, there were similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks.&#8221;</p>
<p>-&#8220;The FBI also observed significant overlap between the infrastructure used in this attack and other malicious cyber activity the U.S. government has previously linked directly to North Korea. For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack.&#8221;</p>
<p>-&#8220;Separately, the tools used in the SPE attack have similarities to a cyber attack in March of last year against South Korean banks and media outlets, which was carried out by North Korea.&#8221;</p></blockquote>
<p>The agency added that it was &#8220;deeply concerned&#8221; about the destructive nature of this attack on a private sector entity and the ordinary citizens who work there, and that the FBI stands ready to assist any U.S. company that is the victim of a destructive cyber attack or breach of confidential information.</p>
<p>&#8220;Further, North Korea’s attack on SPE reaffirms that cyber threats pose one of the gravest national security dangers to the United States,&#8221; the FBI said. &#8220;Though the FBI has seen a wide variety and increasing number of cyber intrusions, the destructive nature of this attack, coupled with its coercive nature, sets it apart. North Korea’s actions were intended to inflict significant harm on a U.S. business and suppress the right of American citizens to express themselves. Such acts of intimidation fall outside the bounds of acceptable state behavior. The FBI takes seriously any attempt—whether through cyber-enabled means, threats of violence, or otherwise—to undermine the economic and social prosperity of our citizens.&#8221;</p>
<p>SPE was hit with a strain of malware designed to wipe all computer hard drives within the company&#8217;s network. The attackers then began releasing huge troves of sensitive SPE internal documents, and, more recently, started threatening physical violence against anyone who viewed the Sony movie &#8220;The Interview,&#8221; a comedy that involves a plot to assassinate North Korean leader <strong>Kim Jong Un</strong>. Not long after a number of top movie theater chains said they would not show the film, Sony announced that it would cancel the movie&#8217;s theatrical release.</p>
<p>Apparently emboldened by Sony&#8217;s capitulation, the attackers are now making even more demands. <a title="http://money.cnn.com/2014/12/19/media/insde-sony-hack-interview/index.html?hpt=hp_t1" href="http://money.cnn.com/2014/12/19/media/insde-sony-hack-interview/index.html?hpt=hp_t1" target="_blank">According to CNN</a>, Sony executives on Thursday received an email apparently from the attackers said they would no longer release additional stolen Sony Pictures data if the company announced that it would also cancel any plans to release the movie on DVD, Netflix or elsewhere. The attackers also reportedly demanded that any teasers and trailers about The Interview online be removed from the Internet.</p>
<p>A &#8216;MAGIC WEAPON&#8217;</p>
<p>Little is publicly known about North Korea&#8217;s cyber warfare and hacking capabilities, but experts say North Korean leaders view cyber warfare capabilities as an important asymmetric asset in the face of its perceived enemies &#8212; the United States and South Korea. An <a title="http://h30499.www3.hp.com/hpeb/attachments/hpeb/off-by-on-software-security-blog/388/2/HPSR%20SecurityBriefing_Episode16_NorthKorea.pdf" href="media/92e6466f.HPSR20SecurityBriefing_Episode16_NorthKorea.pdf" data-original-source="http://h30499.www3.hp.com/hpeb/attachments/hpeb/off-by-on-software-security-blog/388/2/HPSR%20SecurityBriefing_Episode16_NorthKorea.pdf" target="_blank">in-depth report</a> (PDF) released earlier this year by HP Security Research notes that in November 2013, <span class="pullquote pqright">North Korea&#8217;s &#8220;dear leader&#8221; Kim Jong Un referred to cyber warfare capabilities as a &#8220;magic weapon&#8221; in conjunction with nuclear weapons and missiles.</span></p>
<p>&#8220;Although North Korea’s limited online presence makes a thorough analysis of their cyber warfare capabilities a difficult task, it must be noted that what is known of those capabilities closely mirrors their kinetic warfare tactics,&#8221; HP notes. &#8220;Cyber warfare is simply the modern chapter in North Korea’s long history of asymmetrical warfare. North Korea has used various unconventional tactics in the past, such as guerilla warfare, strategic use of terrain, and psychological operations. The regime also aspires to create viable nuclear weapons.&#8221;</p>
<p>Sources familiar with the investigation tell KrebsOnSecurity that the investigators believe there may have been as many as several dozen individuals involved in the attack, the bulk of whom hail from North Korea. Nearly a dozen of them are believed to reside in Japan.</p>
<div id="attachment_29168" style="width: 295px" class="wp-caption alignleft"><a href="media/10eaadea.chongryonhq.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/chongryonhq.png"><img class="size-medium wp-image-29168" src="media/011adcb5.chongryonhq-285x211.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/chongryonhq-285x211.png" alt="Headquarters of the Chongryon in Japan." width="285" height="211" /></a><p class="wp-caption-text">Headquarters of the Chongryon in Japan.</p></div>
<p>According to HP, a group of ethnic North Koreans residing in Japan known as the <strong>Chongryon</strong> are critical to North Korea&#8217;s cyber and intelligence programs, and help generate hard currency for the regime. The report quotes Japanese intelligence officials stating that &#8220;the Chongryon are vital to North Korea&#8217;s military budget, raising funds via weapons trafficking, drug trafficking, and other black market activities.&#8221; HP today <a title="http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/North-Korea-and-the-attack-on-Sony-Pictures-Entertainment/ba-p/6686796" href="http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/North-Korea-and-the-attack-on-Sony-Pictures-Entertainment/ba-p/6686796" target="_blank">published much more detail</a> about specific North Korean hacking groups that may have played a key role in the Sony incident given previous such attacks. <span id="more-29159"></span></p>
<p>While the United States government seems convinced by technical analysis and intelligence sources that the North Koreans were behind the attack, skeptics could be forgiven for having doubts about this conclusion. It is interesting to note that the attackers initially made no mention of The Interview, and instead demanded payment from Sony to forestall the release of sensitive corporate data. It wasn&#8217;t until well after the news media pounced on the idea that the attack was in apparent retribution for The Interview that we saw the attackers begin to mention the Sony movie.</p>
<p>In any case, it&#8217;s unlikely that U.S. officials relish the conclusion that North Korea is the aggressor in this attack, because it forces the government to respond in some way and few of the options are particularly palatable. The top story on the front page of the <em>The Wall Street Journal</em> today is an examination of what the U.S. response to this incident might look like, and it seems that few of the options on the table are appealing to policymakers and intelligence agencies alike.</p>
<p>The WSJ story notes that North Korea&#8217;s only connections to the Internet run through China, but that pressuring China to sever or severely restrict those connections is unlikely to work.</p>
<p>Likewise, engaging in a counter-attack could prove fruitless, or even backfire, the Journal observed, &#8220;in part because the U.S. is able to spy on North Korea by maintaining a foothold on some of its computer systems. A retaliatory cyberstrike could wind up damaging Washington&#8217;s ability to spy on Pyongyang&#8230;Another former U.S. official said policy makers remain squeamish about deploying cyberweapons against foreign targets.&#8221;</p>
<p><span style="text-decoration: underline;">IMPLICATIONS FOR US FIRMS</span></p>
<p>If this incident isn&#8217;t a giant wake-up call for U.S. corporations to get serious about cybersecurity, I don&#8217;t know what is. I&#8217;ve done more than two dozen speaking engagements around the world this year, and one point I always try to drive home is that far too few organizations recognize how much they have riding on their technology and IT operations until it is too late. The message is that if the security breaks down, the technology stops working &#8212; and if that happens the business can quickly grind to a halt. But you would be hard-pressed to witness signs that most organizations have heard and internalized that message, based on their investments in cybersecurity relative to their overall reliance on it.</p>
<p>A critical step that many organizations fail to take is keeping a basic but comprehensive and ongoing inventory of all the organization&#8217;s IT assets. Identifying where the most sensitive and mission-critical data resides (identifying the organization&#8217;s &#8220;crown jewels&#8221;) is another essential exercise, but too many organizations fail to take the critical step of encrypting this vital information.</p>
<p>Over the past several years, we&#8217;ve seen a remarkable shift toward more destructive attacks. Most organizations are accustomed to tackling malware infestations within their IT environments, but few are prepared to handle fast-moving threats designed to completely wipe data from storage drives across the network.</p>
<p>As I note in my book Spam Nation, miscreants who were once content to steal banking information and blast out unsolicited commercial email increasingly are using their skills to hold data for ransom using malware tools such as ransomware. I&#8217;m afraid that as these attackers become better at situational awareness &#8212; that is, gaining a better understanding of who their victims are and the value of the assets the intruders have under their control &#8212; these attacks and ransom demands will become more aggressive and costly in the months ahead.</p>


feed_id: http://krebsonsecurity.com/?p=29184
title: Staples: 6-Month Breach, 1.16 Million Cards
uri: Staples-6-Month-Breach-1-16-Million-Cards
url: http://krebsonsecurity.com/2014/12/staples-6-month-breach-1-16-million-cards/
content:
<p>Office supply chain <strong>Staples Inc.</strong> today finally acknowledged that a malware intrusion this year at some of its stores resulted in a credit card breach. The company now says some 119 stores were impacted between April and September 2014, and that as many as 1.16 million customer credit and debit cards may have been stolen as a result.</p>
<p><a href="media/093be403.staples.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/10/staples.png"><img class="alignright size-medium wp-image-28406" src="media/d828f72c.staples-285x180.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/10/staples-285x180.png" alt="staples" width="285" height="180" /></a>KrebsOnSecurity <a title="http://krebsonsecurity.com/2014/10/banks-credit-card-breach-at-staples-stores/" href="http://krebsonsecurity.com/2014/10/banks-credit-card-breach-at-staples-stores/" target="_blank">first reported the suspected breach</a> on Oct. 20, 2014, after hearing from multiple banks that had identified a pattern of credit and debit card fraud suggesting that several Staples office supply locations in the Northeastern United States were dealing with a data breach. At the time, Staples would say only that it was investigating “a potential issue” and had contacted law enforcement.</p>
<p>In <a title="http://staples.newshq.businesswire.com/press-release/corporate/staples-provides-update-data-security-incident" href="http://staples.newshq.businesswire.com/press-release/corporate/staples-provides-update-data-security-incident" target="_blank">a statement</a> issued today, Staples released <a title="http://staples.newshq.businesswire.com/press-release/corporate/staples-provides-update-data-security-incident" href="http://staples.newshq.businesswire.com/press-release/corporate/staples-provides-update-data-security-incident" target="_blank">a list of stores</a> (PDF) hit with the card-stealing malware, and the stores are not limited to the Northeastern United States.</p>
<p>&#8220;At 113 stores, the malware may have allowed access to this data for purchases made from August 10, 2014 through September 16, 2014,&#8221; Staples disclosed. &#8220;At two stores, the malware may have allowed access to data from purchases made from July 20, 2014 through September 16, 2014.&#8221;</p>
<p>However, the company did say that during the investigation Staples also received reports of fraudulent payment card use related to four stores in Manhattan, New York at various times from April through September 2014.<span id="more-29184"></span></p>
<p><strong>Aviv Raff,</strong> chief technology officer at <a title="http://www.seculert.com" href="http://www.seculert.com" target="_blank">Seculert</a>, said the per-store minimum time to detect and respond to the breach was an average of 40 days.</p>
<p>&#8220;Once again, much like previous breaches, the statistics of the Staples&#8217; breach shows the necessity of moving from trying to prevent an attack to try and detect and respond as quickly as possible,&#8221; Raff said.</p>
<div id="attachment_29185" style="width: 610px" class="wp-caption aligncenter"><a href="media/3de40622.compromisedstaplesstores.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/compromisedstaplesstores.png"><img class="size-large wp-image-29185" src="media/06a8b721.compromisedstaplesstores-600x357.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/compromisedstaplesstores-600x357.png" alt="Source: Seculert" width="600" height="357" /></a><p class="wp-caption-text">Source: Seculert</p></div>
<p>It appears that the attackers responsible for the Staples break-in are not the same group thought to have hit Target and Home Depot. In November, I posted <a title="http://krebsonsecurity.com/2014/11/link-found-in-staples-michaels-breaches/" href="http://krebsonsecurity.com/2014/11/link-found-in-staples-michaels-breaches/" target="_blank">a story</a> that cited sources close to the Staples investigation saying the breach at Staples impacted roughly 100 stores and was powered by some of the same criminal infrastructure seen in the <a title="http://krebsonsecurity.com/2014/01/sources-card-breach-at-michaels-stores/" href="http://krebsonsecurity.com/2014/01/sources-card-breach-at-michaels-stores/" target="_blank">intrusion disclosed earlier this year at Michaels craft stores</a>.</p>


feed_id: http://krebsonsecurity.com/?p=29191
title: Alleged Counterfeiter “Willy Clock” Arrested
uri: Alleged-Counterfeiter-Willy-Clock-Arrested
url: http://krebsonsecurity.com/2014/12/alleged-counterfeiter-willy-clock-arrested/
content:
<p>In September 2014, I wrote about <a title="http://krebsonsecurity.com/2014/09/fun-with-funny-money/" href="http://krebsonsecurity.com/2014/09/fun-with-funny-money/" target="_blank">receiving a package of $500 in counterfeit U.S. currency</a> from an unknown sender, after mentioning in <a title="http://krebsonsecurity.com/2014/08/counterfeit-u-s-cash-floods-crime-forums/" href="http://krebsonsecurity.com/2014/08/counterfeit-u-s-cash-floods-crime-forums/" target="_blank">a blog post about a rash of funny money resellers</a> flooding underground cybercrime markets. Last week, U.S. authorities announced the arrest of a Texas man charged with leading the international counterfeit currency operation from a location in the Republic of Uganda.</p>
<div id="attachment_27555" style="width: 295px" class="wp-caption alignright"><a href="media/31ece2e5.funnymoney.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/08/funnymoney.jpg"><img class="size-medium wp-image-27555" src="media/422afce8.funnymoney-285x213.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/08/funnymoney-285x213.jpg" alt="Counterfeit $100s and $50s from &quot;Willy Clock,&quot; allegedly the online alias of a Texas man living in Uganda." width="285" height="213" /></a><p class="wp-caption-text">Counterfeit $100s and $50s from &#8220;Willy Clock,&#8221; allegedly the online alias of a Texas man living in Uganda.</p></div>
<p>U.S. prosecutors say 27-year-old <strong>Ryan Andrew Gustafson</strong> &#8211; a.k.a. &#8220;Jack Farrel&#8221; and &#8220;Willy Clock&#8221; &#8212; is a U.S. citizen currently residing in Kampala, Uganda. Gustafson was arrested on Dec. 16 by Ugandan authorities and charged with conspiracy, counterfeiting, and unlawful possession of ammunition.</p>
<p>The defendant and his alleged accomplices are suspected of passing approximately $270,000 in fake U.S. currency in Uganda. In total, Ugandan authorities say they seized some $1.8 million in funny money from Gustafson&#8217;s operation.</p>
<p>The<strong> U.S. Secret Service</strong>, which investigates currency counterfeiting, said the investigation began in December 2013 when agents were alerted to the passing of counterfeit notes at retail stores and businesses in the Pittsburgh area. A <a title="http://www.justice.gov/opa/pr/criminal-charges-filed-against-us-citizen-connection-multi-million-dollar-international-cyber" href="http://www.justice.gov/opa/pr/criminal-charges-filed-against-us-citizen-connection-multi-million-dollar-international-cyber" target="_blank">press release</a> from the Justice Department outlines the rest of the investigation:</p>
<p>&#8220;Agents determined that an individual identified as J.G. had passed these notes and was renting a postal box at The UPS Store on Pittsburgh’s South Side.  On Feb 19, 2014, law enforcement learned that J.G. received three packages addressed from Beyond Computers, located in Kampala, Uganda.  Agents executing a search warrant on the packages found $7,000 in counterfeit $100, $50 and $20 FRNs located in two hidden compartments within the packaging envelopes.  A fingerprint on a document inside one of the packages was identified as belonging to Ryan Andrew Gustafson.&#8221;</p>
<div id="attachment_29231" style="width: 295px" class="wp-caption alignleft"><a href="media/57bed2af.jackfarrel-fb.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/jackfarrel-fb.png"><img class="size-medium wp-image-29231" src="media/75041102.jackfarrel-fb-285x232.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/jackfarrel-fb-285x232.png" alt="Jack Farrel's Facebook page. The U.S. Secret Service alleges that Farrel is Gustafson, a.k.a. counterfeiter &quot;Willy Clock.&quot;" width="285" height="232" /></a><p class="wp-caption-text">Jack Farrel&#8217;s Facebook page. The U.S. Secret Service alleges that Farrel is Gustafson, a.k.a. counterfeiter &#8220;Willy Clock.&#8221;</p></div>
<p>&#8220;The Secret Service subsequently worked with Ugandan authorities to identify the source of the counterfeit [cash].  Their efforts led to A.B., who admitted to sending the packages, explaining that an American named “Jack Farrel,” and another person, provided him the counterfeit notes to ship.  Based on information provided by A.B., the Secret Service used facial recognition to identify Jack Farrel as Ryan Andrew Gustafson.&#8221;</p>
<p>The government says Gustafson sold the bills through the <strong>Tor Carding Forum</strong>, a cybercrime shop that is unreachable from the regular Internet. Rather, visiting the Tor Carding Forum requires the visitor to route his communications through Tor, a free software-based service that helps users maintain anonymity by obfuscating their true location online.<span id="more-29191"></span></p>
<p>Willy Clock&#8217;s phony currency wasn&#8217;t only available via Tor. By the middle of 2014, ads for his funny money were showing up on<a title="http://krebsonsecurity.com/2014/08/counterfeit-u-s-cash-floods-crime-forums/" href="http://krebsonsecurity.com/2014/08/counterfeit-u-s-cash-floods-crime-forums/" target="_blank"> regular, Internet-based cybercrime forums</a>. One reseller of Willy Clock&#8217;s notes even set up his own sales thread on <strong>Reddit</strong>.</p>
<p>Once again, it appears that sloppy operational security contributed to an arrest of an alleged bad guy. According to the <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/Gustafson.pdf" href="media/3b3a4d35.Gustafson.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/Gustafson.pdf" target="_blank">government&#8217;s complaint</a> (PDF), the email address that Gustafson provided on his U.S. passport application was the same one he allegedly used to maintain a <a title="https://www.facebook.com/jack.farrel.94?fref=ts" href="https://www.facebook.com/jack.farrel.94?fref=ts" target="_blank">Facebook account under the Jack Farrel alias</a>. Investigators found that Gustafson also used the same Internet address to access his real Facebook page and the Farrel account. Another <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/jack-neversurrender.png" href="media/cb51ce89.jack-neversurrender.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/jack-neversurrender.png" target="_blank">Facebook page tied to the Jack Farrel identity</a> says the accused was in Uganda as a project associate at the U.N. refugee shelter program.</p>


