# articles

feed_id: https://krebsonsecurity.com/?p=52325
title: Robocall Legal Advocate Leaks Customer Data
uri: Robocall-Legal-Advocate-Leaks-Customer-Data
url: https://krebsonsecurity.com/2020/08/robocall-legal-advocate-leaks-customer-data/
content:
<p>A California company that helps telemarketing firms avoid getting sued for violating a federal law that seeks to curb robocalls has leaked the phone numbers, email addresses and passwords of all its customers, as well as the mobile phone numbers and other data on people who have hired lawyers to go after telemarketers.</p>
<p><img class="size-full wp-image-52557 aligncenter" src="media/69d68667.robocalls.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/robocalls.png" alt="" width="477" height="312" /></p>
<p><a href="https://www.blacklistalliance.com" target="_blank" rel="noopener noreferrer">The Blacklist Alliance</a> provides technologies and services to marketing firms concerned about lawsuits under the <a href="https://en.wikipedia.org/wiki/Telephone_Consumer_Protection_Act_of_1991" target="_blank" rel="noopener noreferrer">Telephone Consumer Protection Act</a> (TCPA), a 1991 law that restricts the making of telemarketing calls through the use of automatic telephone dialing systems and artificial or prerecorded voice messages. The TCPA prohibits contact with consumers &#8212; even via text messages &#8212; unless the company has &#8220;prior express consent&#8221; to contact the consumer.</p>
<p>With statutory damages of $500 to $1,500 per call, the TCPA has prompted a flood of lawsuits over the years. From the telemarketer&#8217;s perspective, the TCPA can present something of a legal minefield in certain situations, such as when a phone number belonging to someone who&#8217;d previously given consent gets reassigned to another subscriber.</p>
<p>Enter The Blacklist Alliance, which promises to help marketers avoid TCPA legal snares set by &#8220;professional plaintiffs and class action attorneys seeking to cash in on the TCPA.&#8221; According to the Blacklist, one of the &#8220;dirty tricks&#8221; used by TCPA &#8220;frequent filers&#8221; includes &#8220;phone flipping,&#8221; or registering multiple prepaid cell phone numbers to receive calls intended for the person to whom a number was previously registered.</p>
<p>Lawyers representing TCPA claimants typically redact their clients&#8217; personal information from legal filings to protect them from retaliation and to keep their contact information private. The Blacklist Alliance researches TCPA cases to uncover the phone numbers of plaintiffs and sells this data in the form of list-scrubbing services to telemarketers.</p>
<p>&#8220;TCPA predators operate like malware,&#8221; The Blacklist explains on its website. &#8220;Our Litigation Firewall isolates the infection and protects you from harm. Scrub against active plaintiffs, pre litigation complainers, active attorneys, attorney associates, and more. Use our robust API to seamlessly scrub these high-risk numbers from your outbound campaigns and inbound calls, or adjust your suppression settings to fit your individual requirements and appetite for risk.&#8221;</p>
<p>Unfortunately for the Blacklist paying customers and for people represented by attorneys filing TCPA lawsuits, the Blacklist&#8217;s own Web site until late last week leaked reams of data to anyone with a Web browser. Thousands of documents, emails, spreadsheets, images and the names tied to countless mobile phone numbers all could be viewed or downloaded without authentication from the domain theblacklist.click.</p>
<p>The directory also included all 388 Blacklist customer API keys, as well as each customer&#8217;s phone number, employer, username and password (scrambled with the relatively weak <a href="https://en.wikipedia.org/wiki/MD5" target="_blank" rel="noopener noreferrer">MD5 password hashing algorithm</a>).</p>
<p><img class="alignright wp-image-52559" src="media/1aebc128.robocall2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/robocall2.png" alt="" width="249" height="310" />The leaked Blacklist customer database points to various companies you might expect to see using automated calling systems to generate business, including real estate and life insurance providers, credit repair companies and a long list of online advertising firms and individual digital marketing specialists.</p>
<p>The very first account in the leaked Blacklist user database corresponds to its CEO <a href="https://www.linkedin.com/in/seth-heyman-971b5b24/" target="_blank" rel="noopener noreferrer">Seth Heyman</a>, an attorney southern California. Mr. Heyman did not respond to multiple requests for comment, although The Blacklist stopped leaking its database not long after that contact request.</p>
<p>Two other accounts marked as administrators were among the third and sixth registered users in the database; those correspond to two individuals at <strong>Riip Digital</strong>, a California-based email marketing concern that serves a <a href="http://sites.riip.com/" target="_blank" rel="noopener noreferrer">diverse range of clients</a> in the lead generation business, from <a href="http://sites.riip.com/sites/Debt_003/" target="_blank" rel="noopener noreferrer">debt relief</a> and <a href="http://sites.riip.com/sites/TimeShare/" target="_blank" rel="noopener noreferrer">timeshare companies</a>, to <a href="http://sites.riip.com/sites/r2d/" target="_blank" rel="noopener noreferrer">real estate firms</a> and <a href="http://sites.riip.com/sites/SuperCBD/" target="_blank" rel="noopener noreferrer">CBD vendors</a>.</p>
<p>Riip Digital did not respond to requests for comment. But According to <strong>Spamhaus</strong>, an anti-spam group relied upon by many Internet service providers (ISPs) to block unsolicited junk email, the company has <a href="https://www.spamhaus.org/rokso/evidence/ROK10959/lead-research-group-riip-digital-inc.-throughput-inc./main-info" target="_blank" rel="noopener noreferrer">a storied history</a> of so-called &#8220;snowshoe spamming,&#8221; which involves junk email purveyors who try to avoid spam filters and blacklists by spreading their spam-sending systems across a broad swath of domains and Internet addresses.<span id="more-52325"></span></p>
<p>The irony of this data leak is that marketers who constantly scrape the Web for consumer contact data may not realize the source of the information, and end up feeding it into automated systems that peddle dubious wares and services via automated phone calls and text messages. To the extent this data is used to generate sales leads that are then sold to others, such a leak could end up causing more legal problems for The Blacklist&#8217;s customers.</p>
<p>The Blacklist and their clients talk a lot about technologies that they say separate automated telephonic communications from dime-a-dozen robocalls, such as software that delivers recorded statements that are manually selected by a live agent. But for your average person, this is likely a distinction without a difference.</p>
<p>Robocalls are permitted for political candidates, but beyond that if the recording is a sales message and you haven’t given your written permission to get calls from the company on the other end, the call is illegal. According to the <strong>Federal Trade Commission </strong>(FTC), companies are using auto-dialers to send out thousands of phone calls every minute for an incredibly low cost.</p>
<p>In fiscal year 2019, the FTC received 3.78 million complaints about robocalls. Readers may be able to avoid some marketing calls by registering their mobile number with the <a href="http://www.donotcall.gov/" target="_blank" rel="noopener noreferrer">Do Not Call registry</a>, but the list appears to do little to deter all automated calls &#8212; particularly scam calls that spoof their real number. If and when you do receive robocalls, consider <a href="http://complaints.donotcall.gov/" target="_blank" rel="noopener noreferrer">reporting them to the FTC</a>.</p>
<p>Some wireless providers now offer additional services and features to help block automated calls. For example, <strong>AT&amp;T</strong> offers wireless customers its free <a href="https://www.att.com/offers/call-protect.html" target="_blank" rel="noopener noreferrer">Call Protect app</a>, which screens incoming calls and flags those that are likely spam calls. See <a href="https://www.fcc.gov/consumers/guides/stop-unwanted-calls-texts-and-faxes" target="_blank" rel="noopener noreferrer">the FCC’s robocall resource page</a> for links to resources at your mobile provider. In addition, there are a number of third-party mobile apps designed to block spammy calls, such as <a href="https://www.nomorobo.com/" target="_blank" rel="noopener noreferrer">Nomorobo</a> and <a href="https://www.truecaller.com/" target="_blank" rel="noopener noreferrer">TrueCaller</a>.</p>
<p>Obviously, not all telemarketing is spammy or scammy. I have friends and relatives who&#8217;ve worked at non-profits that rely a great deal on fundraising over the phone. Nevertheless, readers who are fed up with telemarketing calls may find some catharsis in the <a href="https://jollyrogertelephone.com/" target="_blank" rel="noopener noreferrer">Jolly Roger Telephone Company</a>, which offers subscribers a choice of <a href="https://www.youtube.com/c/jollyrogertelephoneco" target="_blank" rel="noopener noreferrer">automated bots</a> that keep telemarketers engaged for several minutes. The service lets subscribers choose which callers should get the bot treatment, and then records the result.</p>