feed_id: http://krebsonsecurity.com/?p=29206
title: Gang Hacked ATMs from Inside Banks
uri: Gang-Hacked-ATMs-from-Inside-Banks
url: http://krebsonsecurity.com/2014/12/gang-hacked-atms-from-inside-banks/
content:
<p>An organized gang of hackers from Russia and Ukraine has broken into internal networks at dozens of financial institutions and installed malicious software that allowed the gang to drain bank ATMs of cash. While none of the victim institutions were in the United States or Western Europe, experts say the stealthy methods used by the attackers in these heists would likely work across a broad range of western banks.</p>
<p><a href="media/56e48230.robotrobkb.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/04/robotrobkb.jpg"><img class="alignright size-medium wp-image-19914" src="media/218e39d8.robotrobkb-285x213.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/04/robotrobkb-285x213.jpg" alt="robotrobkb" width="285" height="213" /></a>Most cybercrime targets consumers and businesses, stealing account information such as passwords and other data that lets thieves cash out hijacked bank accounts, as well as credit and debit cards. But this gang specializes in hacking into banks directly, and then working out ingenious ways to funnel cash directly from the financial institution itself.</p>
<p>A number of the gang&#8217;s members are believed to be tied to a group of Eastern European hackers accused of stealing more than USD $2 million from Russian banks using a powerful, custom-made banking trojan known as <a title="http://krebsonsecurity.com/?s=carberp&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=carberp&amp;x=0&amp;y=0" target="_blank">Carberp</a>. Eight men in Moscow <a title="https://nakedsecurity.sophos.com/2012/03/20/carberp-gang-arrested-in-russia-after-victimizing-russians/" href="https://nakedsecurity.sophos.com/2012/03/20/carberp-gang-arrested-in-russia-after-victimizing-russians/" target="_blank">were arrested in 2012</a> and accused of building and using Carberp, but sources say the core members of the gang were out of jail within hours after their arrest and have been busy rebuilding their crime machine ever since.</p>
<p>According to report released today by <a title="http://www.fox-it.com" href="http://www.fox-it.com" target="_blank">Fox-IT</a> and <a title="http://www.group-ib.com" href="http://www.group-ib.com" target="_blank">Group-IB</a>, security firms based in The Netherlands and Russia, respectively, the Carberp guys have since changed their tactics: Instead of stealing from thousands of bank account holders, this gang has decided to focus on siphoning funds right out of banks&#8217; coffers. So far, the security firms report, the gang has stolen more than $15 million from Eastern European banks.</p>
<p>To gain a foothold inside financial institutions, this crime group &#8212; dubbed the &#8220;<strong>Anunak group</strong>&#8221; &#8212; sent bank employees targeted, malware-laced emails made to look like the missives were sent by Russian banking regulators. The phishing emails contained malicious software designed to exploit recently-patched security holes in <strong>Microsoft Office</strong> products.</p>
<p>Incredibly, the group also reportedly <em>bought access to Windows PCs at targeted banks that were already compromised by opportunistic malware spread by other cyber criminals</em>. Indeed, Fox-IT and Group-IB report that the Anunak gang routinely purchased installations of their banking malware from other cybercriminals who operated massive botnets (collections of hacked PCs).</p>
<p>Once inside a financial institution, the criminals typically abused that access to launch even more convincing spear-phishing attacks against other banks. They also gained access to isolated bank network segments that handled ATM transactions, downloading malicious programs made to work specifically with <strong>Wincor</strong> ATMs. The hackers used that malware &#8212; along with a modified legitimate program for managing ATM cash trays &#8212; to change the denomination settings for bank notes in 52 different ATMs.</p>
<p>As a result, they were able to make it so that when co-conspirators went to affected ATMs to withdraw 10 bills totaling 100 Russian rubles, they were instead issued 10 bank notes with the denomination of 5,000 rubles, the report notes.</p>
<div id="attachment_29218" style="width: 610px" class="wp-caption aligncenter"><a href="media/39f43245.kdiag.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/kdiag.png"><img class="size-large wp-image-29218" src="media/cc3f34c2.kdiag-600x308.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/kdiag-600x308.png" alt="The Anunak gang reportedly modified this legitimate program for managing bill denominations in ATMs." width="600" height="308" /></a><p class="wp-caption-text">The Anunak gang reportedly modified this legitimate program for managing bill denominations in ATMs.</p></div>
<p><span id="more-29206"></span>It was bad enough that this group is believed to have hacked into more than 50 Russian banks, but nasty messages encoded into the malware tools employed by the thieves suggest they hold utter contempt for their targets. One malware component the group used to infect targeted systems carried inside of itself the text string &#8220;LOL BANK FUCKIUNG&#8221;. Another strain of malware deployed by this group&#8217;s targeted email campaigns and used to build their own botnet of more than a quarter-million PCs was encrypted with a key that is the <a title="http://www.fastsum.com/support/md5-checksum-utility-faq/md5-hash.php" href="http://www.fastsum.com/support/md5-checksum-utility-faq/md5-hash.php" target="_blank">MD5 hash</a> of the string &#8220;go fuck yourself.&#8221;</p>
<p>While they appear to have developed a penchant for stealing directly from banks, these crooks aren&#8217;t above going after easy money: Sources tell KrebsOnSecurity that this group of hackers is thought to be the same criminal gang responsible for several credit and debit card breaches at major retailers across the United States, including women&#8217;s clothier <a title="http://krebsonsecurity.com/2014/12/banks-credit-card-breach-at-bebe-stores/" href="http://krebsonsecurity.com/2014/12/banks-credit-card-breach-at-bebe-stores/" target="_blank">Bebe Stores Inc.</a>, western wear store <a title="http://www.kansascity.com/news/business/article2169946.html" href="http://www.kansascity.com/news/business/article2169946.html" target="_blank">Sheplers</a>, and office supply store <a title="http://krebsonsecurity.com/?s=staples&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=staples&amp;x=0&amp;y=0" target="_blank">Staples Inc</a>.</p>
<p>A separate source previously <a title="http://krebsonsecurity.com/2014/11/link-found-in-staples-michaels-breaches/" href="http://krebsonsecurity.com/2014/11/link-found-in-staples-michaels-breaches/" target="_blank">told this author</a> that there was a connection between the point-of-sale malware used in the breach at <a title="http://krebsonsecurity.com/?s=michaels&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=michaels&amp;x=0&amp;y=0" target="_blank">Michaels</a> and the Staples incident, which means this group may also have been involved in the Michaels breach. In any case, Group-IB and Fox-IT note that the Anunak gang has hit a total of 16 retailers so far.</p>
<p>The attacks from Anunak showcase once again how important it is for organizations to refocus more resources away from preventing intrusions toward detecting intrusions as quickly as possible and stopping the bleeding. According to the report, the average time from the moment this group breaks into bank internal networks and the successful theft of cash is a whopping 42 days.</p>
<p>The full report on the Anunak group is available <a title="http://www.group-ib.com/files/Anunak_APT_against_financial_institutions.pdf" href="media/fa4a0aed.Anunak_APT_against_financial_institutions.pdf" data-original-source="http://www.group-ib.com/files/Anunak_APT_against_financial_institutions.pdf" target="_blank">here</a> (PDF).</p>


feed_id: http://krebsonsecurity.com/?p=29249
title: The Case for N. Korea’s Role in Sony Hack
uri: The-Case-for-N-Korea-s-Role-in-Sony-Hack
url: http://krebsonsecurity.com/2014/12/the-case-for-n-koreas-role-in-sony-hack/
content:
<p>There are still many unanswered questions about the recent attack on <strong>Sony Pictures Entertainment</strong>, such as how the attackers broke in, how long they were inside Sony&#8217;s network, whether they had inside help, and how the attackers managed to steal terabytes of data without notice. To date, a sizable number of readers remain unconvinced about the one conclusion that many security experts and the U.S. government now agree upon: That North Korea was to blame. This post examines some compelling evidence from past such attacks that has helped inform that conclusion.</p>
<div id="attachment_29252" style="width: 295px" class="wp-caption alignright"><a href="media/80a506ed.nkcyber.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/nkcyber.png"><img class="size-medium wp-image-29252" src="media/c5f420ed.nkcyber-285x198.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/nkcyber-285x198.png" alt="An image from HP, captioned &quot;North Korean students training for cyberwar.&quot;" width="285" height="198" /></a><p class="wp-caption-text">An image from HP, captioned &#8220;North Korean students training for cyberwar.&#8221;</p></div>
<p>The last time the world saw an attack like the one that slammed SPE was on March 20, 2013, when computer networks running three major South Korean banks and two of the country&#8217;s largest television broadcasters <a title="http://www.nytimes.com/2013/03/21/world/asia/south-korea-computer-network-crashes.html" href="http://www.nytimes.com/2013/03/21/world/asia/south-korea-computer-network-crashes.html" target="_blank">were hit with crippling attacks</a> that knocked them offline and left many South Koreans unable to withdraw money from ATMs. The attacks came as American and South Korean military forces were conducting joint exercises in the Korean Peninsula.</p>
<p>That attack relied in part on malware dubbed &#8220;Dark Seoul,&#8221; which was designed to overwrite the initial sections of an infected computer&#8217;s hard drive. The data wiping component used in the attack overwrote information on infected hard drives by repeating the words &#8220;hastati&#8221; or &#8220;principes,&#8221; depending on which version of the wiper malware was uploaded to the compromised host.</p>
<p>Both of those terms reference the <a title="http://en.wikipedia.org/wiki/Hastati" href="http://en.wikipedia.org/wiki/Hastati" target="_blank">military classes of ancient Rome</a>: &#8220;hastati&#8221; were the younger, poorer soldiers typically on the front lines; the &#8220;principes&#8221; referred to more hardened, seasoned soldiers. According to a detailed white paper from <a title="http://www.mcafee.com/us/resources/white-papers/wp-dissecting-operation-troy.pdf" href="media/5e476bd3.wp-dissecting-operation-troy.pdf" data-original-source="http://www.mcafee.com/us/resources/white-papers/wp-dissecting-operation-troy.pdf" target="_blank">McAfee</a>, the attackers left a calling card a day after the attacks in the form of a web pop-up message claiming that the <strong>NewRomanic Cyber Army Team</strong> was responsible and had leaked private information from several banks and media companies and destroyed data on a large number of machines.</p>
<p>The message read:</p>
<blockquote><p>“Hi, Dear Friends, We are very happy to inform you the following news. We, NewRomanic Cyber Army Team, verified our #OPFuckKorea2003. We have now a great deal of personal information in our hands. Those includes; 2.49M of [redacted by Mcafee] member table data, cms_info more than 50M from [redacted]. Much information from [redacted] Bank. We destroyed more than 0.18M of PCs. Many auth Hope you are lucky. 11th, 12th, 13th, 21st, 23rd and 27th HASTATI Detachment. Part of PRINCIPES Elements. p.s For more information, please visit www.dropbox.com login with joseph.r.ulatoski@gmail.com::lqaz@WSX3edc$RFV. Please also visit pastebin.com.”</p></blockquote>
<p>The McAfee report, and a similarly in-depth report from <strong>HP Security</strong>, mentions that another group calling itself the <strong>Whois Team</strong> &#8212; which defaced a South Korean network provider during the attack &#8212; also took responsibility for the destructive Dark Seoul attacks in 2013. But both companies say they believe the NewRomanic Cyber Army Team and the Whois Team are essentially the same group. As Russian security firm <strong>Kaspersky</strong> <a title="http://securelist.com/blog/research/67985/destover/" href="http://securelist.com/blog/research/67985/destover/" target="_blank">notes</a>, the images used by the WhoisTeam and the warning messages left for Sony are remarkably similar:</p>
<div id="attachment_29254" style="width: 610px" class="wp-caption aligncenter"><a href="media/69149dbc.whois-sony.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/whois-sony.png"><img class="size-large wp-image-29254" src="media/668b2006.whois-sony-600x274.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/whois-sony-600x274.png" alt="The defacement message left by the Whois Team in the 2013 Dark Seoul attacks (left) and the message left for Sony (right)." width="600" height="274" /></a><p class="wp-caption-text">The defacement message left by the Whois Team in the 2013 Dark Seoul attacks (left) and the message left for Sony (right).</p></div>
<p>Interestingly, the attacks on Sony also were preceded by the theft of data that was later leaked on <strong>Pastebin</strong> and via <strong>Dropbox</strong>. But how long were the attackers in the Sony case inside Sony&#8217;s network before they began wiping drives? And how did they move tens of terabytes of data off of Sony&#8217;s network without notice? Those questions remain unanswered, but the McAfee paper holds a few possible clues.<span id="more-29249"></span></p>
<p><span style="text-decoration: underline;">A LENGTHY CAMPAIGN</span></p>
<p>McAfee posits that, based on the compile times of the backdoor malware used to upload the drive-wiping malware, the targets in the Dark Seoul attacks were likely compromised by a remote-access Trojan delivered by a spear-phishing campaign at least two months before the data destruction began. More importantly, McAfee concludes that the data-wiping and backdoor malware used in the Dark Seoul attack was but a small component of an elaborate cyber-espionage campaign that started in 2009 and targeted only South Korean assets.</p>
<blockquote><p>&#8220;McAfee Labs has uncovered a sophisticated military spying network targeting South Korea that has been in operation since 2009. Our analysis shows this network is connected to the Dark Seoul incident. Furthermore, we have also determined that a single group has been behind a series of threats targeting South Korea since October 2009. In this case the adversary had designed a sophisticated encrypted network designed to gather intelligence on military networks.</p>
<p>We have confirmed cases of Trojans operating through these networks in 2009, 2010, 2011, and 2013. <em>This network </em><em>was designed to camouflage all communications between the infected systems and the control servers via the Microsoft </em><em>Cryptography API using RSA 128-bit encryption. Everything extracted from these military networks would be transmitted </em><em>over this encrypted network once the malware identified interesting information</em>. What makes this case particularly interesting is the use of automated reconnaissance tools to identify what specific military information internal systems contained before the attackers tried to grab any of the files.&#8221;</p></blockquote>
<p>The espionage malware was looking for files that contained specific terms that might indicate they harbored information about U.S. and Korean military cooperation, including &#8220;U.S. Army&#8221; and &#8220;<a title="http://en.wikipedia.org/wiki/Key_Resolve" href="http://en.wikipedia.org/wiki/Key_Resolve" target="_blank">Operation Key Resolve</a>,&#8221; an annual military exercise held by U.S. forces and the South Korean military.</p>
<div id="attachment_29257" style="width: 260px" class="wp-caption alignright"><a href="media/ff337361.nkmissile.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/nkmissile.png"><img class="size-full wp-image-29257" src="media/ff337361.nkmissile.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/nkmissile.png" alt="A missile launched by North Korea on July 4, 2009." width="250" height="219" /></a><p class="wp-caption-text">A missile launched by North Korea on July 4, 2009.</p></div>
<p>The Dark Seoul attacks were hardly an isolated incident. In 2011, the same  Korean bank that was attacked in the 2013 incident was also hit with denial-of-service attacks and destructive malware. On July 4, 2009, <a title="http://en.wikipedia.org/wiki/July_2009_cyber_attacks" href="http://en.wikipedia.org/wiki/July_2009_cyber_attacks" target="_blank">a wave of denial-of-service attacks</a> washed over more than two dozen Korean and U.S. Government Web sites, including the White House and the Pentagon. July 4 is Independence Day in the United States, <em>but it also happened to be the very day that North Korea <a title="http://en.wikipedia.org/wiki/2009_North_Korean_missile_test" href="http://en.wikipedia.org/wiki/2009_North_Korean_missile_test" target="_blank">launched seven short-range missiles</a> into the Sea of Japan</em> in a show of military might. By the time the third wave of that attack subsided on July 9, the assailants had pushed malware to tens of thousands of zombie computers used in the assault that <a title="http://news.cnet.com/8301-1009_3-10284281-83.html" href="http://news.cnet.com/8301-1009_3-10284281-83.html" target="_blank">wiped all data from the machines</a>.</p>
<p>The co-founder of CrowdStrike, a security firm that focuses heavily on identifying attribution and actors behind major cybercrime attacks, said his firm has a &#8220;very high degree of confidence that the FBI is correct in&#8221; attributing the attack against Sony Pictures to North Korean hackers, and that CrowdStrike came to this conclusion independently long before the FBI came out with its announcement last week.</p>
<p>&#8220;We have a high-confidence that this is a North Korean operator based on the profiles seen dating back to 2006, including prior espionage against the South Korean and U.S. government and  military institutions,&#8221; said  <strong>Dmitri Alperovitch</strong>, chief technology officer and co-founder at CrowdStrike.</p>
<p>&#8220;These events are all connected, through both the infrastructure overlap and the malware analysis, and they are connected to the Sony attack,&#8221; Alperovitch said. &#8220;We haven&#8217;t seen the skeptics produce any evidence that it wasn&#8217;t North Korea, because there is pretty good technical attribution here. I want to know how many other hacking groups are so interested in things like Key Resolve.&#8221;</p>
<div id="attachment_29255" style="width: 295px" class="wp-caption alignleft"><a href="media/4424fd16.chollima.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/chollima.png"><img class="size-medium wp-image-29255" src="media/bce01e58.chollima-285x259.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/chollima-285x259.png" alt="A Chollima statue in North Korea." width="285" height="259" /></a><p class="wp-caption-text">A Chollima statue in North Korea.</p></div>
<p>Security firms like HP <a title="http://h30499.www3.hp.com/hpeb/attachments/hpeb/off-by-on-software-security-blog/388/2/HPSR%20SecurityBriefing_Episode16_NorthKorea.pdf" href="media/92e6466f.HPSR20SecurityBriefing_Episode16_NorthKorea.pdf" data-original-source="http://h30499.www3.hp.com/hpeb/attachments/hpeb/off-by-on-software-security-blog/388/2/HPSR%20SecurityBriefing_Episode16_NorthKorea.pdf" target="_blank">refer</a> to the North Korean hacking team as the &#8220;Hastati&#8221; group, but CrowdStrike calls them by a different nickname: &#8220;Silent Chollima.&#8221; A <a title="http://en.wikipedia.org/wiki/Chollima" href="http://en.wikipedia.org/wiki/Chollima" target="_blank">Chollima</a> is a mythical winged horse which originates from the Chinese classics.</p>
<p>&#8220;North Korea is one of the few countries that doesn&#8217;t have a real animal as a national animal,&#8221; Alperovitch said. &#8220;Which, I think, tells you a lot about the country itself.&#8221;</p>
<p>The &#8220;silent&#8221; part of the moniker is a reference to the stubborn fact that little is known about the hackers themselves. Unlike hacker groups in other countries where it is common to find miscreants with multiple profiles on social networks and hacker forums that can be used to build a more complete profile of the attackers &#8212; the North Koreans heavily restrict the use of Internet communications, even for their cyber warriors.</p>
<p>&#8220;First of all, they don’t have a ton of Internet infrastructure in North Korea, and they don’t have forums and social media which typically helps you identify, for example, whether an attack is from Russians or the Chinese,&#8221; Alperovitch said. &#8220;In general, the North Korean regime is one of the hardest intelligence targets for the intelligence and cyber attribution communities.&#8221;</p>
<p>On Monday, the folks at <strong>Dyn Research</strong> &#8212; a company that tracks Internet connectivity issues around the globe &#8212; said its sensors noted that North Korea <a title="http://research.dyn.com/2014/12/who-disconnected-north-korea/" href="http://research.dyn.com/2014/12/who-disconnected-north-korea/" target="_blank">inexplicably went offline</a> on Monday, Dec. 22, at around 16:15 UTC (01:15 UTC Tuesday in the North Korean capital of Pyongyang). But the researchers stopped short of attributing a reason behind the outage.</p>
<p>&#8220;Who caused this, and how?,&#8221; wrote <strong>Jim Cowie</strong>, chief scientist at Dyn. &#8220;A long pattern of up-and-down connectivity, followed by a total outage, seems consistent with a fragile network under external attack. But it’s also consistent with more common causes, such as power problems.&#8221;</p>
<p>Interestingly, this pattern of downtime also was witnessed directly following the above-described 2013 attacks that targeted South Korean banks and media firms. According to <strong>Jason Lancaster</strong>, a security researcher at HP, <a title="http://bgp.he.net/AS131279#_prefixes" href="http://bgp.he.net/AS131279#_prefixes" target="_blank">the entire North Korean Internet space</a> suffered a similar outage around the same time as the 2013 offensive against South Korea.</p>
<p>&#8220;When they came back online, one of those four [<a title="https://www.robtex.com/as/as131279.html" href="https://www.robtex.com/as/as131279.html" target="_blank">North Korean Internet address blocks</a>] was routing through an Intelsat satellite connection,&#8221; Lancaster said. &#8220;What caused the 2013 outage? They never determined the cause. The speculation was that they were under attack, but there was never any proof of that happening.&#8221;</p>
<p>Additional reading:</p>
<p><a title="https://www.us-cert.gov/ncas/alerts/TA14-353A" href="https://www.us-cert.gov/ncas/alerts/TA14-353A" target="_blank">US-CERT analysis</a> of the computer worm used in the attack on Sony.</p>
<p>TaoSecurity Blog: <a title="http://taosecurity.blogspot.be/2014/12/what-does-responsibility-mean-for.html?m=1" href="http://taosecurity.blogspot.be/2014/12/what-does-responsibility-mean-for.html?m=1" target="_blank">What Does &#8216;Responsibility&#8217; Mean for Attribution?</a></p>
<p><a title="http://www.mcafee.com/us/resources/white-papers/wp-dissecting-operation-troy.pdf" href="media/5e476bd3.wp-dissecting-operation-troy.pdf" data-original-source="http://www.mcafee.com/us/resources/white-papers/wp-dissecting-operation-troy.pdf" target="_blank">McAfee report</a> on Dark Seoul attacks (PDF)</p>
<p>HP Security: <a title="http://h30499.www3.hp.com/hpeb/attachments/hpeb/off-by-on-software-security-blog/388/2/HPSR%20SecurityBriefing_Episode16_NorthKorea.pdf" href="media/92e6466f.HPSR20SecurityBriefing_Episode16_NorthKorea.pdf" data-original-source="http://h30499.www3.hp.com/hpeb/attachments/hpeb/off-by-on-software-security-blog/388/2/HPSR%20SecurityBriefing_Episode16_NorthKorea.pdf" target="_blank">Profiling an Enigma &#8211; The Mystery of North Korea&#8217;s Cyber Threat Landscape</a> (PDF)</p>