<p>For my part, the volume of automated calls hitting my mobile number got so bad that I recently enabled a setting on my smart phone to simply send to voicemail all calls from numbers that aren&#8217;t already in my contacts list. This may not be a solution for everyone, but since then I haven&#8217;t received a single spammy jingle.</p>


feed_id: https://krebsonsecurity.com/?p=52574
title: Porn Clip Disrupts Virtual Court Hearing for Alleged Twitter Hacker
uri: Porn-Clip-Disrupts-Virtual-Court-Hearing-for-Alleged-Twitter-Hacker
url:
https://krebsonsecurity.com/2020/08/porn-clip-disrupts-virtual-court-hearing-for-alleged-twitter-hacker/

content:
<p>Perhaps fittingly, a Web-streamed court hearing for the 17-year-old alleged mastermind of the July 15 mass hack against <strong>Twitter</strong> was cut short this morning after mischief makers injected a pornographic video clip into the proceeding.</p>
<div id="attachment_52527" style="width: 236px" class="wp-caption alignright"><img aria-describedby="caption-attachment-52527" class=" wp-image-52527" src="media/870ebbfb.gclark.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/gclark.png" alt="" width="226" height="265" /><p id="caption-attachment-52527" class="wp-caption-text">17-year-old Graham Clark of Tampa, Fla. was among those charged in the July 15 Twitter hack. Image: Hillsborough County Sheriff&#8217;s Office.</p></div>
<p>The incident occurred at a bond hearing held via the videoconferencing service <strong>Zoom</strong> by the Hillsborough County, Fla. criminal court in the case of <strong>Graham Clark</strong>. The 17-year-old from Tampa was arrested earlier this month on suspicion of social engineering his way into Twitter&#8217;s internal computer systems and tweeting out a bitcoin scam through the accounts of high-profile Twitter users.</p>
<p>Notice of the hearing was available via public records filed with the Florida state attorney&#8217;s office. The notice specified the Zoom meeting time and ID number, essentially allowing anyone to participate in the proceeding.</p>
<p>Even before the hearing officially began it was clear that the event would likely be &#8220;zoom bombed.&#8221; That&#8217;s because while participants were muted by default, they were free to unmute their microphones and transmit their own video streams to the channel.</p>
<p>Sure enough, less than a minute had passed before one attendee not party to the case interrupted a discussion between Clark&#8217;s attorney and the judge by streaming a live video of himself adjusting his face mask. Just a few minutes later, someone began interjecting loud music.</p>
<p>It became clear that presiding <strong>Judge Christopher C. Nash</strong> was personally in charge of administering the video hearing when, after roughly 15 seconds worth of random chatter interrupted the prosecution&#8217;s response, Nash told participants he was removing the troublemakers as quickly as he could.</p>
<div id="attachment_52577" style="width: 235px" class="wp-caption alignleft"><img aria-describedby="caption-attachment-52577" class=" wp-image-52577" src="media/9fd35333.judgenash.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/judgenash.png" alt="" width="225" height="221" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/08/judgenash.png 800w, https://krebsonsecurity.com/wp-content/uploads/2020/08/judgenash-580x571.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/08/judgenash-768x756.png 768w" sizes="(max-width: 225px) 100vw, 225px" /><p id="caption-attachment-52577" class="wp-caption-text">Judge Nash, visibly annoyed immediately after one of the many disruptions to today&#8217;s hearing.</p></div>
<p>What transpired a minute later was almost inevitable given the permissive settings of this particular Zoom conference call: Someone streamed a graphic video clip from Pornhub for approximately 15 seconds before Judge Nash abruptly terminated the broadcast.</p>
<p>With the ongoing pestilence that is the COVID-19 pandemic, the nation&#8217;s state and federal courts have largely been forced to conduct proceedings remotely via videoconferencing services. While Zoom and others do offer settings that can prevent participants from injecting their own audio and video into the stream unless invited to do so, those settings evidently were not enabled in today&#8217;s meeting.</p>
<p>At issue before the court today was a defense motion to modify the amount of the defendant&#8217;s bond, which has been set at $750,000. The prosecution had argued that Clark should be required to show that any funds used toward securing that bond were gained lawfully, and were not merely the proceeds from his alleged participation in the Twitter bitcoin scam or some other form of cybercrime.</p>
<div id="attachment_52580" style="width: 238px" class="wp-caption alignright"><img aria-describedby="caption-attachment-52580" class=" wp-image-52580" src="media/ac4ba134.image-2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/image-2.png" alt="" width="228" height="224" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/08/image-2.png 778w, https://krebsonsecurity.com/wp-content/uploads/2020/08/image-2-580x569.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/08/image-2-768x753.png 768w" sizes="(max-width: 228px) 100vw, 228px" /><p id="caption-attachment-52580" class="wp-caption-text">Florida State Attorney Andrew Warren&#8217;s reaction as a Pornhub clip began streaming to everyone in today&#8217;s Zoom proceeding.</p></div>
<p>Mr. Clark&#8217;s attorneys disagreed, and spent most of the uninterrupted time in today&#8217;s hearing explaining why their client could safely be released under a much smaller bond and close supervision restrictions.</p>
<p>On Sunday, The New York Times <a href="https://www.nytimes.com/2020/08/02/technology/florida-teenager-twitter-hack.html" target="_blank" rel="noopener noreferrer">published an in-depth look into Clark&#8217;s wayward path</a> from a small-time cheater and hustler in online games like Minecraft to big-boy schemes involving <a href="https://krebsonsecurity.com/?s=sim+swapping&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">SIM swapping</a>, a form of fraud that involves social engineering employees at mobile phone companies to gain control over a target&#8217;s phone number and any financial, email and social media accounts associated with that number.</p>
<p>According to The Times, Clark was suspected of being involved in a 2019 SIM swapping incident which led to the theft of 164 bitcoins from <strong>Gregg Bennett</strong>, a tech investor in the Seattle area. That theft would have been worth around $856,000 at the time; these days 164 bitcoins is worth approximately $1.8 million.</p>
<p>The Times said that soon after the theft, Bennett received an extortion note signed by Scrim, one of the hacker handles alleged to have been used by Clark. From that story:</p>
<blockquote><p>&#8220;We just want the remainder of the funds in the Bittrex,&#8221; Scrim wrote, referring to the Bitcoin exchange from which the coins had been taken. &#8220;We are always one step ahead and this is your easiest option.&#8221;</p>
<p>In April, the Secret Service seized 100 Bitcoins from Mr. Clark, according to government forfeiture documents. A few weeks later, Mr. Bennett received a letter from the Secret Service saying they had recovered 100 of his Bitcoins, citing the same code that was assigned to the coins seized from Mr. Clark.</p></blockquote>
<p>Florida prosecutor Darrell Dirks was in the middle of explaining to the judge that investigators are still in the process of discovering the extent of Clark&#8217;s alleged illegal hacking activities since the Secret Service returned the 100 bitcoin when the porn clip was injected into the Zoom conference.</p>
<p>Ultimately, Judge Nash decided to keep the bond amount as is, but to remove the condition that Clark prove the source of the funds.</p>
<p>Clark has been charged with 30 felony counts and is being tried as an adult. Federal prosecutors also have <a href="https://krebsonsecurity.com/2020/07/three-charged-in-july-15-twitter-compromise/" target="_blank" rel="noopener noreferrer">charged two other young men suspected of playing roles in the Twitter hack</a>, including a 22-year-old from Orlando, Fla. and a 19-year-old from the United Kingdom.</p>


feed_id: https://krebsonsecurity.com/?p=52594
title: Hacked Data Broker Accounts Fueled Phony COVID Loans, Unemployment Claims
uri: Hacked-Data-Broker-Accounts-Fueled-Phony-COVID-Loans-Unemployment-Cla
url:
https://krebsonsecurity.com/2020/08/hacked-data-broker-accounts-fueled-phony-covid-loans-unemployment-claims/

content:
<p>A group of thieves thought to be responsible for collecting millions in fraudulent small business loans and unemployment insurance benefits from COVID-19 economic relief efforts gathered personal data on people and businesses they were impersonating by leveraging several compromised accounts at a little-known U.S. consumer data broker, KrebsOnSecurity has learned.</p>
<p><img class="aligncenter  wp-image-52613" src="media/c117e8e7.covidfraud.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/covidfraud.png" alt="" width="597" height="338" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/08/covidfraud.png 648w, https://krebsonsecurity.com/wp-content/uploads/2020/08/covidfraud-580x328.png 580w" sizes="(max-width: 597px) 100vw, 597px" /></p>