feed_id: http://krebsonsecurity.com/?p=29246
title: Payday Loan Network Sold Info to Scammers
uri: Payday-Loan-Network-Sold-Info-to-Scammers
url: http://krebsonsecurity.com/2014/12/payday-loan-network-sold-info-to-scammers/
content:
<p><strong>The Federal Trade Commission</strong> announced this week it is suing a consumer data broker that sold payday loan application data to scammers who used the information to pull money out of consumer bank accounts. The scam brings to mind <a title="http://krebsonsecurity.com/2012/09/id-theft-service-tied-to-payday-loan-sites/" href="http://krebsonsecurity.com/2012/09/id-theft-service-tied-to-payday-loan-sites/" target="_blank">an underground identity theft service</a> I wrote about in 2012 that was gathering its data from a network of payday loan sites.</p>
<div id="attachment_16831" style="width: 295px" class="wp-caption alignright"><a class="lightbox" href="media/8e3dedd2.usearchingpricelookup.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2012/09/usearchingpricelookup.png"><img class="size-medium wp-image-16831" src="media/60b200fb.usearchingpricelookup-285x267.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2012/09/usearchingpricelookup-285x267.png" alt="Usearching.info sold sensitive data taken from payday loan networks." width="285" height="267" /></a><p class="wp-caption-text">Usearching.info sold sensitive data taken from payday loan networks.</p></div>
<p>According to the FTC’s complaint, data broker <strong>LeapLab</strong> bought payday loan applications of financially strapped consumers, and then sold that information to marketers whom it knew had no legitimate need for it. &#8220;At least one of those marketers, <strong>Ideal Financial Solutions</strong> – a defendant in another FTC case – allegedly used the information to withdraw millions of dollars from consumers’ accounts without their authorization,&#8221; the FTC <a title="http://www.ftc.gov/news-events/press-releases/2014/12/ftc-charges-data-broker-facilitating-theft-millions-dollars?utm_source=govdelivery" href="http://www.ftc.gov/news-events/press-releases/2014/12/ftc-charges-data-broker-facilitating-theft-millions-dollars?utm_source=govdelivery" target="_blank">said</a>.</p>
<p>The FTC charges that the defendants sold approximately five percent of these loan applications to online lenders, who paid them between $10 and $150 per lead. But the defendants also allegedly sold the remaining 95 percent for approximately $0.50 each to third parties who were not online lenders and had no legitimate need for this financial information.</p>
<p>In Sept. 2012, I published a blog post about &#8220;<strong>Usearching[dot]info</strong>,&#8221; a now-defunct ID theft service that offered the ability to purchase personal information on countless Americans, including SSN, mother’s maiden name, date of birth, email address, and physical address, as well as and driver license data for approximately 75 million citizens in Florida, Idaho, Iowa, Minnesota, Mississippi, Ohio, Texas and Wisconsin.</p>
<p>That story noted that Usearching[dot]info also included data that appeared to come from another source &#8212; more than 330,000 consumer bank account records pulled from an archipelago of satellite Web sites that negotiate with a variety of lenders to offer payday loans. From that piece:</p>
<blockquote><p>&#8220;I first began to suspect the information was coming from loan sites when I had a look at the data fields available in each record. A trusted source opened and funded an account at Usearching.info, and purchased 80 of these records, at a total cost of about $20. Each includes the following data: A record number, date of record acquisition, status of application (rejected/appproved/pending), applicant’s name, email address, physical address, phone number, Social Security number, date of birth, bank name, account and routing number, employer name, and the length of time at the current job. These records are sold in bulk, with per-record prices ranging from 16 to 25 cents depending on volume.&#8221;</p>
<p>&#8220;But it wasn’t until I started calling the people listed in the records that a clearer picture began to emerge. I spoke with more than a dozen individuals whose data was being sold, and found that all had applied for payday loans on or around the date in their respective records. The trouble was, the records my source obtained were all dated October 2011, and almost nobody I spoke with could recall the name of the site they’d used to apply for the loan. All said, however, that they’d initially provided their information to one site, and then were redirected to a number of different payday loan options.&#8221;</p></blockquote>
<p>I have no idea whether LeapLab sold information to this identity theft service, or whether Ideal Financial was a customer of Usearching[dot]info. LeapLab is no longer in business, and Ideal&#8217;s assets <a title="http://www.idealreceiver.com/" href="http://www.idealreceiver.com/" target="_blank">are frozen and in receivership</a>. But it&#8217;s clear Ideal obtained consumer data from multiple sources: The FTC says LeapLab provided Ideal Financial with financial account information for only about 16 percent of Ideal Financial’s victims.</p>
<p>In this, as with so many financial scams, the people least able to afford it get scammed and fleeced. The FTC charges that Ideal Financial purchased information on at least 2.2 million consumers from data brokers and used it to make more than $43 million in unauthorized debits and charges for purported financial products that the consumers never purchased. Sadly, these &#8220;financial products&#8221; were mostly about how consumers could manage their money better or get themselves out of debt.<span id="more-29246"></span></p>
<p>This scam is also a reminder of how crooks steal millions with <a title="http://krebsonsecurity.com/2014/03/whos-behind-the-bls-weblearn-credit-card-scam/" href="http://krebsonsecurity.com/2014/03/whos-behind-the-bls-weblearn-credit-card-scam/" target="_blank">small</a> <a title="http://krebsonsecurity.com/2014/01/deconstructing-the-9-84-credit-card-hustle/" href="http://krebsonsecurity.com/2014/01/deconstructing-the-9-84-credit-card-hustle/" target="_blank">charges</a>, all made through a vast network of phony company Web sites made to look like established companies with legitimate products. Also, these types of micropayment schemes are more common around the holidays, so now is good time for readers to keep an extra close eye on their bank and credit card statements for any unauthorized charges.</p>
<div id="attachment_29283" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/f053f9e2.ideal-shellcompanies.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/ideal-shellcompanies.png"><img class="size-large wp-image-29283" src="media/cfb0d56f.ideal-shellcompanies-600x360.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/ideal-shellcompanies-600x360.png" alt="A network of shell companies the FTC says were set up to launder stolen funds for Ideal Financial Solutions." width="600" height="360" /></a><p class="wp-caption-text">A network of shell companies the FTC says were set up to launder stolen funds for Ideal Financial Solutions.</p></div>
<p>A copy of the FTC civil complaint against LeapLab is <a title="http://www.ftc.gov/system/files/documents/cases/141223leaplabcmpt.pdf" href="media/43609af5.141223leaplabcmpt.pdf" data-original-source="http://www.ftc.gov/system/files/documents/cases/141223leaplabcmpt.pdf" target="_blank">here</a> (PDF). Also interesting to read are <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/sunyich-et-al.pdf" href="media/626478eb.sunyich-et-al.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/sunyich-et-al.pdf" target="_blank">these</a> <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/idealfinancialexhibit1.pdf" href="media/61b65c2d.idealfinancialexhibit1.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/idealfinancialexhibit1.pdf" target="_blank">exhibits</a> in the case (both PDF).</p>


feed_id: http://krebsonsecurity.com/?p=29303
title: Cowards Attack Sony PlayStation, Microsoft xBox Networks
uri: Cowards-Attack-Sony-PlayStation-Microsoft-xBox-Networks
url: http://krebsonsecurity.com/2014/12/cowards-attack-sony-playstation-microsoft-xbox-networks/
content:
<p>A gaggle of young misfits that has long tried to silence this Web site now is taking credit for preventing millions of users from playing <strong>Sony Playstation</strong> and <strong>Microsoft Xbox Live</strong> games this holiday season.</p>
<p>The group, which calls itself <strong>LizardSquad</strong>, started attacking the gaming networks on or around Christmas Day. Various statements posted by self-described LizardSquad members on their open online chat forum &#8212; <strong>chat.lizardpatrol.com</strong> &#8212; suggest that these misguided individuals launched the attack for no other reason than because they thought it would be amusing to annoy and disappoint people who received new Xbox and Playstation consoles as holiday gifts.</p>
<p>Such assaults, known as distributed denial-of-service (DDoS) attacks &#8212; harness the Internet connectivity of many hacked or misconfigured systems so that those systems are forced to simultaneously flood a target network with junk internet traffic. The goal, of course, is to prevent legitimate visitors from being able to load the site or or use the service under attack.</p>
<p>It&#8217;s unfortunate that some companies which specialize in DDoS protection services have chosen to <a title="http://www.latimes.com/business/technology/la-fi-tn-xbox-playstation-attack-20141226-story.html" href="http://www.latimes.com/business/technology/la-fi-tn-xbox-playstation-attack-20141226-story.html" target="_blank">promote their products</a> by categorizing these latest attacks as &#8220;herculean&#8221; and &#8220;sophisticated;&#8221; these adjectives describe neither the attackers nor their attacks. The sad truth is that these attacks take advantage of compromised and misconfigured systems online, and there are tens of millions of these systems that can be freely leveraged to launch such attacks. What&#8217;s more, the tools and instructions for launching such assaults are widely available.</p>
<p>The LizardSquad leadership is closely tied to a cybercrime forum called <strong>Darkode[dot]com</strong>, a network of ne&#8217;er-do-wells that I have <a title="http://krebsonsecurity.com/?s=darkode&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=darkode&amp;x=0&amp;y=0" target="_blank">written about extensively</a>. So much so, in fact, that the LizardSquad has made attacking KrebsOnSecurity.com and keeping it offline for at least 30 minutes a prerequisite &#8220;proof of skills&#8221; for any new members who wish to join their ranks (see the screen shot below).</p>
<div id="attachment_29304" style="width: 610px" class="wp-caption aligncenter"><a href="media/8fcef73f.lizardlamers.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/lizardlamers.png"><img class="size-large wp-image-29304" src="media/b2b987f9.lizardlamers-600x266.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/lizardlamers-600x266.png" alt="LizardSquad wannabes trying to prove their &quot;skills&quot; by knocking my site offline. " width="600" height="266" /></a><p class="wp-caption-text">LizardSquad wannabes trying to prove their &#8220;skills&#8221; by knocking my site offline.</p></div>
<p><span id="more-29303"></span></p>
<p>Over the past month, KrebsOnSecurity.com has been the target of multiple such attacks each day. <strong>Prolexic</strong> &#8212; a DDoS protection firm now owned by <strong>Akamai</strong> &#8212; has been extremely helpful in poring over huge troves of data about systems seen attacking this site.</p>
<p>The majority of compromised systems being used to attack my site this month are located within three countries &#8212; Taiwan, India, and Vietnam. The bulk of attacks have been so-called &#8220;<a title="http://en.wikipedia.org/wiki/Application_layer_DDoS_attack" href="http://en.wikipedia.org/wiki/Application_layer_DDoS_attack" target="_blank">Layer 7</a>&#8221; assaults &#8212; in that they try to mimic legitimate Web browsing activity in a bid to avoid detection.</p>
<p>But what&#8217;s most interesting about these compromised and/or misconfigured systems is how many of them are located at legitimate companies that have been compromised by miscreants. According to Akamai, most of the malicious sources were Windows-based servers powered by Microsoft&#8217;s IIS Web server technology.  The top five industries where those compromised systems reside are in entertainment, banking, hosting providers, software-as-a-service providers, and consulting services.</p>
<p>Many of those associated with LizardSquad are wannabe hackers with zero skill and a desire to be connected to something interesting and fun. Unfortunately, many of the LizardSquad individuals involved in these attacks also are embroiled in far more serious online crimes &#8212; including identity theft, malware distribution, spam and credit card fraud. While most of the group&#8217;s acolytes are known to U.S. enforcement investigators, many are minors, and the sad truth is that federal prosecutors don&#8217;t really know what to do with underage felons except to turn them into informants. Meanwhile, the cycle of abuse continues.</p>
<p><strong>Update, Dec. 30, 7:05 p.m. ET:</strong> A previous version of this story named multiple companies suspected of hosting compromised systems that may have been abused by LizardSquad members in attacks on this blog. Several of those organizations have reported being unable to find any evidence that their systems were used in an attack, and took strong exception to be included in this story. Since it is entirely possible that the traffic from these systems recorded in this site&#8217;s logs could have been mistaken for attack traffic during an active (and still ongoing) attack, I have omitted the names of those companies from this post. I would like to apologize for any confusion or misunderstanding this post may have caused. </p>


feed_id: http://krebsonsecurity.com/?p=29323
title: Who’s in the Lizard Squad?
uri: Who-s-in-the-Lizard-Squad
url: http://krebsonsecurity.com/2014/12/whos-in-the-lizard-squad/
content:
<p>The core members of a group calling itself &#8220;Lizard Squad&#8221; &#8212; which took responsibility for attacking <strong>Sony&#8217;s</strong> Playstation and <strong>Microsoft</strong>&#8216;s Xbox networks and knocking them offline for Christmas Day &#8212; want very much to be recognized for their actions. So, here&#8217;s a closer look at two young men who appear to be anxious to let the world know they are closely connected to the attacks.</p>
<div id="attachment_29334" style="width: 165px" class="wp-caption alignleft"><a href="media/9be58c90.lyYRjQB.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/lyYRjQB.jpg"><img class="size-medium wp-image-29334" src="media/7102fef6.lyYRjQB-155x400.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/lyYRjQB-155x400.jpg" alt="Kim Dotcom offers Lizard Squad members vouchers to stop the attack." width="155" height="400" /></a><p class="wp-caption-text">Kim Dotcom offers Lizard Squad members vouchers to stop the attack.</p></div>
<p>The LizardSquad reportedly only called off their attacks after <strong>MegaUpload</strong> founder <strong>Kim Dotcom</strong> <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/lyYRjQB.jpg" href="media/9be58c90.lyYRjQB.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/lyYRjQB.jpg" target="_blank">offered the group some 3,000 vouchers</a> for his content hosting service. The vouchers sell for $99 apiece, meaning that Dotcom effectively offered the group the equivalent of $300,000 to stop their seige.</p>
<p>On Dec. 26, <strong>BBC Radio</strong> <a title="https://www.youtube.com/watch?v=QVXfAb8NXyM#t=123" href="https://www.youtube.com/watch?v=QVXfAb8NXyM#t=123" target="_blank">aired an interview</a> with two young men who claimed to have been involved in the attacks. The two were referred to in the interview only as &#8220;Member 1&#8243; and &#8220;Member 2,&#8221; but both have each given on-camera interviews previously (more on that in a bit).</p>
<p>The BBC&#8217;s <strong>Stephen Nolan</strong> asks Member 2, &#8220;It was nothing really to do with exposing a company for the greater good? You took the money and you ran, didn&#8217;t you, like a petty criminal?&#8221;</p>
<p><strong>M2:</strong> &#8220;Well, we didn&#8217;t really expect money from it in the first place. If we really cared about money we could have used the twitter accounts that we generated over 50,000 followers within 24-48 hours we could have used that for monetization, you know? We could have easily sent out a couple of linked&#8230;.profiles or whatever where each click could gain us three to six cents.&#8221;</p>
<div id="attachment_29329" style="width: 160px" class="wp-caption alignright"><a class="lightbox" href="media/7e1c259d.vomari.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/vomari.png"><img class="size-full wp-image-29329" src="media/7e1c259d.vomari.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/vomari.png" alt="Vinnie Omari, speaking to Sky News on Dec. 27." width="150" height="250" /></a><p class="wp-caption-text">Vinnie Omari, speaking to Sky News on Dec. 27.</p></div>
<p><strong>Nolan:</strong> &#8220;So why did you take the vouchers, then?</p>
<p><strong>M2:</strong> &#8220;It was just an offer. It&#8217;s hard to say. It was just a one-time thing. It&#8217;s $300,000 worth of vouchers.&#8221;</p>
<p><strong>Nolan:</strong> &#8220;Dirty, grubby, greed?&#8221;</p>
<p><strong>M2:</strong> &#8220;Well, that&#8217;s what happens, I&#8217;m afraid. That&#8217;s what it is like in the security business.&#8221;</p>
<p>Member2, the guy that does most of the talking in the BBC interview, appears to be a 22-year-old from the United Kingdom named <strong>Vinnie Omari</strong>. <strong>Sky News</strong> ran <a title="http://news.sky.com/video/1398448/rival-groups-battle-for-supremacy" href="http://news.sky.com/video/1398448/rival-groups-battle-for-supremacy" target="_blank">an on-camera interview with Omari</a> on Dec. 27, quoting him as a &#8220;computer security analyst&#8221; as he talks about the attacks by LizardSquad and their supposed feud with a rival hacker gang.</p>
<p>The same voice can be heard on <a title="https://www.youtube.com/watch?v=A5eCCuD3fL8" href="https://www.youtube.com/watch?v=A5eCCuD3fL8" target="_blank">this video</a> from <a title="https://www.youtube.com/channel/UCVIz7joDWaQ4H7y-WjyNNig" href="https://www.youtube.com/channel/UCVIz7joDWaQ4H7y-WjyNNig" target="_blank">Vinnie&#8217;s Youtube channel</a>, in which he enthuses about <strong>hackforums[dot]net</strong>, a forum that is overrun with teenage wannabe hackers who spend most of their time trying to impress, attack or steal from one another.</p>
<p>In a thread on Hackforums that Omari began on Dec. 26 using the Hackforums username &#8220;Vinnie&#8221; Omari says he&#8217;s been given vouchers from Kim Dotcom&#8217;s Mega, and wonders if the Hackforums rules allow him to sell the vouchers on the forum.</p>
<div id="attachment_29326" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/caa1f349.vinnie-mega.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/vinnie-mega.png"><img class="size-large wp-image-29326" src="media/016d6f19.vinnie-mega-600x239.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/vinnie-mega-600x239.png" alt="Hackforums user &quot;Vinnie&quot; asks about selling MegaUpload vouchers." width="600" height="239" /></a><p class="wp-caption-text">Hackforums user &#8220;Vinnie&#8221; asks about selling MegaUpload vouchers.</p></div>
<p><a class="lightbox" href="media/2863c25b.vinnie-profit.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/vinnie-profit.png"><img class="aligncenter size-large wp-image-29340" src="media/ceaf9c74.vinnie-profit-600x309.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/vinnie-profit-600x309.png" alt="vinnie-profit" width="600" height="309" /></a></p>
<p><span id="more-29323"></span>Member 1 from the BBC interview also gave <a title="https://www.youtube.com/watch?v=fPX8yCBdIZ8" href="https://www.youtube.com/watch?v=fPX8yCBdIZ8" target="_blank">an on-camera interview to Sky News</a>, although he does not give his real name; he offers a pseudonym &#8212; &#8220;Ryan.&#8221; According to multiple sources, this individual is a Finnish teenager named <a title="https://www.facebook.com/julius.kivimaki" href="https://www.facebook.com/julius.kivimaki" target="_blank"><strong>Julius Kivimäki</strong></a> who has used a variety of online monikers, including &#8220;Zee,&#8221; &#8220;Zeekill&#8221; and &#8220;Ry|an.&#8221;<strong> </strong></p>
<div id="attachment_29338" style="width: 295px" class="wp-caption alignleft"><a class="lightbox" href="media/a9ae7a8d.ryan-k.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/ryan-k.png"><img class="size-medium wp-image-29338" src="media/8fa28550.ryan-k-285x270.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/ryan-k-285x270.png" alt="Julius &quot;Ryan&quot; Kivimaki talks to Sky News about the Lizardsquad attacks." width="285" height="270" /></a><p class="wp-caption-text">Julius &#8220;Ryan&#8221; Kivimaki talks to Sky News about the Lizardsquad attacks.</p></div>
<p>Sources say <strong>Kivimäki </strong>was <a title="http://www.poliisi.fi/poliisi/helsinki/home.nsf/PFBD/0E81FA7AD3E9C7D0C2257C080025FA7E" href="http://www.poliisi.fi/poliisi/helsinki/home.nsf/PFBD/0E81FA7AD3E9C7D0C2257C080025FA7E" target="_blank">arrested by Helsinki police in October 2013 on suspicion of running a huge botnet</a> consisting of more than 60,000 hacked Web servers around the world. Local Finnish media reported on the youth&#8217;s arrest, although they didn&#8217;t name him. Kivimäki, 16, also was reportedly found in possession of more than 3,000 stolen credit cards.</p>
<p>Both of these individuals may in fact be guilty of nothing more than taking credit for other peoples&#8217; crimes. But I hope it&#8217;s clear to the media that the Lizard Squad is not some sophisticated hacker group.</p>
<p>The Lizard Squad&#8217;s monocle-wearing mascot shows them to be little more than a group of fame-seeking kids who desperately aspire to be like <a title="http://en.wikipedia.org/wiki/LulzSec" href="http://en.wikipedia.org/wiki/LulzSec" target="_blank">LulzSec</a>, a similarly minded gang <a title="http://www.theguardian.com/technology/2013/may/16/lulzsec-hacking-fbi-jail" href="http://www.theguardian.com/technology/2013/may/16/lulzsec-hacking-fbi-jail" target="_blank">whose core members were busted and went to jail</a>. With any luck, these kids will get their wish soon enough.</p>


feed_id: http://krebsonsecurity.com/?p=29244
title: Happy 5th Birthday, KrebsOnSecurity!
uri: Happy-5th-Birthday-KrebsOnSecurity
url: http://krebsonsecurity.com/2014/12/happy-5th-birthday-krebsonsecurity/
content:
<p>It&#8217;s hard to believe, but KrebsOnSecurity turns five years old today! How time flies!</p>
<p><a href="media/a691187e.5reflect.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/5reflect.png"><img class="alignright size-medium wp-image-29354" src="media/94d22792.5reflect-155x400.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/5reflect-155x400.png" alt="5reflect" width="155" height="400" /></a>Probably the most rewarding part about being an independent reporter (for my part, anyway) is watching your readership grow and mature into a community that not only adds perspective and balance but also helps educate other readers.</p>
<p>I&#8217;m very proud of the community that&#8217;s sprung up around this site, and I&#8217;m extremely grateful for all of the support and encouragement from you, Dear Reader. A few dozen readers have sent PayPal or Bitcoin donations, but most have supported this site with their time, expertise and tips (keep those coming, please).</p>
<p>So, from the bottom of my heart, a big THANK YOU and high five to all of you! I wish you all a very happy, healthy and prosperous 2015. Here&#8217;s to another five great years!</p>
<p>Leaving aside the pieces in my <a title="http://krebsonsecurity.com/all-about-skimmers/" href="http://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers series</a>, here are some of the most-read, exclusive posts from the past 365 days:</p>
<p><a title="http://krebsonsecurity.com/2014/08/lorem-ipsum-of-good-evil-google-china/" href="http://krebsonsecurity.com/2014/08/lorem-ipsum-of-good-evil-google-china/" target="_blank">Lorem Ipsum: Of Good and Evil, Google and China</a></p>
<p><a title="http://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/" href="http://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/" target="_blank">A Peek Inside a Professional Carding Shop</a></p>
<p><a title="http://krebsonsecurity.com/2013/12/whos-selling-credit-cards-from-target/" href="http://krebsonsecurity.com/2013/12/whos-selling-credit-cards-from-target/" target="_blank">Who&#8217;s Selling Credit Cards from Target?</a></p>
<p><a title="http://krebsonsecurity.com/2014/03/are-credit-monitoring-services-worth-it/" href="http://krebsonsecurity.com/2014/03/are-credit-monitoring-services-worth-it/" target="_blank">Are Credit Monitoring Services Worth it?</a></p>
<p><a title="http://krebsonsecurity.com/2014/05/antivirus-is-dead-long-live-antivirus/" href="http://krebsonsecurity.com/2014/05/antivirus-is-dead-long-live-antivirus/" target="_blank">Antivirus is Dead: Long Live Antivirus</a></p>
<p><a title="http://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/" href="http://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/" target="_blank">Target Hackers Broke in Via HVAC Company</a></p>
<p><a title="http://krebsonsecurity.com/2014/01/a-first-look-at-the-target-intrusion-malware/" href="http://krebsonsecurity.com/2014/01/a-first-look-at-the-target-intrusion-malware/" target="_blank">A First Look at the Target Intrusion, Malware</a></p>
<p><a title="http://krebsonsecurity.com/2014/09/banks-credit-card-breach-at-home-depot/" href="http://krebsonsecurity.com/2014/09/banks-credit-card-breach-at-home-depot/" target="_blank">Banks: Credit Card Breach at Home Depot</a></p>
<p><a title="http://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hacked-pc-revisited/" href="http://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hacked-pc-revisited/" target="_blank">The Scrap Value of a Hacked PC, Revisited</a> (oldie but a goodie)</p>


feed_id: http://krebsonsecurity.com/?p=29281
title: Target Hackers Hit OneStopParking.com
uri: Target-Hackers-Hit-OneStopParking-com
url: http://krebsonsecurity.com/2014/12/target-hackers-hit-onestopparking-com/
content:
<p>Parking services have taken a beating this year at the hands of hackers bent on stealing credit and debit card data. This week&#8217;s victim &#8212; <strong>onestopparking.com</strong> &#8212; comes compliments of the same organized crime gang thought to be responsible for stealing tens of millions of card numbers from shoppers at <strong>Target</strong> and <strong>Home Depot</strong>.</p>
<p><a href="media/1585851d.onestopparking.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/onestopparking.png"><img class="alignright size-medium wp-image-29295" src="media/025b1f04.onestopparking-285x108.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/onestopparking-285x108.png" alt="onestopparking" width="285" height="108" /></a>Late last week, the cybercrime shop best known for being the first to sell cards stolen in the Target and Home Depot breach moved a new batch of cards taken from an unknown online merchant. Several banks contacted by KrebsOnSecurity acquired cards from this batch, and determined that all had one thing in common: They&#8217;d all been used at onestopparking.com, a Florence, Ky. based company that provides low-cost parking services at airport hotels and seaports throughout the United States.</p>
<p>Contacted about the suspicious activity that banks have traced back to onestopparking.com, <strong>Amer Ghanem</strong>, the site&#8217;s manager, said the company began receiving complaints from customers about a week before Christmas.</p>
<p class="p1">&#8220;It’s been something we have been dealing with for the past week, where some of our customers have called in and complained about fraudulent charges,&#8221; Ghanem said. He noted that the complaints stopped after the company performed several security scans and upgraded software for the Web site, but the investigation continues.</p>
<p class="p1">&#8220;We have been unable to identify any specific issues that has caused any credit card breach on our website,&#8221; Ghanem said in a written statement. &#8220;However, being a part of the e-commerce industry and staying up to date with the security news, we are aware of security threats that are always around, especially during the holiday season, when people tend to shop and travel more.  We currently have 2 different services that are always monitoring traffic on our website, 24/7 to ensure the safety of our customers.&#8221;</p>
<div id="attachment_29357" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/d4587bd5.solidus.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/solidus.png"><img class="size-large wp-image-29357" src="media/f918589f.solidus-600x291.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/solidus-600x291.png" alt="Cards from the &quot;Solidus&quot; base at Rescator map back to One Stop Parking." width="600" height="291" /></a><p class="wp-caption-text">Cards from the &#8220;Solidus&#8221; base at Rescator map back to One Stop Parking.</p></div>
<p>This was the second time in as many weeks that this cybercrime shop &#8211;<strong><a title="http://krebsonsecurity.com/?s=rescator&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=rescator&amp;x=0&amp;y=0" target="_blank">Rescator[dot]cm</a> &#8212; </strong>has put up for sale a batch of credit cards stolen from an online parking service: On Dec. 16, KrebsOnSecurity reported that the same shop was <a title="http://krebsonsecurity.com/2014/12/banks-park-n-fly-online-card-breach/" href="http://krebsonsecurity.com/2014/12/banks-park-n-fly-online-card-breach/" target="_blank">selling cards stolen from Park-n-Fly</a>, a competing airport parking reservation service.  Sometime over the past few days, Park-n-Fly announced it was suspending its online service.<span id="more-29281"></span></p>
<p>&#8220;In the wake of suspicious activity relating to certain Park ‘N Fly’s system containing credit card data, Park ‘N Fly has suspended our online reservations system, pending remediation,&#8221; reads <a title="http://www.pnf.com/security-update/" href="http://www.pnf.com/security-update/" target="_blank">a security update</a> posted on the company&#8217;s site. Park &#8216;N Fly noted that it is still taking reservations over the phone.</p>
<p>The stolen card data that bank sources traced back to Onestopparking.com are among hundreds or thousands that went on sale Dec. 21 at Rescator, in a batch dubbed &#8220;Solidus.&#8221; The card data ranges in price from $6 to $12 per card, and include the card number, expiration date, 3-digit card verification code, as well as the cardholder’s name, address and phone number.</p>
<p>Last month, <strong>SP Plus</strong> — a Chicago-based parking facility provider — <a title="http://www.qconline.com/news/illinois/parking-garages-hacked-for-credit-card-data/article_dabd4256-2aa2-5005-b09e-30feecb95eb1.html" href="http://www.qconline.com/news/illinois/parking-garages-hacked-for-credit-card-data/article_dabd4256-2aa2-5005-b09e-30feecb95eb1.html" target="_blank">said</a> payment systems at 17 parking garages in Chicago, Philadelphia and Seattle that were hacked to capture credit card data after thieves installed malware to access credit card data from a remote location. Card data stolen from those SP+ locations ended up for sale on a competing cybercrime store called Goodshop.</p>
<p>In Missouri, the St. Louis Parking Company recently <a title="http://stlouisparking.com/press-release/" href="http://stlouisparking.com/press-release/" target="_blank">disclosed</a> that it learned of breach involving card data stolen from its Union Station Parking facility between Oct. 6, 2014 and Oct. 31, 2014.</p>


feed_id: http://krebsonsecurity.com/?p=29365
title: Banks: Card Breach at Some Chick-fil-A’s
uri: Banks-Card-Breach-at-Some-Chick-fil-A-s
url: http://krebsonsecurity.com/2014/12/banks-card-breach-at-some-chick-fil-as/
content:
<p>Sources at several U.S. financial institutions say they have traced a pattern of credit card fraud back to accounts that all were used at different <strong>Chick-fil-A</strong> fast food restaurants around the country. Chick-fil-A told KrebsOnSecurity that it has received similar reports and is working with IT security firms and law enforcement in an ongoing investigation.</p>
<div id="attachment_29370" style="width: 295px" class="wp-caption alignright"><a href="media/01821272.chick-fil-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/chick-fil-a.png"><img class="size-medium wp-image-29370" src="media/21e0feb6.chick-fil-a-285x200.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/chick-fil-a-285x200.png" alt="Photo: Robert Du Bois" width="285" height="200" /></a><p class="wp-caption-text">Photo: Robert Du Bois</p></div>
<p>KrebsOnSecurity first began hearing from banks about possible compromised payment systems at Chick-fil-A establishments in November, but the reports were spotty at best. Then, just before Christmas, one of the major credit card associations issued an alert to several financial institutions about a breach at an unnamed retailer that lasted between Dec. 2, 2013 and Sept. 30, 2014.</p>
<p>One financial institution that received that alert said the bank had nearly 9,000 customer cards listed in that alert, and that the only common point-of-purchase were Chick-fil-A locations.</p>
<p>&#8220;It&#8217;s crazy because 9,000 customer cards is more than the total number of cards we had impacted in the Target breach,&#8221; the banking source said, speaking on condition of anonymity.</p>
<p>The source said his institution saw Chick-fil-A locations across the country impacted, but that the bulk of the fraud seemed concentrated at locations in Georgia, Maryland, Pennsylvania, Texas and Virginia.</p>
<p>Reached for comment about the findings, Chick-fil-A issued the following statement:</p>
<blockquote><p>&#8220;Chick-fil-A recently received reports of potential unusual activity involving payment cards used at a few of our restaurants.  We take our obligation to protect customer information seriously, and we are working with leading IT security firms, law enforcement and our payment industry contacts to determine all of the facts.&#8221;</p>
<p>&#8220;We want to assure our customers we are working hard to investigate these events and will share additional facts as we are able to do so.  If the investigation reveals that a breach has occurred, customers will not be liable for any fraudulent charges to their accounts &#8212; any fraudulent charges will be the responsibility of either Chick-fil-A or the bank that issued the card.  If our customers are impacted, we will arrange for free identity protection services, including credit monitoring.&#8221;</p></blockquote>
<p><span id="more-29365"></span>My suspicion is that &#8212; if confirmed &#8212; this breach will be found to have impacted only a subset of Chick-fil-A&#8217;s 1,850 locations in 41 states and the District of Columbia. In that respect, it would be much like the breaches first reported in this blog earlier this year at other fast food chains &#8212;  <a title="http://krebsonsecurity.com/?s=dairy+queen&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=dairy+queen&amp;x=0&amp;y=0" target="_blank">Dairy Queen</a> and <a title="http://krebsonsecurity.com/?s=jimmy+johns&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=jimmy+johns&amp;x=0&amp;y=0" target="_blank">Jimmy Johns</a>. In both of those breaches, the stores impacted were franchises that outsourced the management of their point-of-sale systems to specific third party companies.</p>
<p>In September, KrebsOnSecurity <a title="http://krebsonsecurity.com/2014/09/breach-at-goodwill-vendor-lasted-18-months/" href="http://krebsonsecurity.com/2014/09/breach-at-goodwill-vendor-lasted-18-months/" target="_blank">reported</a> that a different hacked point-of-sale provider was the driver behind a breach that impacted more than <a title="http://www.goodwill.org/press-releases/goodwill-provides-update-on-data-security-issue/" href="http://www.goodwill.org/press-releases/goodwill-provides-update-on-data-security-issue/" target="_blank">330 Goodwill locations nationwide</a>. That breach, which targeted payment vendor C&amp;K Systems Inc., persisted for 18 months, and involved two other as-yet unnamed C&amp;K customers.</p>
<p>In all of these incidents, the intruders managed to install malicious software on point-of-sale systems at the affected merchants. Point-of-sale malware, like the malware that hit C&amp;K as well as Target, Home Depot, Neiman Marcus and other retailers this past year, is designed to steal the data encoded onto the magnetic stripe on the backs of debit and credit cards. This data can be used to create counterfeit cards, which are then typically used to purchase physical goods at big-box retailers.</p>
<p>Point-of-sale compromises have come to define 2014. Earlier this year, the <strong>U.S. Secret Service</strong> issued <a title="https://www.documentcloud.org/documents/1279345-secret-service-malware-announcement.html" href="https://www.documentcloud.org/documents/1279345-secret-service-malware-announcement.html" target="_blank">an advisory</a> that a point-of-sale malware strain known as &#8220;Backoff&#8221; had struck more than 1,000 U.S. companies since Oct. 2013.</p>
<p>Companies that suffer credit card breaches offer credit monitoring services as a means of placating nervous customers, but bear in mind that credit monitoring services do nothing to prevent fraud on existing accounts (such as credit cards you may have in your wallet). There is no substitute for monitoring your monthly bank and credit card statements for unauthorized or suspicious transactions.</p>
<p>If, on the other hand, you’re looking for more information on credit monitoring services, or for tips about how to protect yourself and loved ones from identity thieves, please check out <a title="http://krebsonsecurity.com/2014/03/are-credit-monitoring-services-worth-it/" href="http://krebsonsecurity.com/2014/03/are-credit-monitoring-services-worth-it/" target="_blank">this article</a>.</p>


feed_id: http://krebsonsecurity.com/?p=29368
title: Lizard Kids: A Long Trail of Fail
uri: Lizard-Kids-A-Long-Trail-of-Fail
url: http://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of-fail/
content:
<p><strong>The Lizard Squad</strong>, a band of young hooligans that recently became Internet famous for launching crippling distributed denial-of-service (DDoS) attacks against the largest online gaming networks, is now advertising its own Lizard-branded DDoS-for-hire service. Read on for a decidedly different take on this offering than what&#8217;s being portrayed in the mainstream media.</p>
<div id="attachment_29380" style="width: 233px" class="wp-caption alignright"><a class="lightbox" href="media/1760c387.lizardskidlogin.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/lizardskidlogin.png"><img class="size-medium wp-image-29380" src="media/2a050948.lizardskidlogin-223x400.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/lizardskidlogin-223x400.png" alt="Lizard Stresser login page taunts this author." width="223" height="400" /></a><p class="wp-caption-text">Lizard Stresser login page taunts this author.</p></div>
<p>The new service, lizardstresser[dot]su, seems a natural evolution for a group of misguided youngsters that has sought to profit from its attention-seeking activities. The Lizard kids only ceased their attack against Sony&#8217;s Playstation and Microsoft&#8217;s Xbox Live networks last week after <strong>MegaUpload</strong> founder <strong>Kim Dotcom</strong> <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/lyYRjQB.jpg" href="media/9be58c90.lyYRjQB.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/lyYRjQB.jpg" target="_blank">offered the group $300,000 worth of vouchers</a> for his service in exchange for ending the assault. And in a development probably that shocks no one, the gang&#8217;s members cynically <a title="http://www.dailydot.com/crime/lizard-squad-lizard-stresser-ddos-service-psn-xbox-live-sony-microsoft/" href="http://www.dailydot.com/crime/lizard-squad-lizard-stresser-ddos-service-psn-xbox-live-sony-microsoft/" target="_blank">told Dailydot</a> that both attacks were just elaborate commercials for and a run-up to this DDoS-for-hire offering.</p>
<p>The group is advertising the new &#8220;<a title="http://krebsonsecurity.com/?s=booter+service&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=booter+service&amp;x=0&amp;y=0" target="_blank">booter service</a>&#8221; via its Twitter account, which has some 132,000+ followers. Subscriptions range from $5.99 per month for the ability to knock a target offline for 100 seconds at a time, to $129.99 monthly for DDoS attacks lasting more than eight hours.</p>
<p>In any case, I&#8217;m not terribly interested in turning this post into a commercial for the Lizard kids; rather, it&#8217;s a brain dump of related information I&#8217;ve gathered from various sources in the past 24 hours about the individuals and infrastructure that support the site.</p>
<p>In a show of just how little this group knows about actual hacking and coding, the source code for the service appears to have been lifted in its entirety from <strong>titaniumstresser</strong>, another, more established DDoS-for-hire booter service. In fact, these Lizard geniuses are <a title="http://www.ericzhang.me/lizardstresser-user-enumeration/#more-449" href="http://www.ericzhang.me/lizardstresser-user-enumeration/#more-449" target="_blank">so inexperienced</a> at coding that they inadvertently <a title="http://pastebin.com/Gdk9wifY" href="http://pastebin.com/Gdk9wifY" target="_blank">exposed</a> information about all of their 1,700+ registered users (more on this in a moment).</p>
<p>These two services, like most booters, are hidden behind <strong>CloudFlare,</strong> a content distribution service that lets sites obscure their true Internet address. In case anyone cares, Lizardstresser&#8217;s real Internet address currently is 217.71.50.57, at <a title="http://www.google.com/safebrowsing/diagnostic?site=AS:198252" href="http://www.google.com/safebrowsing/diagnostic?site=AS:198252" target="_blank">a hosting facility</a> in Bosnia.</p>
<p>In any database of leaked forum or service usernames, it is usually safe to say that the usernames which show up first in the list are the administrators and/or creators of the site. The usernames exposed by the coding and authentication weaknesses in LizardStresser show that the first few registered users are &#8220;anti&#8221; and &#8220;antichrist.&#8221; As far as I can tell, these two users are the same guy: A ne&#8217;er-do-well who has previously sold access to his personal DDoS-for-hire service on <strong>Darkode</strong> &#8212; a notorious English-language cybercrime forum that <a title="http://krebsonsecurity.com/?s=darkode&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=darkode&amp;x=0&amp;y=0" target="_blank">I have profiled extensively on this blog</a>.</p>
<p>As detailed in <a title="http://www.malwaretech.com/2014/12/darkode-ode-to-lizardsquad-rise-and.html?m=1" href="http://www.malwaretech.com/2014/12/darkode-ode-to-lizardsquad-rise-and.html?m=1" target="_blank">a recent, highly entertaining post on the blog Malwaretech</a>, LizardSquad and Darkode are practically synonymous and indistinguishable now. Anyone curious about why the Lizard kids have picked on Yours Truly can probably find the answer in that Malwaretech story. As that post notes, the main online chat room for the Lizard kids (at lizardpatrol[dot]com) also is hidden behind CloudFlare, but careful research shows that it is actually hosted at the same Internet address as Darkode (5,38,89,132).</p>
<div id="attachment_29379" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/5cdb6bb1.krabsonsecurity.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/krabsonsecurity.png"><img class="size-large wp-image-29379" src="media/3bde0c4e.krabsonsecurity-600x220.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/krabsonsecurity-600x220.png" alt="A suggested new banner for this blog from the jokers at black hat forum Darkode, which shares a server with the main chat forum for the Lizard kids." width="600" height="220" /></a><p class="wp-caption-text">A suggested new banner for this blog from the jokers at black hat forum Darkode, which shares a server with the main chat forum for the Lizard kids.</p></div>
<p>In a show of just how desperate these kids are for attention, consider that <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/lizardskidlogin.png" href="media/1760c387.lizardskidlogin.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/lizardskidlogin.png" target="_blank">the login page</a> for LizardStresser currently says &#8220;Hosted somewhere on Brian Krebs&#8217; forehead: Donate to the forehead reduction foundation, simply send money to krebsonsecurity@gmail.com on PayPal.&#8221; Many of you have done that in the past couple of days, although I doubt as a result of visiting the Lizard kids&#8217; silly site. Anyway, for those generous donors, a hearty &#8220;thank you.&#8221;<span id="more-29368"></span></p>
<p>It&#8217;s worth noting that the individual who registered LizardStresser is an interesting and angry teenager who appears to <a title="http://pastebin.com/DvSf6dAK" href="http://pastebin.com/DvSf6dAK" target="_blank">hail from Australia</a> and uses the nickname &#8220;abdilo.&#8221; You can find his possibly not-safe-for-work rants on Twitter at <a title="https://twitter.com/abdilo_/with_replies" href="https://twitter.com/abdilo_/with_replies" target="_blank">this page</a>. A reverse WHOIS lookup (ordered from <a title="http://www.domaintools.com" href="http://www.domaintools.com" target="_blank">Domaintools.com</a>) on the email address used to register LizardStresser (<strong>9ajjs[at]zmail[dot]ru</strong>) shows this email has been <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/9ajjs-at-zmail-dot-ru-reverse-whois.txt" href="http://krebsonsecurity.com/wp-content/uploads/2014/12/9ajjs-at-zmail-dot-ru-reverse-whois.txt" target="_blank">used to register a number of domains</a> tied to cybercrime operations, including sites selling stolen credit card data and access to hacked PCs.</p>
<p>A <a title="http://krebsonsecurity.com/wp-content/uploads/2014/12/abdilo-reversewhois.txt" href="http://krebsonsecurity.com/wp-content/uploads/2014/12/abdilo-reversewhois.txt" target="_blank">more nuanced lookup</a> at Domaintools.com using some of this information turns up additional domains tied to Abdilo, including <strong>bkcn[dot]ru</strong> and <strong>abdilo[dot]ru</strong> (please do not attempt to visit these sites unless you know what you&#8217;re doing). Another domain that abdilo registered (in my name, no less) &#8212; http://x6b-x72-x65-x62-x73-x6f-x6e-x73-x65-x63-x75-x72-x69-x74-x79-x0[dot]com &#8212; is <a title="http://www.rapidtables.com/convert/number/hex-to-ascii.htm" href="http://www.rapidtables.com/convert/number/hex-to-ascii.htm" target="_blank">hexadecimal encoding</a> for &#8220;krebsonsecurity.&#8221;</p>
<p>Last, but certainly not least, it appears that <a title="http://krebsonsecurity.com/2014/12/whos-in-the-lizard-squad/" href="http://krebsonsecurity.com/2014/12/whos-in-the-lizard-squad/" target="_blank">Vinnie Omari &#8212; the young man I identified earlier this week as being a self-proclaimed member of of the Lizard kids</a> &#8212; has apparently just been arrested by the police in the United Kingdom (see screen shot below). Sources tell KrebsOnSecurity that Vinnie is one of many individuals associated with this sad little club who are being rounded up and questioned. My guess is most, if not all, of these kids will turn on one another. Time to go get some popcorn.</p>
<p>Happy New Year, everyone!</p>
<p><a href="media/621a1699.vinnie1.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/vinnie1.png"><img class="aligncenter size-large wp-image-29378" src="media/66678048.vinnie1-591x800.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/vinnie1-591x800.png" alt="vinnie1" width="591" height="800" /></a></p>