<p>In June, KrebsOnSecurity was contacted by a cybersecurity researcher who discovered that a group of scammers was sharing highly detailed personal and financial records on Americans via a free web-based email service that allows anyone who knows an account&#8217;s username to view all email sent to that account &#8212; without the need of a password.</p>
<p>The source, who asked not to be identified in this story, said he&#8217;s been monitoring the group&#8217;s communications for several weeks and sharing the information with state and federal authorities in a bid to disrupt their fraudulent activity.</p>
<p>The source said the group appears to consist of several hundred individuals who collectively have stolen tens of millions of dollars from U.S. state and federal treasuries via phony loan applications with the <strong>U.S. Small Business Administration</strong> (SBA) and through <a href="https://krebsonsecurity.com/?s=unemployment+insurance&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">fraudulent unemployment insurance claims made against several states</a>.</p>
<p>KrebsOnSecurity reviewed dozens of emails the fraud group exchanged, and noticed that a great many consumer records they shared carried a notation indicating they were cut and pasted from the output of queries made at <strong>Interactive Data LLC</strong>, a Florida-based data analytics company.</p>
<p>Interactive Data, also known as <a href="https://www.ididata.com/" target="_blank" rel="noopener noreferrer">IDIdata.com,</a> markets access to a &#8220;massive data repository&#8221; on U.S. consumers to a range of clients, including law enforcement officials, debt recovery professionals, and anti-fraud and compliance personnel at a variety of organizations.</p>
<p>The consumer dossiers obtained from IDI and shared by the fraudsters include a staggering amount of sensitive data, including:</p>
<p>-full Social Security number and date of birth;<br />
-current and all known previous physical addresses;<br />
-all known current and past mobile and home phone numbers;<br />
-the names of any relatives and known associates;<br />
-all known associated email addresses<br />
-IP addresses and dates tied to the consumer&#8217;s online activities;<br />
-vehicle registration, and property ownership information<br />
-available lines of credit and amounts, and dates they were opened<br />
-bankruptcies, liens, judgments, foreclosures and business affiliations</p>
<p>Reached via phone, <a href="https://www.marketscreener.com/business-leaders/Derek-Dubner-0FF5XY-E/biography/" target="_blank" rel="noopener noreferrer">IDI Holdings CEO Derek Dubner</a> acknowledged that a review of the consumer records sampled from the fraud group&#8217;s shared communications indicates &#8220;a handful&#8221; of authorized IDI customer accounts had been compromised.</p>
<p>&#8220;We identified a handful of legitimate businesses who are customers that may have experienced a breach,&#8221; Dubner said.</p>
<p><a class="lightbox" href="media/071eb79a.idi.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/idi.png"><img class="aligncenter wp-image-52609" src="media/071eb79a.idi.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/idi.png" alt="" width="595" height="435" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/08/idi.png 1114w, https://krebsonsecurity.com/wp-content/uploads/2020/08/idi-580x424.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/08/idi-940x687.png 940w, https://krebsonsecurity.com/wp-content/uploads/2020/08/idi-768x561.png 768w" sizes="(max-width: 595px) 100vw, 595px" /></a></p>
<p>Dubner said all customers are required to use multi-factor authentication, and that everyone applying for access to its services undergoes a rigorous vetting process.</p>
<p>&#8220;We absolutely credential businesses and have several ways do that and exceed the gold standard, which is following some of the credit bureau guidelines,&#8221; he said. &#8220;We validate the identity of those applying [for access], check with the applicant&#8217;s state licensor and individual licenses.&#8221;</p>
<p>Citing an ongoing law enforcement investigation into the matter, Dubner declined to say if the company knew for how long the handful of customer accounts were compromised, or how many consumer records were looked up via those stolen accounts.</p>
<p>&#8220;We are communicating with law enforcement about it,&#8221; he said. &#8220;There isn&#8217;t much more I can share because we don&#8217;t want to impede the investigation.&#8221;</p>
<p>The source told KrebsOnSecurity he&#8217;s identified more than 2,000 people whose SSNs, DoBs and other data were used by the fraud gang to file for unemployment insurance benefits and SBA loans, and that a single payday can land the thieves $20,000 or more. In addition, he said, it seems clear that the fraudsters are recycling stolen identities to file phony unemployment insurance claims in multiple states.<span id="more-52594"></span></p>
<h4>ANALYSIS</h4>
<p>Hacked or ill-gotten accounts at consumer data brokers have fueled ID theft and identity theft services of various sorts for years. In 2013, KrebsOnSecurity <a href="http://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/" target="_blank" rel="noopener noreferrer">broke the news that the U.S. Secret Service had arrested a 24-year-old man named Hieu Minh Ngo for running an identity theft service out of his home in Vietnam</a>.</p>
<p>Ngo&#8217;s service, variously named superget[.]info and findget[.]me, gave customers access to personal and financial data on more than 200 million Americans. He gained that access by posing as a private investigator to a data broker subsidiary acquired by <strong>Experian</strong>, one of the three major credit bureaus in the United States.</p>
<div id="attachment_26029" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/a047afff.superget1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/05/superget1.png"><img aria-describedby="caption-attachment-26029" class="wp-image-26029" src="media/a047afff.superget1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/05/superget1.png" alt="" width="599" height="456" srcset="https://krebsonsecurity.com/wp-content/uploads/2014/05/superget1.png 847w, https://krebsonsecurity.com/wp-content/uploads/2014/05/superget1-285x217.png 285w, https://krebsonsecurity.com/wp-content/uploads/2014/05/superget1-600x456.png 600w" sizes="(max-width: 599px) 100vw, 599px" /></a><p id="caption-attachment-26029" class="wp-caption-text">Ngo&#8217;s ID theft service superget.info</p></div>
<p>Experian was hauled before Congress to account for the lapse, and assured lawmakers there was <a href="https://krebsonsecurity.com/2014/03/experian-lapse-allowed-id-theft-service-to-access-200-million-consumer-records/" target="_blank" rel="noopener noreferrer">no evidence that consumers had been harmed by Ngo&#8217;s access</a>. But as follow-up reporting showed, Ngo&#8217;s service was frequented by ID thieves who specialized in filing fraudulent tax refund requests with the Internal Revenue Service, and was relied upon heavily by <a href="https://krebsonsecurity.com/2014/05/experian-breach-tied-to-ny-nj-id-theft-ring/" target="_blank" rel="noopener noreferrer">an identity theft ring operating in the New York-New Jersey region</a>.</p>
<p>Also in 2013, KrebsOnSecurity broke the news that <strong>ssndob[.]ms</strong>, then a major identity theft service in the cybercrime underground, <a href="https://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/" target="_blank" rel="noopener noreferrer">had infiltrated computers at some of America&#8217;s large consumer and business data aggregators</a>, including <strong>LexisNexis Inc.</strong>, <strong>Dun &amp; Bradstreet</strong>, and <strong>Kroll Background America Inc</strong>.</p>
<div id="attachment_22656" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/07f95024.ssndobhome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/09/ssndobhome.png"><img aria-describedby="caption-attachment-22656" class="wp-image-22656" src="media/07f95024.ssndobhome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/09/ssndobhome.png" alt="" width="598" height="246" srcset="https://krebsonsecurity.com/wp-content/uploads/2013/09/ssndobhome.png 1179w, https://krebsonsecurity.com/wp-content/uploads/2013/09/ssndobhome-285x117.png 285w, https://krebsonsecurity.com/wp-content/uploads/2013/09/ssndobhome-600x246.png 600w" sizes="(max-width: 598px) 100vw, 598px" /></a><p id="caption-attachment-22656" class="wp-caption-text">The now defunct SSNDOB identity theft service.</p></div>
<p>In 2006, <em>The Washington Post</em> <a href="https://www.washingtonpost.com/archive/business/2006/07/01/five-arrested-in-theft-of-lexisnexis-data/e4ef8ed6-e809-430d-8114-5e46dccbc50a/" target="_blank" rel="noopener noreferrer">reported</a> that a group of five men used stolen or illegally created accounts at LexisNexis subsidiaries to lookup SSNs and other personal information more than 310,000 individuals. And in 2004, it emerged that identity thieves masquerading as customers of data broker <strong>Choicepoint</strong> had <a href="https://www.nytimes.com/2005/02/24/business/breach-points-up-flaws-in-privacy-laws.html" target="_blank" rel="noopener noreferrer">stolen the personal and financial records of more than 145,000 Americans</a>.</p>
<p>Those compromises were noteworthy because the consumer information warehoused by these data brokers can be used to find the answers to so-called knowledge-based authentication (KBA) questions used by companies seeking to validate the financial history of people applying for new lines of credit.</p>