feed_id: http://krebsonsecurity.com/?p=29362
title: Who’s Attacking Whom? Realtime Attack Trackers
uri: Who-s-Attacking-Whom-Realtime-Attack-Trackers
url: http://krebsonsecurity.com/2015/01/whos-attacking-whom-realtime-attack-trackers/
content:
<p>It seems nearly every day we&#8217;re reading about Internet attacks aimed at knocking sites offline and breaking into networks, but it&#8217;s often difficult to visualize this type of activity. In this post, we&#8217;ll take a look at multiple ways of tracking online attacks and attackers around the globe and in real-time.</p>
<p>A couple of notes about these graphics. Much of the data that powers these live maps is drawn from a mix of actual targets and &#8220;honeypots,&#8221; decoy systems that security firms deploy to gather data about the sources, methods and frequency of online attacks. Also, the organizations referenced in some of these maps as &#8220;attackers&#8221; typically are compromised systems within those organizations that are being used to relay attacks launched from someplace else.</p>
<p>The <a title="http://www.fireeye.com/cyber-map/threat-map.html" href="http://www.fireeye.com/cyber-map/threat-map.html" target="_blank">Cyber Threat Map</a> from <strong>FireEye</strong> recently became famous in <a title="http://krebsonsecurity.com/2014/12/krebsonsecurity-on-cbss-60-minutes/" href="http://krebsonsecurity.com/2014/12/krebsonsecurity-on-cbss-60-minutes/" target="_blank">a 60 Minutes story</a> on cyberattacks against retailers and their credit card systems. This graphic reminds me of the ICBM monitors from NORAD, as featured in the 1984 movie <a title="https://www.youtube.com/results?search_query=war+games+movie+clips" href="https://www.youtube.com/results?search_query=war+games+movie+clips" target="_blank"><em>War Games</em></a> (I&#8217;m guessing that association is intentional). Not a lot of raw data included in this map, but it&#8217;s fun to watch.</p>
<div id="attachment_29397" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/46fa7c93.fireeyemap.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/fireeyemap.png"><img class="size-large wp-image-29397" src="media/9fdb124a.fireeyemap-600x273.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/fireeyemap-600x273.png" alt="FireEye's &quot;Cyber Threat Map&quot;" width="600" height="273" /></a><p class="wp-caption-text">FireEye&#8217;s &#8220;Cyber Threat Map&#8221;</p></div>
<p>My favorite &#8212; and perhaps the easiest way to lose track of half your workday (and bandwidth) comes from the folks at <strong>Norse Corp.</strong> Their map &#8212; <a title="http://map.ipviking.com/" href="http://map.ipviking.com/" target="_blank">IPViking</a> &#8212; includes a wealth of data about each attack, such as the attacking organization name and Internet address, the target&#8217;s city and service being attacked, as well as the most popular target countries and origin countries.</p>
<div id="attachment_29398" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/117a593d.norse2.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/norse2.png"><img class="size-large wp-image-29398" src="media/9de5e528.norse2-600x396.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/norse2-600x396.png" alt="Norse's IPViking attack map is fun to watch, but very resource-intensive." width="600" height="396" /></a><p class="wp-caption-text">Norse&#8217;s IPViking attack map is eye candy-addictive, but very resource-intensive.</p></div>
<p><span id="more-29362"></span>Another live service with oodles of information about each attack comes from <strong>Arbor Networks</strong>&#8216; <a title="http://www.digitalattackmap.com/#anim=1&amp;color=0&amp;country=ALL&amp;list=0&amp;time=16434&amp;view=map" href="http://www.digitalattackmap.com/#anim=1&amp;color=0&amp;country=ALL&amp;list=0&amp;time=16434&amp;view=map" target="_blank">Digital Attack map</a>. Arbor says the map is powered by data fed from 270+ ISP customers worldwide who have agreed to share anonymous network traffic and attack statistics. This is a truly useful service because it lets you step back in time to attacks on previous dates going all the way back to June 2013.</p>
<div id="attachment_29399" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/6ef957e7.arbormap.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/arbormap.png"><img class="size-large wp-image-29399" src="media/eb97af31.arbormap-600x373.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/arbormap-600x373.png" alt="The Digital Attack Map from Arbor networks is powered by data shared anonymously by 270 ISPs." width="600" height="373" /></a><p class="wp-caption-text">The Digital Attack Map from Arbor networks is powered by data shared anonymously by 270 ISPs.</p></div>
<p><strong>Kaspersky</strong>&#8216;s <a title="http://cyberwar.kaspersky.com/" href="http://cyberwar.kaspersky.com/" target="_blank">Cyberthreat Real-time Map</a> is a lot of fun to play with, and probably looks the most like an interactive video game. Beneath the 3-D eye candy and kaleidoscopic map is anonymized data from Kaspersky&#8217;s various scanning services. As such, this fairly interactive map lets you customize its layout by filtering certain types of malicious threats, such as email malware, Web site attacks, vulnerability scans, etc.</p>
<div id="attachment_29402" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/e10b193f.kav-map.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/kav-map.png"><img class="size-large wp-image-29402" src="media/6aa35f7d.kav-map-600x376.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/kav-map-600x376.png" alt="Kaspersky's Cyberthreat Real-time Map is probably the closest of them all to a video game." width="600" height="376" /></a><p class="wp-caption-text">Kaspersky&#8217;s Cyberthreat Real-time Map is probably the closest of them all to a video game.</p></div>
<p><a title="http://globe.cyberfeed.net/" href="http://globe.cyberfeed.net/" target="_blank">The Cyberfeed</a>, from <strong>Anubis Networks</strong>, takes the visitor on an automated tour of the world, using something akin to Google Earth and map data based on infections from the top known malware families. It&#8217;s a neat idea, but more of a malware infection map than an attack map, and not terribly interactive either. In this respect, it&#8217;s a lot like the <a title="http://worldmap3.f-secure.com" href="http://worldmap3.f-secure.com" target="_blank">threat map</a> from Finnish security firm <strong>F-Secure, </strong>the <a title="http://www.trendmicro.com/us/security-intelligence/current-threat-activity/global-botnet-map/index.html" href="http://www.trendmicro.com/us/security-intelligence/current-threat-activity/global-botnet-map/index.html" target="_blank">Global Botnet Threat Activity Map</a> from <strong>Trend Micro, </strong>and <strong>Team Cymru</strong>&#8216;s <a title="http://www.team-cymru.org/Monitoring/Malevolence/maps.html" href="http://www.team-cymru.org/Monitoring/Malevolence/maps.html" target="_blank">Internet Malicious Activity Map</a>.</p>
<div id="attachment_29401" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/b0e975c6.anubismap.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/anubismap.png"><img class="size-large wp-image-29401" src="media/916bc3e8.anubismap-600x352.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/anubismap-600x352.png" alt="The Cyberfeed from AnubisNetworks takes you on a global tour of malware infections." width="600" height="352" /></a><p class="wp-caption-text">The Cyberfeed from AnubisNetworks takes you on a global tour of malware infections.</p></div>
<p>The <strong>Honeynet Project</strong>&#8216;s <a title="http://map.honeynet.org/" href="http://map.honeynet.org/" target="_blank">Honey Map</a> is not super sexy but it does include a fair amount of useful information about real-time threats on honeypot systems, including links to malware analysis from <a title="http://www.virustotal.com" href="http://www.virustotal.com" target="_blank">Virustotal </a>for each threat or attack.</p>
<div id="attachment_29404" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/004a57df.honeymap2.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/honeymap2.png"><img class="size-large wp-image-29404" src="media/d4031873.honeymap2-600x297.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/honeymap2-600x297.png" alt="The Honeynet Project's Honey Map" width="600" height="297" /></a><p class="wp-caption-text">The Honeynet Project&#8217;s Honey Map</p></div>
<p>Additionally, the guys at OpenDNS Labs have <a title="http://labs.opendns.com/global-network/" href="http://labs.opendns.com/global-network/" target="_blank">a decent attack tracker</a> that includes some nifty data and graphics.</p>
<div id="attachment_29418" style="width: 610px" class="wp-caption aligncenter"><a href="media/f5ae6f1b.Screenshot-2015-01-05-14.41.20.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/Screenshot-2015-01-05-14.41.20.png"><img class="size-large wp-image-29418" src="media/c5b43191.Screenshot-2015-01-05-14.41.20-600x390.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/Screenshot-2015-01-05-14.41.20-600x390.png" alt="Data from OpenDNS's Global Network graph." width="600" height="390" /></a><p class="wp-caption-text">Data from OpenDNS&#8217;s Global Network graph.</p></div>
<p>If all these maps are a bit too Hollywood for you, then you&#8217;ll love the simplicity and humor behind <a title="http://dds.ec/pewpew/index.html?china_mode=1&amp;org_name=Mandiant&amp;bad_day=1" href="http://dds.ec/pewpew/index.html?china_mode=1&amp;org_name=Mandiant&amp;bad_day=1" target="_blank">PewPew</a>, which derives its name from the added sound effects. Might want to turn the volume down on your computer&#8217;s speakers before visiting this map (especially if you&#8217;re at work while viewing it).</p>
<p>Speaking of attacks, some of you may have noticed that this site was unreachable for several hours over the last few days. That&#8217;s because it has been under fairly constant assault by <a title="http://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of-fail/" href="http://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of-fail/" target="_blank">the same criminals</a> who <a title="http://krebsonsecurity.com/2014/12/cowards-attack-sony-playstation-microsoft-xbox-networks/" href="http://krebsonsecurity.com/2014/12/cowards-attack-sony-playstation-microsoft-xbox-networks/" target="_blank">attacked Sony and Microsoft&#8217;s gaming networks</a> on Christmas Day. We are moving a few things around to prevent further such disruptions, so you may notice that some of the site&#8217;s features are a tad flaky or slow for a few days. Thanks for your patience as we sort this out.  And Happy New Year, dear readers!</p>
<p><strong>Update, 1:25 p.m. ET: </strong>An earlier version of this post incorrectly stated that the PewPew service was fed with data supplied by Mandiant. The story above has been changed to reflect that.</p>


feed_id: http://krebsonsecurity.com/?p=29144
title: Thieves Jackpot ATMs With ‘Black Box’ Attack
uri: Thieves-Jackpot-ATMs-With-Black-Box-Attack
url: http://krebsonsecurity.com/2015/01/thieves-jackpot-atms-with-black-box-attack/
content:
<p>Previous stories on KrebsOnSecurity about ATM skimming attacks have focused on innovative fraud devices made to attach to the outside of compromised ATMs. Security experts are now warning about the emergence of a new class of skimming scams aimed at draining ATM cash deposits via a novel and complex attack.</p>
<div id="attachment_29423" style="width: 295px" class="wp-caption alignright"><a href="media/e4bc07e4.blackboxskimmer.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/blackboxskimmer.png"><img class="size-medium wp-image-29423" src="media/8cdbe81d.blackboxskimmer-285x318.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/blackboxskimmer-285x318.png" alt="The attackers responsible for this &quot;black box&quot; ATM attack relied on a mobile device and a USB-based circuit board." width="285" height="318" /></a><p class="wp-caption-text">The attackers responsible for this &#8220;black box&#8221; ATM hack relied on a mobile device and a USB-based circuit board.</p></div>
<p>At issue is a form of ATM fraud known as a &#8220;black box&#8221; attack. In a black box assault, the crooks gain physical access to the top of the cash machine. From there, the attackers are able to disconnect the ATM’s cash dispenser from the “core” (the computer and brains of the device), and then connect their own computer that can be used to issue commands forcing the dispenser to spit out cash.</p>
<p>In this particular attack, the thieves included an additional step: They plugged into the controller a USB-based circuit board that NCR believes was designed to fool the ATM’s core into thinking it was still connected to the cash dispenser.</p>
<p>“They didn’t have to do this [to get away with the money] but our guess is they thought this component would buy them some time,” before the ATM’s owners figured out something was wrong, said <strong>Charlie Harrow</strong>, solutions manager for global security at NCR.</p>
<p>NCR says the crooks then attached a smart phone (a virgin, out-of-the-box Samsung Galaxy 4), which they used as a conduit through which to send commands to the cash dispenser remotely. According to Harrow, the mobile phone was set up to relay commands through a dynamic IP service.</p>
<p>“Which meant that the real attacker sending the commands was somewhere remote from the ATM,” Harrow said.</p>
<p>Why would the ATM thieves set it up so that the dispense commands could only be issued remotely, when co-conspirators would still need to be present at the hacked cash machine to retrieve the money? Harrow believes it’s so that the boss running the crime operation can call the shots.</p>
<p>“There is no honor among thieves, and these guys will delegate responsibility,” Harrow observed. “That way, you have the Mr. Big back at the hideout who’s sending the commands, and the mules are the ones at the ATMs. So the mule who has the black box is unable to activate the attack unless he gets the command from the Mr. Big, and the mobile phone is the best way to do that.”<span id="more-29144"></span></p>
<p>The mobile phone component also made it difficult for investigators to piece together how the attackers pushed commands through to the cash dispenser.</p>
<p>“The mobile phone was simply a pass-through for commands sent from the remote server, so we had no idea about commands being sent to the dispenser,” Harrow recalled. “It took us a while to figure out how they were doing this attack.”</p>
<p>NCR notes that black box attacks are one of two “logical” attacks seen so far against ATMs. The other type of logical attack <a title="http://krebsonsecurity.com/2014/10/spike-in-malware-attacks-on-aging-atms/" href="http://krebsonsecurity.com/2014/10/spike-in-malware-attacks-on-aging-atms/" target="_blank">uses malicious software that similarly “jackpots” the cash machine</a>, forcing it to spit out cash. In both cases, the attacks are made possible because thieves are able to physically access the top part of the ATMs where the USB ports are located.</p>
<p>“It’s one of two logical attacks we have seen increasing in frequency,” said <strong>Owen Wild</strong>, NCR’s global marketing director, noting that the company has seen only two black box attacks so far, including this one. “So far we’ve seen far more malware attacks than black box attacks. The ATM malware attack is simpler because you don’t need hardware. But in principle, there’s no reason black box hacks couldn’t become more common.”</p>
<p>To help prevent the type of physical access that allows thieves to perpetrate logical attacks, NCR urges customers who plan to deploy cash machines in unattended areas to consider wall-mounted units as opposed to stand-alone units. The company also recently shipped a software update for its ATMs that strengthen the encryption used to manage communications between the cash dispenser and the ATM core. More importantly, the update changes the system so that the encryption key exchange between those two components is only done when the dispenser receives a specific authentication sequence.</p>
<p>“All things considered, this is a pretty cheap attack,” Harrow said. “If you know the right commands to send, it’s relatively simple to do. That’s why better authentication needs to be there.”</p>
<p>Harrow said the update also makes it so that the underlying firmware which powers the ATM core cannot be rolled back to previous versions of the firmware. According to Harrow, ATM thieves in Mexico did just that in a recent attack that tried to undo security upgrades that were bundled into a recent software update.</p>
<p>If you liked this story, check out my <a title="http://krebsonsecurity.com/all-about-skimmers/" href="http://krebsonsecurity.com/all-about-skimmers/" target="_blank">ongoing series about ATM skimmers</a>.</p>


feed_id: http://krebsonsecurity.com/?p=29431
title: Lizard Stresser Runs on Hacked Home Routers
uri: Lizard-Stresser-Runs-on-Hacked-Home-Routers
url: http://krebsonsecurity.com/2015/01/lizard-stresser-runs-on-hacked-home-routers/
content:
<p class="p1">The online attack service launched late last year by the same criminals who knocked <strong>Sony</strong> and <strong>Microsoft</strong>’s gaming networks offline over the holidays is powered mostly by thousands of hacked home Internet routers, KrebsOnSecurity.com has discovered.</p>
<p class="p1">Just days after <a title="http://krebsonsecurity.com/2014/12/cowards-attack-sony-playstation-microsoft-xbox-networks/" href="http://krebsonsecurity.com/2014/12/cowards-attack-sony-playstation-microsoft-xbox-networks/" target="_blank">the attacks on Sony and Microsoft</a>, a group of young hoodlums calling themselves the <strong>Lizard Squad</strong> took responsibility for the attack and announced the whole thing was merely an elaborate commercial for their new “booter” or “stresser” site — a service designed to help paying customers knock virtually any site or person offline for hours or days at a time. As it turns out, that service draws on Internet bandwidth from hacked home Internet routers around the globe that are protected by little more than factory-default usernames and passwords.</p>
<div id="attachment_29452" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/5b99fc3a.lsaddons.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/lsaddons.png"><img class="size-large wp-image-29452" src="media/27e9f2e9.lsaddons-600x238.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/lsaddons-600x238.png" alt="The Lizard Stresser's add-on plans. In case it wasn't clear, this service is *not* sponsored by Brian Krebs." width="600" height="238" /></a><p class="wp-caption-text">The Lizard Stresser&#8217;s add-on plans. Despite this site&#8217;s claims, it is *not* sponsored by this author.</p></div>
<p class="p1">In the first few days of 2015, KrebsOnSecurity was taken offline by a series of large and sustained denial-of-service attacks apparently orchestrated by the Lizard Squad. As I noted in <a title="http://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of-fail/" href="http://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of-fail/" target="_blank">a previous story</a>, the booter service — <strong>lizardstresser[dot]su</strong> — is hosted at an Internet provider in Bosnia that is home to a large number of malicious and hostile sites.</p>
<p class="p1">That provider happens to be on the same “bulletproof” hosting network advertised by “sp3c1alist,” the administrator of the cybercrime forum <a title="http://krebsonsecurity.com/?s=darkode&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=darkode&amp;x=0&amp;y=0" target="_blank">Darkode</a>. Until a few days ago, Darkode and LizardStresser shared the same Internet address. Interestingly, one of the core members of the Lizard Squad is an individual who goes by the nickname &#8220;Sp3c.&#8221;</p>
<p class="p1">On Jan. 4, KrebsOnSecurity discovered the location of the malware that powers the botnet. Hard-coded inside of that malware was the location of the LizardStresser botnet controller, which happens to be situated in the same small swath Internet address space occupied by the LizardStresser Web site (217.71.50.x)</p>
<p class="p1">The malicious code that converts vulnerable systems into stresser bots is a variation on a piece of rather crude malware <a title="http://vms.drweb.com/virus/?i=4242198" href="http://vms.drweb.com/virus/?i=4242198" target="_blank">first documented</a> in November by Russian security firm <strong>Dr. Web, </strong>but the malware itself appears to date back to early 2014 (Google&#8217;s Chrome browser should auto-translate that page; for others, a Google-translated copy of the Dr. Web writeup is <a title="https://translate.google.com/translate?sl=ru&amp;tl=en&amp;js=y&amp;prev=_t&amp;hl=en&amp;ie=UTF-8&amp;u=http%3A%2F%2Fvms.drweb.com%2Fvirus%2F%3Fi%3D4242198&amp;edit-text=" href="https://translate.google.com/translate?sl=ru&amp;tl=en&amp;js=y&amp;prev=_t&amp;hl=en&amp;ie=UTF-8&amp;u=http%3A%2F%2Fvms.drweb.com%2Fvirus%2F%3Fi%3D4242198&amp;edit-text=" target="_blank">here</a>).</p>
<p class="p1">As we can see in that writeup, in addition to turning the infected host into attack zombies, the malicious code uses the infected system to scan the Internet for additional devices that also allow access via factory default credentials, such as “admin/admin,” or “root/12345”. In this way, each infected host is constantly trying to spread the infection to new home routers and other devices accepting incoming connections (via <a title="http://en.wikipedia.org/wiki/Telnet" href="http://en.wikipedia.org/wiki/Telnet" target="_blank">telnet</a>) with default credentials.</p>
<p class="p1">The botnet is not made entirely of home routers; some of the infected hosts appear to be commercial routers at universities and companies, and there are undoubtedly other devices involved. The preponderance of routers represented in the botnet probably has to do with the way that the botnet spreads and scans for new potential hosts. But there is no reason the malware couldn&#8217;t spread to a wide range of devices powered by the <strong>Linux</strong> operating system, including desktop servers and Internet-connected cameras.<span id="more-29431"></span></p>
<p class="p1">KrebsOnSecurity had extensive help on this project from a team of security researchers who have been working closely with law enforcement officials investigating the LizardSquad. Those researchers, however, asked to remain anonymous in this story. The researchers who assisted on this project are working with law enforcement officials and ISPs to get the infected systems taken offline.</p>
<p class="p4">This is not the first time members of LizardSquad have built a botnet. Shortly after their attack on Sony and Microsoft, the group’s members came up with the brilliant idea to mess with the <a title="https://www.torproject.org/" href="https://www.torproject.org/" target="_blank">Tor network</a>, an anonymity system that bounces users&#8217; connections between multiple networks around the world, encrypting the communications at every step of the way. Their plan was to set up many hundreds of servers to act as Tor relays, and somehow use that access to undermine the integrity of the Tor network.</p>
<div id="attachment_29453" style="width: 295px" class="wp-caption alignright"><a href="media/b230cd22.tormetrics.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/tormetrics.png"><img class="size-medium wp-image-29453" src="media/fe93cd8e.tormetrics-285x198.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/tormetrics-285x198.png" alt="This graphic reflects a sharp uptick in Tor relays stood up at the end of 2015 in a failed bid by the Lizard Squad to mess with Tor." width="285" height="198" /></a><p class="wp-caption-text">This graphic reflects a sharp uptick in Tor relays stood up at the end of 2014 in a failed bid by the Lizard Squad to mess with Tor.</p></div>
<p class="p4">According to sources close to the LizardSquad investigation, the group’s members used stolen credit cards to purchase thousands of instances of <strong>Google</strong>’s cloud computing service — virtual computing resources that can be rented by the day or longer. That scheme failed shortly after the bots were stood up, as Google quickly became aware of the activity and shut down the computing resources that were purchased with stolen cards.</p>
<p class="p4">A Google spokesperson said he was not able to discuss specific incidents, noting only that, &#8220;We&#8217;re aware of these reports, and have taken the appropriate actions.&#8221; Nevertheless, the incident was documented in several places, including <a title="http://pastebin.com/655ba54R" href="http://pastebin.com/655ba54R" target="_blank">this Pastebin post</a> listing the Google bots that were used in the failed scheme, as well as <a title="https://lists.torproject.org/pipermail/tor-talk/2014-December/036165.html" href="https://lists.torproject.org/pipermail/tor-talk/2014-December/036165.html" target="_blank">a discussion thread</a> on the Tor Project mailing list.</p>
<p class="p4"><span style="text-decoration: underline;">ROUTER SECURITY 101</span></p>
<p class="p4">Wireless and wired Internet routers are very popular consumer devices, but few users take the time to make sure these integral systems are locked down tightly. Don’t make that same mistake. Take a few minutes to review these tips for hardening your hardware.</p>
<p class="p4"><a href="media/85262e64.wrt.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2012/10/wrt.png"><img class="alignleft size-medium wp-image-17232" src="media/b2844fde.wrt-285x264.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2012/10/wrt-285x264.png" alt="wrt" width="285" height="264" /></a>For starters, make sure you change the default credentials on the router. This is the username and password that were factory installed by the router maker. The administrative page of most commercial routers can be accessed by typing 192.168.1.1, or 192.168.0.1 into a Web browser address bar. If neither of those work, try looking up the documentation at the router maker’s site, or checking to see if the address is listed <a title="http://www.techspot.com/guides/287-default-router-ip-addresses/" href="http://www.techspot.com/guides/287-default-router-ip-addresses/" target="_blank">here</a>. If you still can’t find it, open the command prompt (Start &gt; Run/or Search for “cmd”) and then enter ipconfig. The address you need should be next to Default Gateway under your Local Area Connection.</p>
<p>If you don’t know your router’s default username and password, you can look it up <a title="http://www.routerpasswords.com/" href="http://www.routerpasswords.com/" target="_blank">here</a>. Leaving these as-is out-of-the-box is a very bad idea. Most modern routers will let you change both the default user name and password, so do both if you can. But it’s most important <a title="http://krebsonsecurity.com/password-dos-and-donts/" href="http://krebsonsecurity.com/password-dos-and-donts/" target="_blank">to pick a strong password</a>.</p>
<p>When you’ve changed the default password, you’ll want to encrypt your connection if you’re using a wireless router (one that broadcasts your modem’s Internet connection so that it can be accessed via wireless devices, like tablets and smart phones). Onguardonline.gov has published some <a title="http://www.onguardonline.gov/articles/0013-securing-your-wireless-network" href="http://www.onguardonline.gov/articles/0013-securing-your-wireless-network" target="_blank">video how-tos</a> on enabling wireless encryption on your router. WPA2 is the strongest encryption technology available in most modern routers, followed by WPA and WEP (the latter is fairly trivial to crack with open source tools, so don’t use it unless it’s your only option).</p>
<p><a href="media/260922cb.wps.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2011/12/wps.png"><img class="alignright size-full wp-image-13180" src="media/260922cb.wps.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2011/12/wps.png" alt="wps" width="286" height="131" /></a>But even users who have a strong router password and have protected their wireless Internet connection with a strong WPA2 passphrase may have the security of their routers undermined by security flaws built into these routers. At issue is a technology called “Wi-Fi Protected Setup” (WPS) that ships with many routers marketed to consumers and small businesses. According to the Wi-Fi Alliance, an industry group, WPS is “designed to ease the task of setting up and configuring security on wireless local area networks. WPS enables typical users who possess little understanding of traditional Wi-Fi configuration and security settings to automatically configure new wireless networks, add new devices and enable security.”</p>
<p>But WPS also may expose routers to easy compromise. Read more about this vulnerability <a title="http://krebsonsecurity.com/2011/12/new-tools-bypass-wireless-router-security/" href="http://krebsonsecurity.com/2011/12/new-tools-bypass-wireless-router-security/" target="_blank">here</a>. If your router is among those listed as vulnerable, see if you can disable WPS from the router’s administration page. If you’re not sure whether it can be, or if you’d like to see whether your router maker has shipped an update to fix the WPS problem on their hardware, check <a title="https://docs.google.com/spreadsheet/lv?key=0Ags-JmeLMFP2dFp2dkhJZGIxTTFkdFpEUDNSSHZEN3c" href="https://docs.google.com/spreadsheet/lv?key=0Ags-JmeLMFP2dFp2dkhJZGIxTTFkdFpEUDNSSHZEN3c" target="_blank">this spreadsheet</a>. If your router maker doesn’t offer a firmware fix, consider installing an open source alternative, such as <a title="http://www.dd-wrt.com/site/index" href="http://www.dd-wrt.com/site/index" target="_blank">DD-WRT</a> (my favorite) or <a title="http://www.polarcloud.com/tomato" href="http://www.polarcloud.com/tomato" target="_blank">Tomato</a>.</p>
<p><a href="media/eff22be2.opendns.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2012/10/opendns.png"><img class="alignleft size-full wp-image-17231" src="media/eff22be2.opendns.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2012/10/opendns.png" alt="opendns" width="174" height="74" /></a>While you’re monkeying around with your router setting, consider changing the router’s default DNS servers to those maintained by OpenDNS. The company’s free service filters out malicious Web page requests at the domain name system (DNS) level. DNS is responsible for translating human-friendly Web site names like “example.com” into numeric, machine-readable Internet addresses. Anytime you send an e-mail or browse a Web site, your machine is sending a DNS look-up request to your Internet service provider to help route the traffic.</p>
<p>Most Internet users use their ISP’s DNS servers for this task, either explicitly because the information was entered when signing up for service, or by default because the user hasn’t specified any external DNS servers. By creating a free account at OpenDNS.com, changing the DNS settings on your machine, and registering your Internet address with OpenDNS, the company will block your computer from communicating with known malware and phishing sites. OpenDNS also offers a fairly effective adult content filtering service that can be used to block porn sites on an entire household’s network.</p>
<p>The above advice on router security was taken from a broader tutorial on how to stay safe online, called &#8220;<a title="http://krebsonsecurity.com/tools-for-a-safer-pc/" href="http://krebsonsecurity.com/tools-for-a-safer-pc/" target="_blank">Tools for a Safer PC</a>.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=29471
title: KrebsOnSecurity Wins Ntl’ Journalism Award
uri: KrebsOnSecurity-Wins-Ntl-Journalism-Award
url: http://krebsonsecurity.com/2015/01/krebsonsecurity-wins-ntl-journalism-award/
content:
<p>I put this out on Twitter last Friday but wanted to note it here in the blog as well: <strong>The National Press Foundation</strong> graciously <a title="http://nationalpress.org/awards/" href="http://nationalpress.org/awards/" target="_blank">announced</a> last week that it plans to award me its Chairman&#8217;s Citation, which &#8220;confers recognition on individuals whose accomplishments fall outside the traditional categories of excellence.&#8221;</p>
<p><a href="media/8c75d800.npf.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/npf.png"><img class="alignright size-full wp-image-29480" src="media/8c75d800.npf.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/npf.png" alt="npf" width="220" height="218" /></a>I&#8217;m truly honored by this award, and more than a little humbled by the pedigree of its previous winners. The NPF&#8217;s Chairman&#8217;s Citation was last awarded in 2012 to the late, great New York Times reporter <a title="http://en.wikipedia.org/wiki/Anthony_Shadid" href="http://en.wikipedia.org/wiki/Anthony_Shadid" target="_blank">Anthony Shadid</a>, who died in Syria that same year. Shadid, a two-time Pulitzer Prize winner, was also a former Washington Post reporter. Likewise, the award was presented in 2010 to <a title="http://en.wikipedia.org/wiki/Colbert_I._King" href="http://en.wikipedia.org/wiki/Colbert_I._King" target="_blank">Colbert King</a>, a Pulitzer Prize-winning columnist at The Post.</p>
<p>This honor also gives me another opportunity and platform for proselytizing to media colleagues about the merits and rewards of being an independent journalist. Some of my reporter friends probably get sick of hearing it from me, but there has never been a more important time for reporters who are passionate about creating original, impactful content to consider going it alone. A diversity of authoritative (and accountable) voices on important topics keeps the mainstream media honest and on its toes. More crucially, it helps inspire and cultivate the next generation of the Fourth Estate.</p>
<p>A hearty &#8220;THANK YOU&#8221; to the NPF for this recognition, and to the faithful readers here who make this all worthwhile!</p>