<p>In that sense, thieves involved in ID theft may be better off targeting data brokers like IDI and their customers than the major credit bureaus, said <strong>Nicholas Weaver</strong>, a researcher at the <a href="https://www.icsi.berkeley.edu/icsi/" target="_blank" rel="noopener noreferrer">International Computer Science Institute</a> and lecturer at <strong>UC Berkeley</strong>.</p>
<p>&#8220;This means you have access not only to the consumer&#8217;s SSN and other static information, but everything you need for knowledge-based authentication because these are the types of companies that are providing KBA data.&#8221;</p>
<p>The fraud group communications reviewed by this author suggest they are cashing out primarily through financial instruments like prepaid cards and a small number of online-only banks that allow consumers to establish accounts and move money just by providing a name and associated date of birth and SSN.</p>
<p>While most of these instruments place daily or monthly limits on the amount of money users can deposit into and withdraw from the accounts, some of the more popular instruments for ID thieves appear to be those that allow spending, sending or withdrawal of between $5,000 to $7,000 per transaction, with high limits on the overall number or dollar value of transactions allowed in a given time period.</p>
<p>KrebsOnSecurity is investigating the extent to which a small number of these financial instruments may be massively over-represented in the incidence of unemployment insurance benefit fraud at the state level, and in SBA loan fraud at the federal level. Anyone in the financial sector or state agencies with information about these apparent trends may confidentially contact this author at <strong>krebsonsecurity @ gmail dot com</strong>, or via the encrypted message service <strong>Wickr</strong> at &#8220;<strong>krebswickr</strong>&#8220;.</p>
<p>The looting of state unemployment insurance programs by identity thieves has been well documented of late, but far less public attention has centered on fraud targeting <strong>Economic Injury Disaster Loan</strong> (EIDL) and advance grant programs run by the U.S. Small Business Administration in response to the COVID-19 crisis.</p>
<p>Late last month, the SBA Office of Inspector General (OIG) <a href="media/81bee6b7.SBA_OIG_Report_20-16_508.1.pdf" data-original-source="https://www.sba.gov/sites/default/files/2020-07/SBA_OIG_Report_20-16_508.1.pdf" target="_blank" rel="noopener noreferrer">released a scathing report</a> (PDF) saying it has been inundated with complaints from financial institutions reporting suspected fraudulent EIDL transactions, and that it has so far identified $250 million in loans given to &#8220;potentially ineligible recipients.&#8221; The OIG said many of the complaints were about credit inquiries for individuals who had never applied for an economic injury loan or grant.</p>
<p>The figures released by the SBA OIG suggest the financial impact of the fraud may be severely under-reported at the moment. For example, the OIG said nearly 3,800 of the 5,000 complaints it received came from just six financial institutions (out of several thousand across the United States). One credit union reportedly told the U.S. Justice Department that 59 out of 60 SBA deposits it received appeared to be fraudulent.</p>
<p><a class="lightbox" href="media/c39b8ea6.sbaoig.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/sbaoig.png"><img class="aligncenter wp-image-52610" src="media/c39b8ea6.sbaoig.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/sbaoig.png" alt="" width="596" height="480" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/08/sbaoig.png 963w, https://krebsonsecurity.com/wp-content/uploads/2020/08/sbaoig-580x467.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/08/sbaoig-940x756.png 940w, https://krebsonsecurity.com/wp-content/uploads/2020/08/sbaoig-768x618.png 768w" sizes="(max-width: 596px) 100vw, 596px" /></a></p>


feed_id: https://krebsonsecurity.com/?p=52627
title: Microsoft Patch Tuesday, August 2020 Edition
uri: Microsoft-Patch-Tuesday-August-2020-Edition
url: https://krebsonsecurity.com/2020/08/microsoft-patch-tuesday-august-2020-edition/
content:
<p><strong>Microsoft</strong> today released updates to plug at least 120 security holes in its <strong>Windows</strong> operating systems and supported software, including two newly discovered vulnerabilities that are actively being exploited. Yes, good people of the Windows world, it&#8217;s time once again to backup and patch up!</p>
<p><img class="aligncenter size-full wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="579" height="425" />At least 17 of the bugs squashed in August&#8217;s patch batch address vulnerabilities Microsoft rates as &#8220;critical,&#8221; meaning they can be exploited by miscreants or malware to gain complete, remote control over an affected system with little or no help from users. This is the sixth month in a row Microsoft has shipped fixes for more than 100 flaws in its products.</p>
<p>The most concerning of these appears to be <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1380" target="_blank" rel="noopener noreferrer">CVE-2020-1380</a>, which is a weaknesses in <strong>Internet Explorer</strong> that could result in system compromise just by browsing with IE to a hacked or malicious website. Microsoft&#8217;s advisory says this flaw is currently being exploited in active attacks.</p>
<p>The other flaw enjoying active exploitation is <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1464" target="_blank" rel="noopener noreferrer">CVE-2020-1464</a>, which is a &#8220;spoofing&#8221; bug in virtually supported version of Windows that allows an attacker to bypass Windows security features and load improperly signed files.</p>
<p><strong>Trend Micro&#8217;s Zero Day Initiative</strong> points to another fix &#8212; <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472" target="_blank" rel="noopener noreferrer">CVE-2020-1472</a> &#8212; which involves a critical issue in <strong>Windows Server</strong> versions that could let an unauthenticated attacker gain administrative access to a Windows domain controller and run an application of their choosing. A domain controller is a server that responds to security authentication requests in a Windows environment, and a compromised domain controller can give attackers the keys to the kingdom inside a corporate network.</p>
<p>&#8220;It’s rare to see a Critical-rated elevation of privilege bug, but this one deserves it,&#8221; said ZDI&#8217;S <strong>Dustin Childs</strong>. &#8220;What’s worse is that there is not a full fix available.&#8221;</p>
<p>Perhaps the most &#8220;<a href="https://en.wikipedia.org/wiki/Leet" target="_blank" rel="noopener noreferrer">elite</a>&#8221; vulnerability addressed this month earned the distinction of being named <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1337" target="_blank" rel="noopener noreferrer">CVE-2020-1337</a>, and refers to a security hole in the <strong>Windows Print Spooler</strong> service that could allow an attacker or malware to escalate their privileges on a system if they were already logged on as a regular (non-administrator) user.</p>
<p><strong>Satnam Narang</strong> at <strong>Tenable</strong> notes that CVE-2020-1337 is a patch bypass for <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1048" target="_blank" rel="noopener noreferrer">CVE-2020-1048</a>, another Windows Print Spooler vulnerability that was patched in May 2020. Narang said researchers found that the patch for CVE-2020-1048 was incomplete and presented their findings for CVE-2020-1337 at the <strong>Black Hat</strong> security conference earlier this month. More information on CVE-2020-1337, including a video demonstration of a proof-of-concept exploit, is available <a href="https://voidsec.com/cve-2020-1337-printdemon-is-dead-long-live-printdemon/" target="_blank" rel="noopener noreferrer">here</a>.<span id="more-52627"></span></p>
<p><strong>Adobe</strong> has graciously given us another month&#8217;s respite from patching <strong>Flash Player</strong> flaws, but it did release critical security updates for its <strong>Acrobat</strong> and <strong>PDF Reader</strong> products. More information on those updates is available <a href="https://helpx.adobe.com/security/products/acrobat/apsb20-48.html" target="_blank" rel="noopener noreferrer">here</a>.</p>
<p>Keep in mind that while staying up-to-date on Windows patches is a must, it’s important to make sure you’re updating only after you’ve backed up your important data and files. A reliable backup means you’re less likely to pull your hair out when the odd buggy patch causes problems booting the system.</p>
<p>So do yourself a favor and backup your files before installing any patches. Windows 10 even has <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">some built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>And as ever, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips.</p>


feed_id: https://krebsonsecurity.com/?p=52197
title: Why & Where You Should You Plant Your Flag
uri: Why-Where-You-Should-You-Plant-Your-Flag
url: https://krebsonsecurity.com/2020/08/why-where-you-should-you-plant-your-flag/
content:
<p>Several stories here have highlighted the importance of creating accounts online tied to your various identity, financial and communications services before identity thieves do it for you. This post examines some of the key places where everyone should plant their virtual flags.</p>
<p><img class="aligncenter size-full wp-image-44352" src="media/d725a83f.plantflag.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/plantflag.png" alt="" width="528" height="360" /></p>
<p>As <a href="https://krebsonsecurity.com/2018/06/plant-your-flag-mark-your-territory/" target="_blank" rel="noopener noreferrer">KrebsOnSecurity observed back in 2018</a>, many people &#8212; particularly older folks &#8212; proudly declare they avoid using the Web to manage various accounts tied to their personal and financial data — including everything from utilities and mobile phones to retirement benefits and online banking services. From that story:</p>
<blockquote><p>&#8220;The reasoning behind this strategy is as simple as it is alluring: What’s not put online can’t be hacked. But increasingly, adherents to this mantra are finding out the hard way that if you don’t plant your flag online, fraudsters and identity thieves may do it for you.&#8221;</p>
<p>&#8220;The crux of the problem is that while most types of customer accounts these days can be managed online, the process of tying one’s account number to a specific email address and/or mobile device typically involves supplying personal data that can easily be found or purchased online — such as Social Security numbers, birthdays and addresses.&#8221;</p></blockquote>
<p>In short, although you may not be required to create online accounts to manage your affairs at your ISP, the U.S. Postal Service, the credit bureaus or the Social Security Administration, it&#8217;s a good idea to do so for several reasons.</p>
<p>Most importantly, the majority of the entities I&#8217;ll discuss here allow just one registrant per person/customer. Thus, even if you have no intention of using that account, establishing one will be far easier than trying to dislodge an impostor who gets there first using your identity data and an email address they control.</p>
<p>Also, the cost of planting your flag is virtually nil apart from your investment of time. In contrast, failing to plant one&#8217;s flag can allow ne&#8217;er-do-wells to create a great deal of mischief for you, whether it be misdirecting your service or benefits elsewhere, or canceling them altogether.</p>
<p>Before we dive into the list, a couple of important caveats. Adding multi-factor authentication (MFA) at these various providers (where available) and/or establishing a customer-specific personal identification number (PIN) also can help secure online access. For those who can’t be convinced to use a password manager, even writing down all of the account details and passwords on a slip of paper can be helpful, provided the document is secured in a safe place.</p>
<p>Perhaps the most important place to enable MFA is with your email accounts. Armed with access to your inbox, <a href="https://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank" rel="noopener noreferrer">thieves can then reset the password for any other service or account that is tied to that email address</a>.</p>
<p>People who don’t take advantage of these added safeguards may find it far more difficult to regain access when their account gets hacked, because <a href="https://krebsonsecurity.com/2020/06/turn-on-mfa-before-crooks-do-it-for-you/" target="_blank" rel="noopener noreferrer">increasingly thieves will enable multi-factor options and tie the account to a device they control</a>.</p>
<p>Secondly, guard the security of your mobile phone account as best you can (doing so <a href="https://krebsonsecurity.com/2016/08/a-life-or-death-case-of-identity-theft/" target="_blank" rel="noopener noreferrer">might just save your life</a>). The passwords for countless online services can be reset merely by entering a one-time code sent via text message to the phone number on file for the customer&#8217;s account.</p>
<p>And thanks to the increasing prevalence of a crime known as <a href="https://krebsonsecurity.com/?s=sim+swapping&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">SIM swapping</a>, thieves may be able to upend your personal and financial life simply by tricking someone at your mobile service provider into diverting your calls and texts to a device they control.</p>
<p>Most mobile providers offer customers the option of placing a PIN or secret passphrase on their accounts to lessen the likelihood of such attacks succeeding, but these protections also usually fail when the attackers are social engineering some $12-an-hour employee at a mobile phone store.</p>
<p>Your best option is to reduce your overall reliance on your phone number for added authentication at any online service. Many sites now offer MFA options that are app-based and not tied to your mobile service, and this is your best option for MFA wherever possible.<span id="more-52197"></span></p>
<h4>YOUR CREDIT FILES</h4>
<p>First and foremost, all U.S. residents should ensure they have accounts set up online at the three major credit bureaus &#8212; <strong>Equifax</strong>, <strong>Experian</strong> and <strong>Trans Union</strong>.</p>
<p>It&#8217;s important to remember that the questions these bureaus will ask to verify your identity are not terribly difficult for thieves to answer or guess just by referencing public records and/or perhaps your postings on social media.</p>
<p>You will need accounts at these bureaus if you wish to freeze your credit file. KrebsOnSecurity has for many years urged all readers to do just that, because freezing your file is the best way to prevent identity thieves from opening new lines of credit in your name. Parents and guardians also can now freeze the files of their dependents for free.</p>
<p>For more on what a freeze entails and how to place or thaw one, <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener noreferrer">please see this post</a>. Beyond the big three bureaus, <strong>Innovis</strong> is a distant fourth bureau that some entities use to check consumer creditworthiness. Fortunately, <a href="https://www.innovis.com/personal/securityFreeze" target="_blank" rel="noopener noreferrer">filing a freeze with Innovis</a> likewise is free and relatively painless.</p>
<p>It’s also a good idea to notify a company called <strong>ChexSystems</strong> to keep an eye out for fraud committed in your name. Thousands of banks rely on ChexSystems to verify customers who are requesting new checking and savings accounts, and ChexSystems lets consumers place a security alert on their credit data to make it more difficult for ID thieves to fraudulently obtain checking and savings accounts. For more information on doing that with ChexSystems, see <a href="https://www.chexsystems.com/web/chexsystems/consumerdebit/page/securityfreeze/information/!ut/p/z1/04_Sj9CPykssy0xPLMnMz0vMAfIjo8ziDRxdHA1Ngg183AP83QwcXX39LIJDfYwMvM30w1EV-HuEGAEVuPq4Gxt5G7oHmuhHkaQfTYGBOWX6gQrA-nEARwN9L1QL0NzvaggKAaMiX2ffdP2ogsSSDN3MvLR8_QhPIFmUCw4loBOiCBmCXwEolPD6ExQMhDxSkBsaGlHlkxbsmekIAE6xunk!/dz/d5/L2dBISEvZ0FBIS9nQSEh/" target="_blank" rel="noopener noreferrer">this link</a>.</p>
<p>If you placed a freeze on your file at the major bureaus more than a few years ago but haven&#8217;t revisited the bureaus&#8217; sites lately, it might be wise to do that soon. Following its epic 2017 data breach, Equifax <a href="https://krebsonsecurity.com/2019/03/myequifax-com-bypasses-credit-freeze-pin/" target="_blank" rel="noopener noreferrer">reconfigured its systems to effectively invalidate the freeze PINs</a> it previously relied upon to unfreeze a file, effectively allowing anyone to bypass that PIN if they can glean a few personal details about you. Experian&#8217;s site <a href="https://krebsonsecurity.com/2017/09/experian-site-can-give-anyone-your-credit-freeze-pin/" target="_blank" rel="noopener noreferrer">also has undermined the security of the freeze PIN</a>.</p>
<p>I mentioned planting your flag at the credit bureaus first because if you plan to freeze your credit files, it may be wise to do so <em>after you have planted your flag at all the other places listed in this story</em>. That&#8217;s because these other places may try to check your identity records at one or more of the bureaus, and having a freeze in place may interfere with that account creation.</p>
<h4>YOUR FINANCIAL INSTITUTIONS</h4>
<p>I can&#8217;t tell you how many times people have proudly told me they don&#8217;t bank online, and prefer to manage all of their accounts the old fashioned way. I always respond that while this is totally okay, you still need to establish an online account for your financial providers because if you don&#8217;t someone may do it for you.</p>
<p>This goes doubly for any retirement and pension plans you may have. It’s a good idea for people with older relatives to help those individuals set up and manage online identities for their various accounts — even if those relatives never intend to access any of the accounts online.</p>
<p>This process is doubly important for parents and relatives who have just lost a spouse. When someone passes away, there’s often an obituary in the paper that offers a great deal of information about the deceased and any surviving family members, and identity thieves love to mine this information.</p>
<h4>YOUR GOVERNMENT</h4>