feed_id: http://krebsonsecurity.com/?p=29485
title: Toward Better Privacy, Data Breach Laws
uri: Toward-Better-Privacy-Data-Breach-Laws
url: http://krebsonsecurity.com/2015/01/toward-better-privacy-data-breach-laws/
content:
<p><strong>President Obama</strong> on Monday outlined a proposal that would require companies to inform their customers of a data breach within 30 days of discovering their information has been hacked. But depending on what is put in and left out of any implementing legislation, the effort could well lead to more voluminous but less useful disclosure. Here are a few thoughts about how a federal breach law could produce fewer yet more meaningful notice that may actually help prevent future breaches.</p>
<p><a href="media/4cb3a27a.dataleak.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/10/dataleak.png"><img class="alignright size-medium wp-image-28516" src="media/16a0375a.dataleak-285x216.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/10/dataleak-285x216.png" alt="dataleak" width="285" height="216" /></a>The plan is intended to unify nearly four dozen disparate state data breach disclosure laws into a single, federal standard. But as experts quoted in <a title="http://www.nytimes.com/2015/01/12/us/politics/obama-to-call-for-laws-covering-data-hacking-and-student-privacy.html?smid=tw-share" href="http://www.nytimes.com/2015/01/12/us/politics/obama-to-call-for-laws-covering-data-hacking-and-student-privacy.html?smid=tw-share" target="_blank">this story</a> from <em>The</em> <em>New York Times</em> rightly note, much rides on whether or not any federal breach disclosure law is a baseline law that allows states to pass stronger standards.</p>
<p>For example, right now seven states already have so-called &#8220;shot-clock&#8221; disclosure laws, some more stringent; Connecticut requires insurance firms to notify no more than five days after discovering a breach; California has similar requirements for health providers. Also, at least 14 states and the District of Columbia have laws that permit affected consumers to sue a company for damages in the wake of a breach. What&#8217;s more, many states define &#8220;personal information&#8221; differently and hence have different triggers for what requires a company to disclose. For an excellent breakdown on the various data breach disclosure laws, see <a title="http://www.bakerlaw.com/files/Uploads/Documents/Data%20Breach%20documents/Data_Breach_Charts.pdf" href="media/13db0d94.Data_Breach_Charts.pdf" data-original-source="http://www.bakerlaw.com/files/Uploads/Documents/Data%20Breach%20documents/Data_Breach_Charts.pdf" target="_blank">this analysis</a> by <strong>BakerHostetler</strong> (PDF).</p>
<p>Leaving aside the weighty question of federal preemption, I&#8217;d like to see a discussion here and elsewhere about a requirement which mandates that companies disclose <em>how</em> they got breached. Naturally, we wouldn&#8217;t expect companies to disclose the specific technologies they&#8217;re using in a public breach document. Additionally, forensics firms called in to investigate aren&#8217;t always able to precisely pinpoint the cause or source of the breach.</p>
<p>But this information could be publicly shared in a timely way when it&#8217;s available, and appropriately anonymized. It&#8217;s unfortunate that while we&#8217;ve heard time and again about credit card breaches at retail establishments, we know very little about how those organizations were breached in the first place. A requirement to share the &#8220;how&#8221; of the hack when it&#8217;s known and anonymized by industry would be helpful.<span id="more-29485"></span></p>
<p>I also want to address the issue of encryption. Many security experts insist that there ought to be a carve-out that would allow companies to avoid disclosure requirements in a breach that exposes properly encrypted sensitive data (i.e., the intruders did not also manage to steal the private key needed to decrypt the data). While a broader adoption of encryption could help lessen the impact of breaches, this exception is in some form already included in nearly all four dozen state data breach disclosure laws, and it doesn&#8217;t seem to have lessened the frequency of breach alerts.</p>
<p><a href="media/e7e837fd.passcrack.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2012/06/passcrack.jpg"><img class="alignleft size-medium wp-image-15419" src="media/67d1a1f1.passcrack-285x189.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2012/06/passcrack-285x189.jpg" alt="passcrack" width="285" height="189" /></a>I suspect there are several reasons for this. The most obvious is that few organizations that suffer a breach are encrypting their sensitive data, or that they&#8217;re doing so sloppily (exposing the encryption key, e.g.). Also, most states also have provisions in their breach disclosure laws that require a &#8220;risk of harm&#8221; analysis that forces the victim organization to determine whether the breach is reasonably likely to result in harm (such as identity theft) to the affected consumer.</p>
<p>This is important because many of these breaches are the result of thieves breaking into a Web site database and stealing passwords, and in far too many cases the stolen passwords are not encrypted but instead &#8220;hashed&#8221; using a relatively weak and easy-to-crack approach such as MD5 or SHA-1. For a good basic breakdown on the difference between encrypting data and hashing it, check out <a title="http://ctankersley.com/2009/10/14/hashing-is-not-encryption/" href="http://ctankersley.com/2009/10/14/hashing-is-not-encryption/" target="_blank">this post</a>. Also, for a primer on far more secure alternatives to cryptographic hashes, see my 2012 interview with <strong>Thomas Ptacek</strong>, <a title="http://krebsonsecurity.com/2012/06/how-companies-can-beef-up-password-security/" href="http://krebsonsecurity.com/2012/06/how-companies-can-beef-up-password-security/" target="_blank">How Companies Can Beef Up Password Security</a>.</p>
<p>As long as we&#8217;re dealing with laws to help companies shore up their security, I would very much like to see some kind of legislative approach that includes ways to incentivize more companies to deploy two-factor and two step authentication &#8212; not just for their customers, but just as crucially (if not more so) <a title="http://krebsonsecurity.com/2014/09/we-take-your-privacy-and-security-seriously/" href="http://krebsonsecurity.com/2014/09/we-take-your-privacy-and-security-seriously/" target="_blank">for their employees</a>.</p>
<p><span style="text-decoration: underline;">PRIVACY PROMISES</span></p>
<p>President Obama also said he would propose the <strong>Student Data Privacy Act</strong>, which, according to The Times, would prohibit technology firms from profiting from information collected in schools as teachers adopt tablets, online services and Internet-connected software. The story also noted that the president was touting voluntary agreements by companies to safeguard energy data and to provide easy access to consumer credit scores. While Americans can by law get a free copy of their credit report from each of the three major credit bureaus once per year &#8212; at <strong>annualcreditreport.com</strong> &#8212; most consumers still have to pay to see their credit scores.</p>
<p>These changes would be welcome, but they fall far short of the sorts of revisions we need to the privacy laws in this country, some of which were written in the 1980s and predate even the advent of Web browsing technology. As I&#8217;ve discussed at length on this blog, Congress <a title="http://krebsonsecurity.com/2013/12/help-bring-privacy-laws-into-21st-century/" href="http://krebsonsecurity.com/2013/12/help-bring-privacy-laws-into-21st-century/" target="_blank">sorely needs to update</a> the <a title="http://en.wikipedia.org/wiki/Electronic_Communications_Privacy_Act" href="http://en.wikipedia.org/wiki/Electronic_Communications_Privacy_Act" target="_blank" rel="noreferrer">Electronic Communications Privacy Act</a> (ECPA), the 1986 statute that was originally designed to protect Americans from Big Brother and from government overreach. Unfortunately, the law is now so outdated that it actually provides legal cover for the <a title="https://www.eff.org/deeplinks/2013/05/5-overlooked-lessons-justice-depts-leak-investigations" href="https://www.eff.org/deeplinks/2013/05/5-overlooked-lessons-justice-depts-leak-investigations" target="_blank" rel="noreferrer">very sort of overreach it was designed to prevent</a>. For more on the effort to change the status quo, see <a title="http://digitaldueprocess.org/index.cfm?objectid=37940370-2551-11DF-8E02000C296BA163" href="http://digitaldueprocess.org/index.cfm?objectid=37940370-2551-11DF-8E02000C296BA163" target="_blank">digitaldueprocess.org</a>.</p>
<p><a href="media/57bcd769.cloudprivacy.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/12/cloudprivacy.jpg"><img class="alignright size-medium wp-image-23893" src="media/8418111e.cloudprivacy-285x206.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/12/cloudprivacy-285x206.jpg" alt="cloudprivacy" width="285" height="206" /></a>Also, I&#8217;d like to see a broader discussion of privacy proposals that cover what companies can and must/must not do with all the biometric data they&#8217;re collecting from consumers. Companies are tripping over themselves to collect oodles of potentially very sensitive such data from consumers, and yet we still have no basic principles that say what companies can do with that information, how much they can collect, how they can collect it or share it, or how they will protect that information.</p>
<p>There are a handful of exceptions at the state level; read more <a title="http://www.genomicslawreport.com/index.php/2014/05/21/biometrics-a-developing-regulatory-landscape-for-a-new-era-of-technology/" href="http://www.genomicslawreport.com/index.php/2014/05/21/biometrics-a-developing-regulatory-landscape-for-a-new-era-of-technology/" target="_blank">here</a>). But overall, we’re really lacking any sort of basic protections for that information, and consumers are giving it away every day without fully realizing there are basically zero federal standards for what can or should be done with this information.</p>
<p>Coming back to the subject of encryption: Considering how few companies actually make customer data encryption the default approach, it&#8217;s discouraging to see elements of this administration criticizing companies for it. There is likely a big showdown coming between the major mobile players and federal investigators over encryption. Apple and Google&#8217;s <a title="http://www.bbc.com/news/technology-29276955" href="http://www.bbc.com/news/technology-29276955" target="_blank">recent decision</a> to introduce default, irrevocable data encryption on all devices powered by their latest operating systems has prompted calls from the U.S. law enforcement community for legislation that would require mobile providers to allow law enforcement officials to bypass that security in criminal investigations.</p>
<p>In October, <strong>FBI Director James Comey</strong> <a title="http://recode.net/2014/10/16/fbi-director-calls-on-good-people-of-apple-google-to-dump-new-encryption/" href="http://recode.net/2014/10/16/fbi-director-calls-on-good-people-of-apple-google-to-dump-new-encryption/" target="_blank">called on the mobile giants</a> to dump their new encryption policies. Last week, I spoke at a conference in New York where the panel prior to my talk was an address from New York&#8217;s top prosecutor, who said he was <a title="http://www.bloomberg.com/news/2015-01-06/new-york-prosecutor-calls-for-law-to-fight-apple-data-encryption.html" href="http://www.bloomberg.com/news/2015-01-06/new-york-prosecutor-calls-for-law-to-fight-apple-data-encryption.html" target="_blank">working with unnamed lawmakers to craft new legal requirements</a>. Last week, Sen. Ron Wyden (D-Ore.) <a title="http://thehill.com/policy/technology/229007-wyden-resubmits-bill-banning-backdoor-access-to-mobile-devices" href="http://thehill.com/policy/technology/229007-wyden-resubmits-bill-banning-backdoor-access-to-mobile-devices" target="_blank">reintroduced a bill</a> that would bar the government from requiring tech companies to build so-called &#8220;backdoor&#8221; access to their data for law enforcement.</p>
<p>This tension is being felt across the pond as well: British Prime Minister <strong>David Cameron</strong> also has <a title="http://www.theguardian.com/technology/2015/jan/13/david-cameron-encrypted-messaging-apps-ban" href="http://www.theguardian.com/technology/2015/jan/13/david-cameron-encrypted-messaging-apps-ban" target="_blank">pledged new anti-terror laws</a> that give U.K. security services the ability to read encrypted communications on mobile devices.</p>


feed_id: http://krebsonsecurity.com/?p=29436
title: Adobe, Microsoft Push Critical Security Fixes
uri: Adobe-Microsoft-Push-Critical-Security-Fixes
url: http://krebsonsecurity.com/2015/01/adobe-microsoft-push-critical-security-fixes-6/
content:
<p><strong>Microsoft</strong> on Tuesday posted eight security updates to fix serious security vulnerabilities in computers powered by its <strong>Windows</strong> operating system. Separately, <strong>Adobe</strong> pushed out a patch to plug at least nine holes in its <strong>Flash Player</strong> software.</p>
<p><a href="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png"><img class="alignright size-full wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="229" height="240" /></a>Leading the batch of Microsoft patches for 2015 is a drama-laden update to fix a vulnerability in Windows 8.1 that <strong>Google</strong> researchers disclosed just two days ago. Google has <a title="http://googleonlinesecurity.blogspot.com/2014/07/announcing-project-zero.html" href="http://googleonlinesecurity.blogspot.com/2014/07/announcing-project-zero.html" target="_blank">a relatively new policy</a> of publicly disclosing flaws 90 days after they are reported to the responsible software vendor &#8212; whether or not that vendor has fixed the bug yet. That 90-day period elapsed over the weekend, causing Google to <a title="https://code.google.com/p/google-security-research/issues/detail?id=123" href="https://code.google.com/p/google-security-research/issues/detail?id=123" target="_blank">spill the beans</a> and potentially help attackers develop an exploit in advance of Patch Tuesday.</p>
<p>For its part, Microsoft issued a <a title="http://blogs.technet.com/b/msrc/archive/2015/01/11/a-call-for-better-coordinated-vulnerability-disclosure.aspx" href="http://blogs.technet.com/b/msrc/archive/2015/01/11/a-call-for-better-coordinated-vulnerability-disclosure.aspx" target="_blank">strongly-worded blog post</a> chiding Google for what it called a &#8220;gotcha&#8221; policy that leaves Microsoft users in the lurch. Somehow I doubt this is the last time we&#8217;ll see this tension between these two software giants. But then again, who said patching had to be boring? For a full rundown of updates fixed in today&#8217;s release, see <a title="https://technet.microsoft.com/library/security/ms15-jan" href="https://technet.microsoft.com/library/security/ms15-jan" target="_blank">this link</a>.<span id="more-29436"></span></p>
<p>Adobe, as it is prone to do on Patch Tuesday, issued an update to fix a whole mess of security problems with its Flash Player program. Adobe’s update brings the Player to<em> v. 16.0.0.257</em> for Windows and Mac users, and fixes at least nine critical bugs in the software. Adobe said it is not aware of exploits that exist in the wild for any of the vulnerabilities fixed in this release.</p>
<p><a href="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png"><img class="alignleft size-full wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="211" height="180" /></a>To see which version of Flash you have installed, check <a title="https://www.adobe.com/software/flash/about/" href="https://www.adobe.com/software/flash/about/" target="_blank">this link</a>. IE10/IE11 on Windows 8.x and Chrome should auto-update their versions of Flash. If your version of Chrome doesn’t show the latest version of Flash, you may need to restart the browser or manually force Chrome to check for updates (click the three-bar icon to the right of the address bar, select “About Google Chrome” and it should check then).</p>
<p>The most recent versions of Flash are available from the Flash <a title="http://get.adobe.com/flashplayer/" href="http://get.adobe.com/flashplayer/" target="_blank">home page</a>, but beware potentially unwanted add-ons, like <strong>McAfee Security Scan</strong>. To avoid this, uncheck the pre-checked box before downloading, or grab your OS-specific Flash download from <a title="http://www.adobe.com/products/flashplayer/distribution3.html" href="http://www.adobe.com/products/flashplayer/distribution3.html" target="_blank">here</a>.</p>
<p>Windows users who browse the Web with anything other than Internet Explorer may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>
<p>As always, please feel free to sound off in the comments section below with your experience about applying any of these security patches.</p>


feed_id: http://krebsonsecurity.com/?p=29507
title: Park ‘N Fly, OneStopParking Confirm Breaches
uri: Park-N-Fly-OneStopParking-Confirm-Breaches
url: http://krebsonsecurity.com/2015/01/park-n-fly-onestopparking-confirm-breaches/
content:
<p>Late last year, KrebsOnSecurity wrote that two huge swaths of credit card numbers put up for sale in the cybercrime underground had likely been stolen from <strong>Park &#8216;N Fly</strong> and from <strong>OneStopParking.com</strong>, competing airport parking services that lets customers reserve spots in advance of travel via Internet reservation systems. This week, both companies confirmed that they had indeed suffered a breach.</p>
<p><a href="media/a62eaba8.park-n-fly.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/park-n-fly.png"><img class="alignright size-full wp-image-29129" src="media/a62eaba8.park-n-fly.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/park-n-fly.png" alt="park-n-fly" width="258" height="78" /></a>When <a title="http://krebsonsecurity.com/2014/12/banks-park-n-fly-online-card-breach/" href="http://krebsonsecurity.com/2014/12/banks-park-n-fly-online-card-breach/" target="_blank">contacted by this author on Dec. 15</a>, Atlanta-based Park &#8216;N Fly said while it had recently engaged multiple security firms to investigate breach claims, it had not found any proof of an intrusion. In a statement released Tuesday, however, the company acknowledged that its site was hacked and leaking credit card data, but stopped short of saying how long the breach persisted or how many customers may have been affected. A portion of <a title="http://www.pnf.com/security-update/" href="http://www.pnf.com/security-update/" target="_blank">their statement</a> reads:</p>
<blockquote><p>&#8220;Park &#8216;N Fly (&#8220;PNF&#8221;) has become aware of a security compromise involving payment card data processed through its e-commerce website. PNF has been working continuously to understand the nature and scope of the incident, and has engaged third-party data forensics experts to assist with its investigation. The data compromise has been contained. While the investigation is ongoing, it has been determined that the security of some data from certain payment cards that were used to make reservations through PNF’s e-commerce website is at risk. The data potentially at risk includes the card number, cardholder’s name and billing address, card expiration date, and CVV code. Other loyalty customer data potentially at risk includes email addresses, Park ‘N Fly passwords, and telephone numbers.&#8221;</p></blockquote>
<p>The Park &#8216;N Fly <a title="http://www.pnf.com/" href="http://www.pnf.com/" target="_blank">homepage</a> now includes a conspicuous notice stating that the Web site is temporarily unable to process transactions and directs customers to a 1-800 for reservations.</p>
<p>Reading the Park &#8216;N Fly disclosure made me wonder if anything had changed over at OneStopParking.com, a Florence, Ky.-based competitor that <a title="http://krebsonsecurity.com/2014/12/target-hackers-hit-onestopparking-com/" href="http://krebsonsecurity.com/2014/12/target-hackers-hit-onestopparking-com/" target="_blank">KrebsOnSecurity reported Dec. 30, 2014</a> as the likely source of another e-commerce breach. Reached via phone this morning, the site&#8217;s manager <strong>Amer Ghanem</strong> said the company recently determined that hackers had broken in to its systems via a vulnerability in <strong>Joomla</strong> for which patches were made available in Sept. 2014. Unfortunately for OneStopParking.com and its customers, the company put off applying that Joomla update because it broke portions of the site.<span id="more-29507"></span></p>
<p><a href="media/1585851d.onestopparking.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/onestopparking.png"><img class="alignleft size-medium wp-image-29295" src="media/025b1f04.onestopparking-285x108.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/onestopparking-285x108.png" alt="onestopparking" width="285" height="108" /></a>Ghanem said his firm is in the process of notifying affected customers.</p>
<p>Unlike card data stolen from main street retailers &#8212; which can be encoded onto new plastic and used to buy stolen goods in physical retail stores — cards stolen from online transactions can only be used by thieves for fraudulent online purchases. However, most online carding shops that sell stolen card data in underground stores market both types of cards, known in thief-speak as “dumps” and “CVVs,” respectively.</p>
<p>The stolen CVVs traced back to both Park &#8216;N Fly and Onestopparking.com were among thousands for sale in large batches of card data being peddled at <strong>Rescator[dot]cm</strong>, the same crime shop that first moved cards stolen in the retail breaches at <a title="http://krebsonsecurity.com/?s=home+depot+breach&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=home+depot+breach&amp;x=0&amp;y=0" target="_blank">Home Depot</a>, <a title="http://krebsonsecurity.com/?s=target+breach&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=target+breach&amp;x=0&amp;y=0" target="_blank">Target</a>, <a title="http://krebsonsecurity.com/?s=sally+beauty+breach&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=sally+beauty+breach&amp;x=0&amp;y=0" target="_blank">Sally Beauty</a>, <a title="http://krebsonsecurity.com/?s=p.f.+chang%27s&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=p.f.+chang%27s&amp;x=0&amp;y=0" target="_blank">P.F. Chang&#8217;s</a> and <a title="http://krebsonsecurity.com/2014/02/fire-sale-on-cards-stolen-in-target-breach/" href="http://krebsonsecurity.com/2014/02/fire-sale-on-cards-stolen-in-target-breach/" target="_blank">Harbor Freight</a>. The card data in both batches ranged in price from $6 to $9 per card, and included the card number, expiration date, 3-digit card verification code, as well as the cardholder’s name, address and phone number.</p>
<div id="attachment_29357" style="width: 610px" class="wp-caption aligncenter"><a href="media/d4587bd5.solidus.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/solidus.png"><img class="size-large wp-image-29357" src="media/f918589f.solidus-600x291.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/12/solidus-600x291.png" alt="Cards from the &quot;Solidus&quot; base at Rescator map back to One Stop Parking." width="600" height="291" /></a><p class="wp-caption-text">Cards from the &#8220;Solidus&#8221; base at Rescator map back to One Stop Parking.</p></div>
<p>Predictably, Park &#8216;N Fly is offering affected consumers 12 months of free credit monitoring services, even though credit protection services generally do nothing to detect or prevent fraud on existing accounts &#8212; such as credit cards. For more on what credit monitoring services actually do (and don&#8217;t do) check out <a title="http://krebsonsecurity.com/2014/03/are-credit-monitoring-services-worth-it/" href="http://krebsonsecurity.com/2014/03/are-credit-monitoring-services-worth-it/" target="_blank">this primer</a>.</p>
<p>Interestingly, the disclosure timeline for both of these companies would have been consistent with a new data breach notification law that <a title="http://krebsonsecurity.com/2015/01/toward-better-privacy-data-breach-laws/" href="http://krebsonsecurity.com/2015/01/toward-better-privacy-data-breach-laws/" target="_blank">President Obama called for earlier this week</a>. That proposal would require companies to notify consumers about a breach within 30 days of discovering their information has been hacked.</p>


feed_id: http://krebsonsecurity.com/?p=29532
title: Another Lizard Arrested, Lizard Lair Hacked
uri: Another-Lizard-Arrested-Lizard-Lair-Hacked
url: http://krebsonsecurity.com/2015/01/another-lizard-arrested-lizard-lair-hacked/
content:
<p>Several media outlets are reporting that authorities in the United Kingdom early this morning arrested an 18-year-old in connection with the denial-of-service <a title="http://krebsonsecurity.com/2014/12/cowards-attack-sony-playstation-microsoft-xbox-networks/" href="http://krebsonsecurity.com/2014/12/cowards-attack-sony-playstation-microsoft-xbox-networks/" target="_blank">attacks on Sony Playstation and Microsoft Xbox</a> systems over Christmas. The arrest is one of several tied to a joint U.K. and U.S. law enforcement investigation into a group calling itself the &#8220;<strong>Lizard Squad</strong>,&#8221; and comes as the group&#8217;s attack-for-hire online service was completely compromised and leaked to investigators.</p>
<p>A BBC <a title="http://www.bbc.co.uk/news/technology-30849172" href="http://www.bbc.co.uk/news/technology-30849172" target="_blank">story</a> does not name the individual, saying only that the youth was arrested at an address in Southport, near Liverpool, and that he was accused of unauthorized access to computer material and knowingly providing false information to law enforcement agencies in the United States. The <a title="http://www.serocu.org.uk/31/section.aspx/21/man_arrested_swatting_and_denial_of_service_offences" href="http://www.serocu.org.uk/31/section.aspx/21/man_arrested_swatting_and_denial_of_service_offences" target="_blank">notice about the arrest</a> on the Web site of the Southeast Regional Organized Crime Unit states that this individual has been actively involved in several &#8220;swatting&#8221; incidents &#8212; phoning in fake hostage situations or bomb threats to prompt a police raid at a targeted address.</p>
<p>U.K. police declined to publicly name the individual arrested. But according to the <a title="http://t.co/kx3k9E8gIE" href="http://t.co/kx3k9E8gIE" target="_blank">Daily Mail</a>, the youth is one <strong>Jordan Lee-Bevan</strong>. Known online variously as &#8220;Jordie,&#8221; &#8220;EvilJordie&#8221; and &#8220;GDKJordie,&#8221; the young man frequently adopts the persona of an African American gang member from Chicago, as evidenced in <a title="https://www.youtube.com/watch?v=NXjT7mtRFr4" href="https://www.youtube.com/watch?v=NXjT7mtRFr4" target="_blank">this</a> (extremely explicit) interview he and other Lizard Squad members gave late last year. <a title="https://twitter.com/gdkjordie" href="https://twitter.com/gdkjordie" target="_blank">Jordie&#8217;s Twitter account</a> also speaks volumes, although it hasn&#8217;t been saying much for the past 13 hours.</p>
<p><strong>Update:</strong> Added link to Daily Mail story identifying Jordie as Lee-Bevan.</p>
<p><em>Original post:</em></p>
<p>An individual using variations on the &#8220;Jordie&#8221; nickname was named in <a title="http://pdf.911dispatch.com.s3.amazonaws.com/tollis_swating_case.pdf" href="media/5e11bfb2.tollis_swating_case.pdf" data-original-source="http://pdf.911dispatch.com.s3.amazonaws.com/tollis_swating_case.pdf" target="_blank">this FBI criminal complaint</a> (PDF) from Sept. 2014 as <a title="http://www.coloradonewsday.com/news/regional/76627-british-isis-hackers-as-young-as-16-face-extradition-to-u-s-for-threatening-to-carry-out-school-massacres.html" href="http://www.coloradonewsday.com/news/regional/76627-british-isis-hackers-as-young-as-16-face-extradition-to-u-s-for-threatening-to-carry-out-school-massacres.html" target="_blank">one of three from the U.K.</a> suspected in <a title="https://www.google.com/search?q=%22twitter.com%2Feviljordie%22&amp;rlz=1C1CHFX_enUS568US568&amp;oq=%22twitter.com%2Feviljordie%22&amp;aqs=chrome..69i57j69i58.1215j0j4&amp;sourceid=chrome&amp;es_sm=0&amp;ie=UTF-8#q=%22eviljordie%22+police+threat" href="https://www.google.com/search?q=%22twitter.com%2Feviljordie%22&amp;rlz=1C1CHFX_enUS568US568&amp;oq=%22twitter.com%2Feviljordie%22&amp;aqs=chrome..69i57j69i58.1215j0j4&amp;sourceid=chrome&amp;es_sm=0&amp;ie=UTF-8#q=%22eviljordie%22+police+threat" target="_blank">a string of swatting attacks and bomb threats</a> to schools and universities across the United States in the past year. According to that affidavit, Jordie was a member of a group of males aged 16-18 who called themselves the &#8220;ISISGang.&#8221;</p>
<p>In one of their most appalling stunts from September 2014, Jordie and his ISIS pals allegedly phoned in a threat to Sandy Hook Elementary &#8212; the site of the 2012 school massacre in Newtown, Ct. in which 20 kids and 6 adults were gunned down. According to investigators, the group told the school they were coming to the building with an assault rifle to &#8220;kill all your asses.&#8221;</p>
<p>In an unrelated development, not long after this publication <a title="http://krebsonsecurity.com/2015/01/lizard-stresser-runs-on-hacked-home-routers/" href="http://krebsonsecurity.com/2015/01/lizard-stresser-runs-on-hacked-home-routers/" target="_blank">broke the news</a> that the Lizard Squad&#8217;s attack infrastructure is built on a network of thousands of hacked home Internet routers, someone hacked <a title="http://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of-fail/" href="http://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of-fail/" target="_blank">LizardStresser[dot]su</a>, the Web site the group uses to coordinate attacks and sell subscriptions to its attacks-for-hire service. As I noted in a previous story, the attacks on Microsoft and Sony were merely meant to be commercials for this very &#8220;stresser&#8221; (a.k.a. &#8220;booter&#8221;) service, which allows paying customers to knock any Web site or individual offline for a small fee.</p>
<p>A copy of the LizardStresser customer database obtained by KrebsOnSecurity shows that it attracted more than 14,241 registered users, but only a few hundred appear to have funded accounts at the service. Interestingly, all registered usernames and passwords were stored in plain text. Also, the database indicates that customers of the service deposited more than USD $11,000 worth of bitcoins to pay for attacks on thousands of Internet addresses and Web sites (including this one).</p>
<div id="attachment_29541" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/cce15293.lssupport.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/lssupport.png"><img class="size-large wp-image-29541" src="media/939e600b.lssupport-600x457.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/lssupport-600x457.png" alt="One page of hundreds of support ticket requests filed by LizardStresser users." width="600" height="457" /></a><p class="wp-caption-text">One page of hundreds of support ticket requests filed by LizardStresser users.</p></div>
<p><span id="more-29532"></span></p>
<p>Two other Lizard Squad members also have been rounded up by police since the initial Christmas Day attacks. In late December, U.K. police arrested 22-year-old <strong>Vincent &#8220;Vinnie&#8221; Omari</strong>, in connection with the investigation. Additionally, authorities in Finland questioned a 17-year-old named <a title="http://krebsonsecurity.com/2014/12/whos-in-the-lizard-squad/" href="http://krebsonsecurity.com/2014/12/whos-in-the-lizard-squad/" target="_blank">Julius &#8220;Ryan/Zeekill&#8221; Kivimäki</a>, after he and Omari gave an interview to Sky News about the attacks. Sources say Kivimäki has been arrested and jailed several times in Finland on charges related to credit card theft, although he is currently not in custody.</p>
<p>Sources say the 18-year-old arrested this morning operates only on the fringes of the group responsible for the Christmas day attacks, and that the core members of the Lizard Squad remain at large.</p>
<p>Nevertheless, individuals involved in swatting need to face serious consequences for these potentially deadly stunts. Swatting attacks are not only extremely dangerous, they divert emergency responders away from actual emergencies, and cost taxpayers on average approximately $10,000 (according to the FBI).</p>
<p>In most states, the punishment for calling in a fake hostage situation or bomb threat is a fine and misdemeanor akin to filing a false police report. Having <a title="http://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" href="http://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank">been the victim of a swatting attack myself</a>, allow me to suggest an alternative approach: Treat all of those charged with the crime as an adult, and make the charge attempted murder.</p>


feed_id: http://krebsonsecurity.com/?p=29560
title: How Was Your Credit Card Stolen?
uri: How-Was-Your-Credit-Card-Stolen
url: http://krebsonsecurity.com/2015/01/how-was-your-credit-card-stolen/
content:
<p>Almost once a week, I receive an email from a reader who has suffered credit card fraud and is seeking help figuring out which hacked merchant was responsible. I generally reply that this is a fruitless pursuit, and instead encourage readers to keep a close eye on their card statements and report any fraud. But it occurred to me recently that I&#8217;ve never published a primer on the types of card fraud and the likelihood with each of the cardholder ever learning how their account was compromised. This post is an effort to remedy that.</p>
<p><a href="media/18c3ec81.carddominoes.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/02/carddominoes.jpg"><img class="alignright size-medium wp-image-25085" src="media/53f08009.carddominoes-285x285.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/02/carddominoes-285x285.jpg" alt="carddominoes" width="285" height="285" /></a>The card associations (Visa, MasterCard, et. al) very often know which merchant was compromised before even the banks or the merchant itself does. But they rarely tell banks which merchant got hacked. Rather, in response to a breach, the card associations will send each affected bank a list of card numbers that were compromised.</p>
<p>The bank may be able to work backwards from that list to the breached merchant if the merchant in question is not one that a majority of their cardholders shop at in a given month anyway. However, in the cases where banks do know which merchant caused a card to be compromised and/or replaced, the banks rarely share that information with their customers.</p>
<p>Here&#8217;s a look at some of the most common forms of credit card fraud:</p>
<p><strong>Hacked main street merchant, restaurant:</strong><br />
Most often powered by malicious software installed on point-of-sale devices remotely.</p>
<p><em>Distinguishing characteristic:</em> Most common and costly source of card fraud. Losses are high because crooks can take the information and produce counterfeit cards that can be used in big box stores to buy gift cards and/or expensive goods that can be easily resold for cash.</p>
<p><em>Chances of consumer learning source of fraud: </em>Low, depending on customer card usage.</p>
<p><strong>Processor breach:<br />
</strong>A network compromise at a company that processes transactions between credit card issuing banks and merchant banks.</p>
<p><em>Distinguishing characteristic:</em> High volume of card accounts can be stolen in a very short time.</p>
<p><em>Chances of consumer learning source of fraud: </em> Virtually nil. Processor breaches are rare compared to retail break-ins, but it&#8217;s also difficult for banks to trace back fraud on a card to a processor. Card associations/banks generally don&#8217;t tell consumers when they do know.</p>
<p><strong>Hacked point-of-sale service company/vendor:</strong></p>
<p><em>Distinguishing characteristic:</em> Can be time-consuming for banks and card associations to determine vendor responsible. Fraud is generally localized to a specific town or geographic region served by vendor.</p>
<p><em>Chances of consumer learning source of fraud:</em> Low, given that compromised point-of-sale service company or vendor does not have a direct relationship with the card holder or issuing bank.</p>
<p><strong>Hacked E-commerce Merchant:</strong><br />
A database or Web site compromise at an online merchant.</p>
<p><em>Distinguishing characteristic: </em>Results in online fraud. Consumer likely to learn about fraud from monthly statement, incorrectly attribute fraud to merchant where unauthorized transaction occurred. Bank customer service representatives are trained not to give out information about the breached online merchant, or address information associated with the fraudulent order.</p>
<p><em>Chances of consumer learning source of fraud:</em> Nil to low. <span id="more-29560"></span></p>
<div id="attachment_24447" style="width: 295px" class="wp-caption alignleft"><a href="media/f4091f67.pumpskimbt.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/01/pumpskimbt.png"><img class="size-medium wp-image-24447" src="media/4ade41bb.pumpskimbt-285x211.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/01/pumpskimbt-285x211.png" alt="A Bluetooth enabled gas pump skimmer lets thieves retrieve stolen card and PIN data wirelessly while they gas up." width="285" height="211" /></a><p class="wp-caption-text">A Bluetooth enabled gas pump skimmer lets thieves retrieve stolen card and PIN data wirelessly while they gas up.</p></div>
<p><strong>ATM or Gas Pump Skimmer:</strong><br />
Thieves attach physical fraud devices to ATMs and pumps to steal card numbers and PINs. For more on skimmers, see my <a title="http://krebsonsecurity.com/all-about-skimmers/" href="http://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers series</a>.</p>
<p><em>Distinguishing characteristic: </em>Fraud can take many months to figure out. Often tied to gang activity.</p>
<p><em>Chances of consumer learning source of fraud:</em> High. Bank should disclose to cardholder the source of the fraud and replace stolen funds.</p>
<p><strong>Crooked employee:</strong><br />
Uses hidden or handheld device to copy card for later counterfeiting.</p>
<p><em>Distinguishing characteristic: </em> Most frequently committed by restaurant workers. Often tied to a local crime rings, or seasonal and transient workers.</p>
<p><em>Chances of consumer learning source of fraud:</em> Nil to low.</p>
<p><strong>Lost/Stolen card:<br />
</strong></p>
<p><em>Distinguishing characteristic: </em>The smallest source of fraud on cards. Consumer generally knows immediately or is alerted by bank to suspicious transactions, which often involve small test transactions to see if the card is still active &#8212; such as at automated gas station pumps.</p>
<p><em>Chances of consumer learning source of fraud:</em> High.</p>
<p><strong>Malware on Consumer PC</strong></p>
<p><em>Distinguishing characteristic: </em>Malicious software that hooks into the victim&#8217;s browser, and records all data submitted into Web site forms, including credit card information. Leads to authorized online charges.</p>
<p><em>Chances of consumer learning source of fraud:</em> Discovering the infection? Fairly good. Definitively tying card-not-present card fraud to a malware infection? Very low.</p>
<p><strong>Physical record theft:</strong><br />
Merchant, government agency or some other entity charged with storing and protecting card data improperly disposes of card account records.</p>
<p><em>Distinguishing characteristic: </em>Usually not high-volume. Less common form of fraud than it used to be.</p>
<p><em>Chances of consumer learning source of fraud:</em> Nil to low.</p>
<p>I hope it&#8217;s clear from the above that most consumers are unlikely to discover the true source or reason for any card fraud. It&#8217;s far more important for cardholders to keep a close eye on their statements for unauthorized charges, and to report that activity as quickly as possible.</p>