<p>Whether you&#8217;re approaching retirement, middle-aged or just starting out in your career, you should establish an account online at the <strong>U.S. Social Security Administration</strong>. Maybe you don&#8217;t believe Social Security money will actually still be there when you retire, but chances are you&#8217;re nevertheless paying into the system now. Either way, the plant-your-flag rules still apply.</p>
<p>Ditto for the <strong>Internal Revenue Service</strong>. A few years back, ID thieves who specialize in perpetrating tax refund fraud were <a href="https://krebsonsecurity.com/2016/06/irs-re-enables-get-transcript-feature/" target="_blank" rel="noopener noreferrer">massively registering people at the IRS&#8217;s website to download key data from their prior years&#8217; tax transcripts</a>. While the IRS has improved its taxpayer validation and security measures since then, it&#8217;s a good idea to mark your territory here as well.</p>
<p>The same goes for <a href="https://en.wikipedia.org/wiki/Department_of_motor_vehicles" target="_blank" rel="noopener noreferrer">your state&#8217;s Department of Motor Vehicles</a> (DMV), which maintains an alarming amount of information about you whether you have an online account there or not. Because the DMV also is the place that typically issues state drivers licenses, you really don&#8217;t want to mess around with the possibility that someone could register as you, change your physical address on file, and obtain a new license in your name.</p>
<p>Last but certainly not least, you should create an account for your household at the U.S. Postal Service&#8217;s Web site. Having someone divert your mail or delay delivery of it for however long they like is not a fun experience.</p>
<p>Also, the USPS has this nifty service called <a href="https://krebsonsecurity.com/2017/10/usps-informed-delivery-is-stalkers-dream/" target="_blank" rel="noopener noreferrer">Informed Delivery</a>, which lets residents view scanned images of all incoming mail prior to delivery. In 2018, the <strong>U.S. Secret Service</strong> warned that <a href="https://krebsonsecurity.com/2018/11/u-s-secret-service-warns-id-thieves-are-abusing-uspss-mail-scanning-service/" target="_blank" rel="noopener noreferrer">identity thieves have been abusing Informed Delivery</a> to let them know when residents are about to receive credit cards or notices of new lines of credit opened in their names.</p>
<h4>YOUR HOME</h4>
<p>Online accounts coupled with the strongest multi-factor authentication available also are important for any services that provide you with telephone, television and Internet access.</p>
<p>Strange as it may sound, plenty of people who receive all of these services in a bundle from one ISP do not have accounts online to manage their service. This is dangerous because if thieves can establish an account on your behalf, they can then divert calls intended for you to their own phones.</p>
<p><a href="https://krebsonsecurity.com/2018/06/plant-your-flag-mark-your-territory/" target="_blank" rel="noopener noreferrer">My original Plant Your Flag piece in 2018</a> told the story of an older Florida man who had pricey jewelry bought in his name after fraudsters created an online account at his ISP and diverted calls to his home phone number so they could intercept calls from his bank seeking to verify the transactions.</p>
<p>If you own a home, chances are you also have an account at one or more local utility providers, such as power and water companies. If you don&#8217;t already have an account at these places, create one and secure access to it with a strong password and any other access controls available.</p>
<p>These frequently monopolistic companies traditionally have poor to non-existent fraud controls, even though they effectively operate as mini credit bureaus. Bear in mind that possession of one or more of your utility bills is often sufficient documentation to establish proof of identity. As a result, such records are highly sought-after by identity thieves.</p>
<p>Another common way that ID thieves establish new lines of credit is by opening a mobile phone account in a target&#8217;s name. A little-known entity that many mobile providers turn to for validating new mobile accounts is the National Consumer Telecommunications and Utilities Exchange, or <a href="http://www.nctue.com/" target="_blank" rel="noopener noreferrer">nctue.com</a>. Happily, the NCTUE allows consumers to place a freeze on their file by calling their 800-number, 1-866-349-5355. For more information on the NCTUE, see <a href="https://www.nctue.com/consumers" target="_blank" rel="noopener noreferrer">this page</a>.</p>
<p>Have I missed any important items? Please sound off in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=52666
title: Medical Debt Collection Firm R1 RCM Hit in Ransomware Attack
uri: Medical-Debt-Collection-Firm-R1-RCM-Hit-in-Ransomware-Attack
url: https://krebsonsecurity.com/2020/08/medical-debt-collection-firm-r1-rcm-hit-in-ransomware-attack/
content:
<p><strong>R1 RCM Inc.</strong> [<a href="https://www.nasdaq.com/market-activity/stocks/rcm" target="_blank" rel="noopener noreferrer">NASDAQ:RCM</a>], one of the nation&#8217;s largest medical debt collection companies, has been hit in a ransomware attack.</p>
<p><img class="aligncenter wp-image-52669" src="media/263d9b4c.r1rcm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/r1rcm.png" alt="" width="597" height="199" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/08/r1rcm.png 1200w, https://krebsonsecurity.com/wp-content/uploads/2020/08/r1rcm-580x193.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/08/r1rcm-940x313.png 940w, https://krebsonsecurity.com/wp-content/uploads/2020/08/r1rcm-768x256.png 768w" sizes="(max-width: 597px) 100vw, 597px" /></p>
<p>Formerly known as <a href="https://www.nytimes.com/topic/company/accretive-health-inc" target="_blank" rel="noopener noreferrer">Accretive Health Inc.</a>, Chicago-based R1 RCM brought in revenues of $1.18 billion in 2019. The company has more than 19,000 employees and contracts with at least 750 healthcare organizations nationwide.</p>
<p>R1 RCM acknowledged taking down its systems in response to a ransomware attack, but otherwise declined to comment for this story.</p>
<p>The &#8220;RCM&#8221; portion of its name refers to &#8220;revenue cycle management,&#8221; an industry which tracks profits throughout the life cycle of each patient, including patient registration, insurance and benefit verification, medical treatment documentation, and bill preparation and collection from patients.</p>
<p>The company has access to a wealth of personal, financial and medical information on tens of millions of patients, including names, dates of birth, Social Security numbers, billing information and medical diagnostic data.</p>
<p>It&#8217;s unclear when the intruders first breached R1&#8217;s networks, but the ransomware was unleashed more than a week ago, right around the time the company was <a href="https://ir.r1rcm.com/press-releases/press-release-details/2020/R1-RCM-Reports-Second-Quarter-2020-Results/default.aspx" target="_blank" rel="noopener noreferrer">set to release its 2nd quarter financial results for 2020</a>.</p>
<p>R1 RCM declined to discuss the strain of ransomware it is battling or how it was compromised. Sources close to the investigation tell KrebsOnSecurity the malware is known as <strong>Defray.</strong><span id="more-52666"></span></p>
<p>Defray was first spotted in 2017, and its purveyors have a history of specifically targeting companies in the healthcare space. According to <a href="https://www.trendmicro.com/vinfo/pl/security/news/cyber-attacks/defray-ransomware-sets-sights-on-healthcare-and-other-industries#:~:text=Defray%20behavior%20and%20demands&amp;text=The%20proliferation%20of%20ransomware%20through%20email%20is%20well%2Ddocumented.&amp;text=The%20phishing%20emails%20the%20authors,were%20disguised%20as%20patient%20reports." target="_blank" rel="noopener noreferrer">Trend Micro</a>, Defray usually is spread via booby-trapped <strong>Microsoft Office</strong> documents sent via email.</p>
<p>&#8220;The phishing emails the authors use are well-crafted,&#8221; Trend Micro wrote. For example, in an attack targeting a hospital, the phishing email was made to look like it came from a hospital IT manager, with the malicious files disguised as patient reports.</p>
<p>Email security company <strong>Proofpoint</strong> <a href="https://www.proofpoint.com/us/threat-insight/post/defray-new-ransomware-targeting-education-and-healthcare-verticals" target="_blank" rel="noopener noreferrer">says</a> the Defray ransomware is somewhat unusual in that it is typically deployed in small, targeted attacks as opposed to large-scale &#8220;spray and pray&#8221; email malware campaigns.</p>
<p>&#8220;It appears that Defray may be for the personal use of specific threat actors, making its continued distribution in small, targeted attacks more likely,&#8221; Proofpoint observed.</p>
<p>A recent <a href="https://aboutblaw.com/Rfz" target="_blank" rel="noopener noreferrer">report</a> (PDF) from <strong>Corvus Insurance</strong> notes that ransomware attacks on companies in the healthcare industry have slowed in recent months, with some malware groups even dubiously pledging they would refrain from targeting these firms during the COVID-19 pandemic. But Corvus says that trend is <a href="https://www.darkreading.com/attacks-breaches/rate-of-ransomware-attacks-in-healthcare-slows-in-h1-2020/d/d-id/1338051" target="_blank" rel="noopener noreferrer">likely to reverse</a> in the second half of 2020 as the United States moves cautiously toward reopening.</p>