feed_id: http://krebsonsecurity.com/?p=29582
title: Java Patch Plugs 19 Security Holes
uri: Java-Patch-Plugs-19-Security-Holes
url: http://krebsonsecurity.com/2015/01/java-patch-plugs-19-security-holes/
content:
<p><strong>Oracle</strong> this week released its quarterly patch update for <strong>Java</strong>, a widely-installed program that for most casual users has probably introduced more vulnerability than utility. If you have Java installed and require it for some application or Web site, it&#8217;s time to update it. If you&#8217;re not sure you have Java on your computer or are unsure why you still have it, read on for advice that could save you some security headaches down the road.</p>
<p><a href="media/f6d0854d.javamess.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/03/javamess.jpg"><img class="alignright size-medium wp-image-19243" src="media/5c15b877.javamess-285x226.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/03/javamess-285x226.jpg" alt="javamess" width="285" height="226" /></a>Oracle&#8217;s update brings <em>Java 7</em> to <em>Update 75</em> and <em>Java 8</em> to <em>Update 31</em>, and fixes at least 19 security vulnerabilities in the program. Security vendor <strong>Qualys</strong> <a title="https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/20/patch-tuesday-january-2015-2nd-edition" href="https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/20/patch-tuesday-january-2015-2nd-edition" target="_blank">notes</a> that 13 of those flaws are remotely exploitable, with a <a title="http://www.networkworld.com/article/2349392/cisco-subnet/common-vulnerability-scoring-system--cvss--explained.html" href="http://www.networkworld.com/article/2349392/cisco-subnet/common-vulnerability-scoring-system--cvss--explained.html" target="_blank">CVSS score</a> of 10 (the most severe possible score).</p>
<p>Java 7 users should know that Oracle <a title="http://www.oracle.com/technetwork/java/javase/documentation/autoupdatejre7tojre8-2389085.html" href="http://www.oracle.com/technetwork/java/javase/documentation/autoupdatejre7tojre8-2389085.html" target="_blank">plans</a> to start using the auto-update function built into the program to migrate those users to Java 8 this week.</p>
<p>According to a new <a title="http://www.cisco.com/web/offers/pdfs/cisco-asr-2015.pdf" href="media/a0b3b607.cisco-asr-2015.pdf" data-original-source="http://www.cisco.com/web/offers/pdfs/cisco-asr-2015.pdf" target="_blank">report</a> (PDF) from <strong>Cisco</strong>, online attacks that exploit Java vulnerabilities have decreased by 34 percent in the past year. Cisco reckons this is thanks to security improvements in the program, and to bad guys embracing new attack vectors &#8212; such <strong>Microsoft Silverlight</strong> flaws (if you&#8217;re a <strong>Netflix</strong> subscriber, you have Silverlight installed). Nevertheless, my message about Java will remain the same: Patch it, or pitch it.<span id="more-29582"></span></p>
<p>The trouble with Java is that it has a very broad install base, but many users don’t even know if they have it on their systems. There are a few of ways to find out if you have Java installed and what version may be running. Windows users can check for the program in the Add/Remove Programs listing in Windows, or visit Java.com and click the “Do I have Java?” link on the homepage. Updates also should be available via the <a title="http://www.java.com/en/download/help/javaconsole.xml" href="http://www.java.com/en/download/help/javaconsole.xml" target="_blank" rel="noreferrer">Java Control Panel</a> or from <a title="http://www.java.com" href="http://www.java.com/" target="_blank" rel="noreferrer">Java.com</a>.</p>
<p>If you really need and use Java for specific Web sites or applications, take a few minutes to update this software. In the past, updating via the control panel auto-selected the installation of third-party software, so be sure to look for any pre-checked &#8220;add-ons&#8221; before proceeding with an update through the Java control panel.</p>
<p>Otherwise, seriously consider removing Java altogether. I have long urged end users to junk Java unless they have a specific use for it (this advice does not scale for businesses, which often have legacy and custom applications that rely on Java). This widely installed and powerful program is riddled with security holes, and is a top target of malware writers and miscreants.</p>
<p>If you have an affirmative use or need for Java, there is a way to have this program installed while minimizing the chance that crooks will exploit unknown or unpatched flaws in the program: unplug it from the browser unless and until you’re at a site that requires it (or at least take advantage of <a title="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" href="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" target="_blank">click-to-play</a>, which can block Web sites from displaying both Java and Flash content by default). The latest versions of Java let users <a title="http://www.java.com/en/download/help/disable_browser.xml" href="http://www.java.com/en/download/help/disable_browser.xml" target="_blank" rel="noreferrer">disable Java content in web browsers</a> through the <a title="http://www.java.com/en/download/help/javaconsole.xml" href="http://www.java.com/en/download/help/javaconsole.xml" target="_blank" rel="noreferrer">Java Control Panel</a>. Alternatively, consider a dual-browser approach, unplugging Java from the browser you use for everyday surfing, and leaving it plugged in to a second browser that you only use for sites that require Java.</p>
<p>For Java power users — or for those who are having trouble upgrading or removing a stubborn older version — I recommend <a title="http://singularlabs.com/software/javara/" href="http://singularlabs.com/software/javara/" target="_blank" rel="noreferrer">JavaRa</a>, which can assist in repairing or removing Java when other methods fail (requires the <a title="http://www.microsoft.com/en-us/download/details.aspx?id=17851" href="http://www.microsoft.com/en-us/download/details.aspx?id=17851" target="_blank" rel="noreferrer">Microsoft .NET Framework</a>).</p>
<p>Many people confuse Java with <strong> JavaScript</strong>, a powerful scripting language that helps make sites interactive. Unfortunately, a huge percentage of Web-based attacks use JavaScript tricks to foist malicious software and exploits onto site visitors. For more about ways to manage JavaScript in the browser, check out my tutorial <a title="http://krebsonsecurity.com/tools-for-a-safer-pc/" href="http://krebsonsecurity.com/tools-for-a-safer-pc/" target="_blank">Tools for a Safer PC</a>.</p>


feed_id: http://krebsonsecurity.com/?p=29596
title: Flash Patch Targets Zero-Day Exploit
uri: Flash-Patch-Targets-Zero-Day-Exploit
url: http://krebsonsecurity.com/2015/01/flash-patch-targets-zero-day-exploit/
content:
<p><strong>Adobe</strong> today released an important security update for its <strong>Flash Player</strong> software that fixes a vulnerability which is already being exploited in active attacks. Compounding the threat, the company said it is investigating reports that crooks may have developed a separate exploit that gets around the protections in this latest update.</p>
<p><a href="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png"><img class="alignright  wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="190" height="162" /></a>Early indicators of a Flash <a title="http://en.wikipedia.org/wiki/Zero-day_attack" href="http://en.wikipedia.org/wiki/Zero-day_attack" target="_blank">zero-day</a> vulnerability came this week in <a title="http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-flash.html" href="http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-flash.html" target="_blank">a blog post</a> by <strong>Kafeine, </strong>a noted security researcher who keeps close tabs on new innovations in &#8220;exploit kits.&#8221; Often called exploit packs &#8212; exploit kits are automated software tools that help thieves booby-trap hacked sites to deploy malicious code.</p>
<p>Kafeine wrote that a popular crimeware package called the <strong>Angler Exploit Kit</strong> was targeting previously undocumented vulnerability in Flash that appears to work against many different combinations of the <strong>Internet Explorer</strong> browser on <strong>Microsoft Windows</strong> systems.</p>
<p>Attackers may be targeting Windows and IE users for now, but the vulnerability fixed by this update also exists in versions of Flash that run on <strong>Mac</strong> and <strong>Linux</strong> as well. The Flash update brings the media player to version <em>16.0.0.287</em> on Mac and Windows systems, and <em>11.2.202.438</em> on Linux.</p>
<p>While Flash users should definitely update as soon as possible, there are indications that this fix may not plug all of the holes in Flash for which attackers have developed exploits. In <a title="http://helpx.adobe.com/security/products/flash-player/apsb15-02.html" href="http://helpx.adobe.com/security/products/flash-player/apsb15-02.html" target="_blank">a statement</a> released along with the Flash update today, Adobe said its patch addresses a newly discovered vulnerability that is being actively exploited, but that there appears to be another active attack this patch doesn&#8217;t address.</p>
<p>&#8220;Adobe is aware of reports that an exploit for <strong>CVE-2015-0310</strong> exists in the wild, which is being used in attacks against older versions of Flash Player,&#8221; Adobe said. &#8220;Additionally, we are investigating reports that a separate exploit for Flash Player 16.0.0.287 and earlier also exists in the wild.&#8221;</p>
<p>To see which version of Flash you have installed, check <a title="https://www.adobe.com/software/flash/about/" href="https://www.adobe.com/software/flash/about/" target="_blank">this link</a>. IE10/IE11 on Windows 8.x and Chrome should auto-update their versions of Flash, although as of this writing it seems that the latest version of Chrome (40.0.2214.91) is still running <em>v. 16.0.0.257</em>. <span id="more-29596"></span></p>
<p>The most recent versions of Flash are available from the <a title="http://get.adobe.com/flashplayer/" href="http://get.adobe.com/flashplayer/" target="_blank">Flash home page</a>, but beware potentially unwanted add-ons, like McAfee Security Scan. To avoid this, uncheck the pre-checked box before downloading, or grab your OS-specific Flash download from <a title="http://www.adobe.com/products/flashplayer/distribution3.html" href="http://www.adobe.com/products/flashplayer/distribution3.html" target="_blank">here</a>.</p>
<p>Windows users who browse the Web with anything other than Internet Explorer may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>
<p>I am looking forward to day in which far fewer sites require Flash Player to view content, and instead rely on <a title="http://en.wikipedia.org/wiki/HTML5" href="http://en.wikipedia.org/wiki/HTML5" target="_blank">HTML5</a> for rendering video content. For now, it&#8217;s probably impractical for most users to remove Flash altogether, but there are in-between options to limit automatic rendering of Flash content in the browser. My favorite is <a title="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" href="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" target="_blank">click-to-play</a>, which is a feature available for most browsers (except IE, sadly) that blocks Flash content from loading by default, replacing the content on Web sites with a blank box. With click-to-play, users who wish to view the blocked content need only click the boxes to enable Flash content inside of them (click-to-play also blocks Java applets from loading by default).</p>
<p>Windows users also should take full advantage of the <a title="http://www.microsoft.com/en-us/download/details.aspx?id=43714" href="http://www.microsoft.com/en-us/download/details.aspx?id=43714" target="_blank">Enhanced Mitigation Experience Toolkit</a> (EMET), a free tool from Microsoft that can <a title="http://krebsonsecurity.com/2013/06/windows-security-101-emet-4-0/" href="http://krebsonsecurity.com/2013/06/windows-security-101-emet-4-0/" target="_blank">help Windows users</a> beef up the security of third-party applications.</p>
<p><strong>Update 11:05 p.m. ET:</strong> Adobe just issued <a title="http://helpx.adobe.com/security/products/flash-player/apsa15-01.html" href="http://helpx.adobe.com/security/products/flash-player/apsa15-01.html" target="_blank">a bulletin</a> confirming that this latest patch does not protect Flash users against all current, active attacks. The company says it plans to release an update the week of Jan. 26 to address this other security issue.</p>


feed_id: http://krebsonsecurity.com/?p=29556
title: Password Re-use Fuels Starwood Fraud Spike
uri: Password-Re-use-Fuels-Starwood-Fraud-Spike
url: http://krebsonsecurity.com/2015/01/password-re-use-fuels-starwood-fraud-spike/
content:
<p>Two different readers have written in this past week to complain about having their <strong>Starwood Preferred Guest</strong> loyalty accounts hijacked by scammers. The spike in fraud appears to be tied to a combination of password re-use and the release of a tool that automates the checking of account credentials at the Web site for the popular travel rewards program.</p>
<p><a href="media/8fc18a13.spg.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/spg.png"><img class="alignright size-medium wp-image-29601" src="media/68ef66be.spg-285x153.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/spg-285x153.png" alt="spg" width="285" height="153" /></a>The mass compromise of Starwood accounts began in earnest less than a week ago. That roughly coincides with a Starwoods-specific account-checking tool that was released for free on <strong>Leakforums[dot]org</strong>, an English-language forum dedicated to helping (mostly low-skilled) misfits monetize compromised credentials from various online services, particularly e-retailers, cloud-based services and points or rewards accounts.</p>
<p>The tool is little more than a bit of code that automates the checking of account credentials stolen from other data breaches, to see if the stolen credentials also work at Starwoods.com. These types of account checking tools work because &#8212; despite constant advice to the contrary &#8212; a fair number of Internet users will rely on the same email address (username) and password pair for accounts at multiple sites.</p>
<p>The release of the account checking tool caused numerous Leakforums denizens to run the tool against various username and password lists stolen in previous data breaches. In less than 24 hours after its release, there were more than a half dozen Leakforums members selling compromised accounts. One seller advertised a Starwood account with 70,000 points for sale at just $3, while accounts with about 40,000 points sold for $1.50.</p>
<div id="attachment_29598" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/dbfac9fb.starwoodsleak.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/starwoodsleak.png"><img class="size-large wp-image-29598" src="media/3197b5f7.starwoodsleak-600x442.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/starwoodsleak-600x442.png" alt="The release of an account checking tool for Starwood credentials has prompted dozens of  miscreants to sell and cash out hijacked Starwood reward points." width="600" height="442" /></a><p class="wp-caption-text">The release of an account checking tool for Starwood credentials has prompted dozens of miscreants to sell and cash out hijacked Starwood reward points.</p></div>
<p>According to a tutorial posted on the forum, hijacked account buyers &#8220;cash out&#8221; their purchases by creating new Starwood accounts and then forcing the hijacked account to transfer its account balance to the new account. The reward points are then exchanged for gift cards that can be used as cash.<br />
<span id="more-29556"></span></p>
<p>Starwood does offer customers the option to receive email or text message alerts when account changes are made. But the tutorial on Leakforums encourages buyers to change the email address, password and other contact information on the victim&#8217;s account, effectively locking out the legitimate user.</p>
<p><strong>Chris Holdren</strong>, senior vice president of global and digital at Starwood Preferred Guest, said the attacks of the past week track closely to the fraud patterns that have hit other loyalty programs in recent months, including <a title="http://krebsonsecurity.com/2014/11/thieves-cash-out-rewards-points-accounts/" href="http://krebsonsecurity.com/2014/11/thieves-cash-out-rewards-points-accounts/" target="_blank">Hilton Honors</a>.</p>
<p>&#8220;They appear to be using credentials from elsewhere and seeing how many of those match up to Starwood accounts to see how many hits they can get,&#8221; Holdren said.</p>
<p>Holdren added that Starwood users who have had their accounts hijacked will not lose points due to fraud, a claim that was backed up by at least one of the two readers who initially contacted KrebsOnSecurity about being victimized by fraudsters.</p>
<p>&#8220;Not one guest is going to lose even a single Starwood point through this activity,&#8221; Holdren said. &#8220;We have a very large team globally mobilized to combat it.&#8221;</p>
<p>Could companies like Starwood be doing a lot more to facilitate safer login procedures, such as 2-step authentication? Absolutely. Even so, far too many people re-use the same passwords at multiple sites that hold either their credit card information or points that can easily be redeemed for cash.</p>


feed_id: http://krebsonsecurity.com/?p=28836
title: Spreading the Disease and Selling the Cure
uri: Spreading-the-Disease-and-Selling-the-Cure
url: http://krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/
content:
<p>When <strong>Karim Rattani</strong> isn’t manning the till at the local <strong>Subway</strong> franchise in his adopted hometown of Cartersville, Ga., he’s usually tinkering with code. The 21-year-old Pakistani native is the lead programmer for two very different yet complementary online services: One lets people launch powerful attacks that can knock Web sites, businesses and other targets offline for hours at a time; the other is a Web hosting service designed to help companies weather such assaults.</p>
<div id="attachment_29632" style="width: 295px" class="wp-caption alignright"><a class="lightbox" href="media/b48f3190.GRIMBOOTER1.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/GRIMBOOTER1.png"><img class="size-medium wp-image-29632" src="media/7b36f1d6.GRIMBOOTER1-285x202.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/GRIMBOOTER1-285x202.png" alt="Grimbooter" width="285" height="202" /></a><p class="wp-caption-text">Grimbooter</p></div>
<p>Rattani helps run two different “booter” or “stresser” services – <strong>grimbooter[dot]com</strong>, and <strong>restricted-stresser[dot]info</strong>. He also works on <strong>TheHosted[dot]me</strong>, a Web hosting firm marketed to Web sites looking for protection from the very attacks he helps to launch.</p>
<p>As part of an <a title="http://krebsonsecurity.com/?s=booter&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=booter&amp;x=0&amp;y=0" target="_blank">ongoing series</a> on booter services, I reached out to Rattani via his Facebook account (which was replete with images linking to fake Youtube sites that foist malicious software disguised as <strong>Adobe’s Flash Player</strong> plugin). It turns out, the same Google Wallet is used to accept payment for all three services, and that wallet traced back to Rattani.</p>
<p>In a Facebook chat, Rattani claimed he doesn’t run the companies, but merely accepts Google Wallet payments for them and then wires the money (minus his cut) to a young man named <strong>Danial Rajput</strong> &#8212; <a title="http://www.facebook.com/danial.rajput/about" href="http://www.facebook.com/danial.rajput/about" target="_blank">his business partner</a> back in Karachi. Rajput declined to be interviewed for this story.</p>
<p>The work that Rattani does for these booter services brings in roughly $2,500 a month &#8212; far more than he could ever hope to make in a month slinging sandwiches. Asked whether he sees a conflict of interest in his work, Rattani was ambivalent.</p>
<p>“It is kind of [a conflict], but if my friend won’t sell [the service], someone else will,” he said.</p>
<p>Rattani and his partner are among an increasing number of young men who sell legally murky DDoS-for-hire services. The proprietors of these services market them as purely for Web site administrators to &#8220;stress test&#8221; their sites to ensure they can handle high volumes of visitors.</p>
<p>But that argument is about as convincing as a prostitute trying to pass herself off as an escort. The owner of the attack services (the aforementioned Mr. Rajput) advertises them at <strong>hackforums[dot]net</strong>, an English language forum where tons of low-skilled hackers hang out and rent such attack services to prove their &#8220;skills&#8221; and toughness to others. Indeed, <a title="http://krebsonsecurity.com/wp-content/uploads/2015/01/vpsfordossing.png" href="media/f6b51dd0.vpsfordossing.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/vpsfordossing.png" target="_blank">in his own first post on Hackforums in 2012</a>, Rajput states that &#8220;my aim is to provide the best quality vps [virtual private server] for ddosing :P&#8221;.<span id="more-28836"></span></p>
<p><strong>Damon McCoy,</strong> an assistant professor of computer science at <strong>George Mason University,</strong> said the number of these DDoS-for-hire services has skyrocketed over the past two years. Nearly all of these services allow customers to pay for attacks using <strong>PayPal</strong> or <strong>Google Wallet</strong>, even though doing so violates the terms of service spelled out by those payment networks.</p>
<p>&#8220;The main reason they are becoming an increasing problem is that they are profitable,&#8221; McCoy said. &#8220;They are also easy to setup using leaked code for other booters, increasing demand from gamers and other customers, decreasing cost of attack infrastructure that can be amplified using common DDoS attacks. Also, it is relatively low-risk to operate a booter service when using rented attack servers instead of botnets.&#8221;</p>
<p>The booter services are proliferating thanks mainly to free services offered by <strong>CloudFlare</strong>, a content distribution network that offers gratis DDoS protection for virtually all of the booter services currently online. That includes the <strong>Lizardstresser</strong>, the attack service launched by the same Lizard Squad (a.k.a. Loser Squad) criminals whose assaults knocked the <strong>Microsoft Xbox</strong> and <strong>Sony Playstation</strong> networks offline on Christmas Day 2014.</p>
<p>The sad truth is that most booter services probably would not be able to remain in business without CloudFlare&#8217;s free service. That&#8217;s because outside of CloudFlare, real DDoS protection services are expensive, and just about the only thing booter service customers enjoy attacking more than Minecraft and online gaming sites are, well, other booter services.</p>
<p>For example, looking at the (now leaked) back-end database for the LizardStresser, we can see that TheHosted and its various properties were targeted for attacks repeatedly by one of the Loser Squad&#8217;s more prominent members.</p>
<p>The Web site <strong>crimeflare.com</strong>, which tracks abusive sites that hide behind CloudFlare, has <a title="http://www.crimeflare.com/cfsites.html" href="http://www.crimeflare.com/cfsites.html" target="_blank">cataloged</a> more than 200 DDoS-for-hire sites using CloudFlare. For its part, CloudFlare&#8217;s owners have rather vehemently resisted the notion of blocking booter services from using the company&#8217;s services, saying that doing so would lead CloudFlare down a &#8220;<a title="http://blog.cloudflare.com/thoughts-on-abuse" href="http://blog.cloudflare.com/thoughts-on-abuse" target="_blank">slippery slope of censorship</a>.&#8221;</p>
<p>As I observed in a previous story about booters, CloudFlare CEO <strong>Matthew Prince</strong> has noted that while Cloudflare will respond to legal process and subpoenas from law enforcement to take sites offline, “sometimes we have court orders that order us to not take sites down.” Indeed, one such example was <a title="http://krebsonsecurity.com/2012/06/carderprofit-forum-sting-nets-26-arrests/" href="http://krebsonsecurity.com/2012/06/carderprofit-forum-sting-nets-26-arrests/" target="_blank">CarderProfit</a>, a Cloudflare-protected carding forum that turned out to be <a title="http://krebsonsecurity.com/2014/05/blackshades-trojan-users-had-it-coming/" href="http://krebsonsecurity.com/2014/05/blackshades-trojan-users-had-it-coming/" target="_blank">an elaborate sting operation</a> set up by the FBI.</p>
<p>I suppose it&#8217;s encouraging that prior to CloudFlare, Prince was co-creator of <a title="https://www.projecthoneypot.org/" href="https://www.projecthoneypot.org/" target="_blank">Project Honey Pot</a>, which bills itself as the largest open-source community dedicated to tracking online fraud and abuse. In hacking and computer terminology, <a title="http://en.wikipedia.org/wiki/Honeypot_%28computing%29" href="http://en.wikipedia.org/wiki/Honeypot_%28computing%29" target="_blank">a honeypot</a> is a trap set to detect, deflect or otherwise counteract attempts at unauthorized use or abuse of information systems.</p>
<p>It may well turn out to be the case that federal investigators are allowing these myriad booter services to remain in operation so that they can gather copious evidence for future criminal prosecutions against their owners and users. In the meantime, however, it will continue to be possible to purchase powerful DDoS attacks with little more than a credit card or prepaid debit card.</p>