<p>Corvus found that while services that scan and filter incoming email for malicious threats can catch many ransomware lures, an estimated 75 percent of healthcare companies do not use this technology.</p>


feed_id: https://krebsonsecurity.com/?p=52687
title: Microsoft Put Off Fixing Zero Day for 2 Years
uri: Microsoft-Put-Off-Fixing-Zero-Day-for-2-Years
url: https://krebsonsecurity.com/2020/08/microsoft-put-off-fixing-zero-day-for-2-years/
content:
<p>A security flaw in the way <strong>Microsoft Windows</strong> guards users against malicious files was actively exploited in malware attacks for two years before last week, when Microsoft finally issued a software update to correct the problem.</p>
<p><img class="aligncenter wp-image-52701" src="media/1b8d5661.zeroday.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/zeroday.png" alt="" width="594" height="393" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/08/zeroday.png 636w, https://krebsonsecurity.com/wp-content/uploads/2020/08/zeroday-580x383.png 580w" sizes="(max-width: 594px) 100vw, 594px" /></p>
<p>One of the 120 security holes <a href="https://krebsonsecurity.com/2020/08/microsoft-patch-tuesday-august-2020-edition/" target="_blank" rel="noopener noreferrer">Microsoft fixed on Aug. 11&#8217;s Patch Tuesday</a> was <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1464" target="_blank" rel="noopener noreferrer">CVE-2020-1464</a>, a problem with the way every supported version of Windows validates digital signatures for computer programs.</p>
<p><a href="https://en.wikipedia.org/wiki/Code_signing" target="_blank" rel="noopener noreferrer">Code signing</a> is the method of using a certificate-based digital signature to sign executable files and scripts in order to verify the author&#8217;s identity and ensure that the code has not been changed or corrupted since it was signed by the author.</p>
<p>Microsoft said an attacker could use this &#8220;spoofing vulnerability&#8221; to bypass security features intended to prevent improperly signed files from being loaded. Microsoft&#8217;s advisory makes no mention of security researchers having told the company about the flaw, which Microsoft acknowledged was actively being exploited.</p>
<p>In fact, CVE-2020-1464 was first spotted in attacks used in the wild back in August 2018. And several researchers informed Microsoft about the weakness over the past 18 months.</p>
<p><strong>Bernardo Quintero</strong> is the manager at <a href="https://www.virustotal.com" target="_blank" rel="noopener noreferrer">VirusTotal</a>, a service owned by Google that scans any submitted files against dozens of antivirus services and displays the results. On Jan. 15, 2019, Quintero <a href="https://blog.virustotal.com/2019/01/distribution-of-malicious-jar-appended.html" target="_blank" rel="noopener noreferrer">published a blog post</a> outlining how Windows keeps the Authenticode signature valid after appending any content to the end of Windows Installer files (those ending in .MSI) signed by any software developer.</p>
<p>Quintero said this weakness would particularly acute if an attacker were to use it to hide a malicious <strong>Java</strong> file (.jar). And, he said, this exact attack vector was indeed detected in a malware sample sent to VirusTotal.</p>
<p>&#8220;In short, an attacker can append a malicious JAR to a MSI file signed by a trusted software developer (like Microsoft Corporation, Google Inc. or any other well-known developer), and the resulting file can be renamed with the .jar extension and will have a valid signature according Microsoft Windows,&#8221; Quintero wrote.</p>
<p>But according to Quintero, while Microsoft&#8217;s security team validated his findings, the company chose not to address the problem at the time.</p>
<p>&#8220;Microsoft has decided that it will not be fixing this issue in the current versions of Windows and agreed we are able to blog about this case and our findings publicly,&#8221; his blog post concluded.</p>
<p><strong>Tal Be&#8217;ery</strong>, founder of <a href="https://zengo.com/" target="_blank" rel="noopener noreferrer">Zengo</a>, and <strong>Peleg Hadar</strong>, senior security researcher at <a href="https://safebreach.com/safebreach-labs" target="_blank" rel="noopener noreferrer">SafeBreach Labs</a>, penned <a href="https://medium.com/@TalBeerySec/glueball-the-story-of-cve-2020-1464-50091a1f98bd" target="_blank" rel="noopener noreferrer">a blog post on Sunday</a> that pointed to a file uploaded to VirusTotal in August 2018 that abused the spoofing weakness, which has been dubbed <strong>GlueBall</strong>. The last time that August 2018 file was scanned at VirusTotal (Aug 14, 2020), it was <a href="https://www.virustotal.com/gui/file/dd71284ac6be9758a5046740168164ae76f743579e24929e0a840afd6f2d0d8e/detection" target="_blank" rel="noopener noreferrer">detected as a malicious Java trojan by 28 of 59 antivirus programs</a>.</p>
<p><span id="more-52687"></span></p>
<p>More recently, others would likewise call attention to malware that abused the security weakness, including <a href="https://www.securityinbits.com/malware-analysis/interesting-tactic-by-ratty-adwind-distribution-of-jar-appended-to-signed-msi/" target="_blank" rel="noopener noreferrer">this post in June 2020</a> from the <strong>Security-in-bits</strong> blog.</p>
<div id="attachment_52700" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/f4397dae.swiftjar.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/swiftjar.png"><img aria-describedby="caption-attachment-52700" class="wp-image-52700" src="media/f4397dae.swiftjar.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/swiftjar.png" alt="" width="597" height="379" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/08/swiftjar.png 1303w, https://krebsonsecurity.com/wp-content/uploads/2020/08/swiftjar-580x368.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/08/swiftjar-940x596.png 940w, https://krebsonsecurity.com/wp-content/uploads/2020/08/swiftjar-768x487.png 768w" sizes="(max-width: 597px) 100vw, 597px" /></a><p id="caption-attachment-52700" class="wp-caption-text">Image: Securityinbits.com</p></div>
<p>Be&#8217;ery said the way Microsoft has handled the vulnerability report seems rather strange.</p>
<p>&#8220;It was very clear to everyone involved, Microsoft included, that GlueBall is indeed a valid vulnerability exploited in the wild,&#8221; he wrote. &#8220;Therefore, it is not clear why it was only patched now and not two years ago.&#8221;</p>
<p>Asked to comment on why it waited two years to patch a flaw that was actively being exploited to compromise the security of Windows computers, Microsoft dodged the question, saying Windows users who have applied the latest security updates are protected from this attack.</p>
<p>&#8220;A security update was released in August,&#8221; Microsoft said in a written statement sent to KrebsOnSecurity. &#8220;Customers who apply the update, or have automatic updates enabled, will be protected. We continue to encourage customers to turn on automatic updates to help ensure they are protected.&#8221;</p>
<p><strong>Update, 12:45 a.m. ET:</strong> Corrected attribution on the June 2020 blog article about GlueBall exploits in the wild.</p>


feed_id: https://krebsonsecurity.com/?p=52718
title: Voice Phishers Targeting Corporate VPNs
uri: Voice-Phishers-Targeting-Corporate-VPNs
url: https://krebsonsecurity.com/2020/08/voice-phishers-targeting-corporate-vpns/
content:
<p>The COVID-19 epidemic has brought a wave of email phishing attacks that try to trick work-at-home employees into giving away credentials needed to remotely access their employers&#8217; networks. But one increasingly brazen group of crooks is taking your standard phishing attack to the next level, marketing a voice phishing service that uses a combination of one-on-one phone calls and custom phishing sites to steal VPN credentials from employees.</p>
<p><img class="aligncenter wp-image-45224" src="media/57d2a628.phonescam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/phonescam.png" alt="" width="598" height="377" /></p>
<p>According to interviews with several sources, this hybrid phishing gang has a remarkably high success rate, and operates primarily through paid requests or &#8220;bounties,&#8221; where customers seeking access to specific companies or accounts can hire them to target employees working remotely at home.</p>
<p>And over the past six months, the criminals responsible have created dozens if not hundreds of phishing pages targeting some of the world&#8217;s biggest corporations. For now at least, they appear to be focusing primarily on companies in the financial, telecommunications and social media industries.</p>
<p>&#8220;For a number of reasons, this kind of attack is really effective,&#8221; said <strong>Allison Nixon</strong>, chief research officer at New York-based cyber investigations firm <a href="https://www.unit221b.com/" target="_blank" rel="noopener noreferrer">Unit 221B</a>. &#8220;Because of the Coronavirus, we have all these major corporations that previously had entire warehouses full of people who are now working remotely. As a result the attack surface has just exploded.&#8221;</p>
<h4>TARGET: NEW HIRES</h4>
<p>A typical engagement begins with a series of phone calls to employees working remotely at a targeted organization. The phishers will explain that they&#8217;re calling from the employer&#8217;s IT department to help troubleshoot issues with the company&#8217;s virtual private networking (VPN) technology.</p>
<div id="attachment_52747" style="width: 530px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-52747" class="size-full wp-image-52747" src="media/2159ffac.bofaticket.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/bofaticket.png" alt="" width="520" height="529" /><p id="caption-attachment-52747" class="wp-caption-text">The employee phishing page bofaticket[.]com. Image: urlscan.io</p></div>
<p>The goal is to convince the target either to divulge their credentials over the phone or to input them manually at a website set up by the attackers that mimics the organization&#8217;s corporate email or VPN portal.</p>
<p><strong>Zack Allen</strong> is director of threat intelligence for <a href="https://www.zerofox.com/" target="_blank" rel="noopener noreferrer">ZeroFOX</a>, a Baltimore-based company that helps customers detect and respond to risks found on social media and other digital channels. Allen has been working with Nixon and several dozen other researchers from various security firms to monitor the activities of this prolific phishing gang in a bid to disrupt their operations.</p>
<p>Allen said the attackers tend to focus on phishing new hires at targeted companies, and will often pose as new employees themselves working in the company&#8217;s IT division. To make that claim more believable, the phishers will create LinkedIn profiles and seek to connect those profiles with other employees from that same organization to support the illusion that the phony profile actually belongs to someone inside the targeted firm.</p>
<p>&#8220;They&#8217;ll say &#8216;Hey, I&#8217;m new to the company, but you can check me out on LinkedIn&#8217; or Microsoft Teams or Slack, or whatever platform the company uses for internal communications,&#8221; Allen said. &#8220;There tends to be a lot of pretext in these conversations around the communications and work-from-home applications that companies are using. But eventually, they tell the employee they have to fix their VPN and can they please log into this website.&#8221;</p>
<h4>SPEAR VISHING</h4>
<p>The domains used for these pages often invoke the company&#8217;s name, followed or preceded by hyphenated terms such as &#8220;vpn,&#8221; &#8220;ticket,&#8221; &#8220;employee,&#8221; or &#8220;portal.&#8221; The phishing sites also may include working links to the organization&#8217;s other internal online resources to make the scheme seem more believable if a target starts hovering over links on the page.</p>
<p>Allen said a typical voice phishing or &#8220;vishing&#8221; attack by this group involves at least two perpetrators: One who is social engineering the target over the phone, and another co-conspirator who takes any credentials entered at the phishing page and quickly uses them to log in to the target company&#8217;s VPN platform in real-time.</p>
<p>Time is of the essence in these attacks because many companies that rely on VPNs for remote employee access also require employees to supply some type of multi-factor authentication in addition to a username and password &#8212; such as a one-time numeric code generated by a mobile app or text message. And in many cases, those codes are only good for a short duration &#8212; often measured in seconds or minutes.</p>
<p>But these vishers can easily sidestep that layer of protection, because their phishing pages simply request the one-time code as well. </p>
<div id="attachment_52743" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/600d9c5a.attgl.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/attgl.png"><img aria-describedby="caption-attachment-52743" class="wp-image-52743" src="media/600d9c5a.attgl.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/attgl.png" alt="" width="598" height="417" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/08/attgl.png 810w, https://krebsonsecurity.com/wp-content/uploads/2020/08/attgl-580x405.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/08/attgl-768x536.png 768w" sizes="(max-width: 598px) 100vw, 598px" /></a><p id="caption-attachment-52743" class="wp-caption-text">A phishing page (helpdesk-att[.]com) targeting AT&amp;T employees. Image: urlscan.io</p></div>
<p>Allen said it matters little to the attackers if the first few social engineering attempts fail. Most targeted employees are working from home or can be reached on a mobile device. If at first the attackers don&#8217;t succeed, they simply try again with a different employee.</p>
<p>And with each passing attempt, the phishers can glean important details from employees about the target&#8217;s operations, such as company-specific lingo used to describe its various online assets, or its corporate hierarchy.</p>
<p>Thus, each unsuccessful attempt actually teaches the fraudsters how to refine their social engineering approach with the next mark within the targeted organization, Nixon said.</p>
<p>&#8220;These guys are calling companies over and over, trying to learn how the corporation works from the inside,&#8221; she said.<span id="more-52718"></span></p>
<h4>NOW YOU SEE IT, NOW YOU DON&#8217;T</h4>
<p>All of the security researchers interviewed for this story said the phishing gang is pseudonymously registering their domains at just a handful of domain registrars that accept bitcoin, and that the crooks typically create just one domain per registrar account.</p>
<p>&#8220;They&#8217;ll do this because that way if one domain gets burned or taken down, they won&#8217;t lose the rest of their domains,&#8221; Allen said.</p>
<p>More importantly, the attackers are careful to do nothing with the phishing domain until they are ready to initiate a vishing call to a potential victim. And when the attack or call is complete, they disable the website tied to the domain.</p>
<p>This is key because many domain registrars will only respond to external requests to take down a phishing website if the site is live at the time of the abuse complaint. This requirement can stymie efforts by companies like ZeroFOX that focus on identifying newly-registered phishing domains <em>before</em> they can be used for fraud.</p>
<p>&#8220;They&#8217;ll only boot up the website and have it respond at the time of the attack,&#8221; Allen said. &#8220;And it&#8217;s super frustrating because if you file an abuse ticket with the registrar and say, &#8216;Please take this domain away because we&#8217;re 100 percent confident this site is going to be used for badness,&#8217; they won&#8217;t do that if they don&#8217;t see an active attack going on. They&#8217;ll respond that according to their policies, the domain has to be a live phishing site for them to take it down. And these bad actors know that, and they&#8217;re exploiting that policy very effectively.&#8221;</p>
<div id="attachment_52745" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/5302ccd9.github.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/github.png"><img aria-describedby="caption-attachment-52745" class="wp-image-52745" src="media/5302ccd9.github.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/github.png" alt="" width="594" height="450" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/08/github.png 1054w, https://krebsonsecurity.com/wp-content/uploads/2020/08/github-580x439.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/08/github-940x712.png 940w, https://krebsonsecurity.com/wp-content/uploads/2020/08/github-768x581.png 768w" sizes="(max-width: 594px) 100vw, 594px" /></a><p id="caption-attachment-52745" class="wp-caption-text">A phishing page (github-ticket[.]com) aimed at siphoning credentials for a target organization&#8217;s access to the software development platform Github. Image: urlscan.io</p></div>
<h4>SCHOOL OF HACKS</h4>
<p>Both Nixon and Allen said the object of these phishing attacks seems to be to gain access to as many internal company tools as possible, and to use those tools to seize control over digital assets that can quickly be turned into cash. Primarily, that includes any social media and email accounts, as well as associated financial instruments such as bank accounts and any cryptocurrencies.</p>
<p>Nixon said she and others in her research group believe the people behind these sophisticated vishing campaigns hail from a community of young men who have spent years learning how to <a href="https://krebsonsecurity.com/?s=sim+swapping&#038;x=0&#038;y=0" rel="noopener noreferrer" target="_blank">social engineer employees at mobile phone companies and social media firms into giving up access to internal company tools</a>.</p>
<p>Traditionally, the goal of these attacks has been gaining control over highly-prized social media accounts, which can sometimes fetch thousands of dollars when resold in the cybercrime underground. But this activity gradually has evolved toward more direct and aggressive monetization of such access.</p>
<p>On July 15, a number of high-profile <strong>Twitter</strong> accounts <a href="https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/" target="_blank" rel="noopener noreferrer">were used to tweet out a bitcoin scam that earned more than $100,000</a> in a few hours. According to Twitter, that attack succeeded because the perpetrators were able to social engineer several Twitter employees over the phone into giving away access to internal Twitter tools.</p>
<p>Nixon said it&#8217;s not clear whether any of the people involved in the Twitter compromise are associated with this vishing gang, but she noted that the group showed no signs of slacking off after <a href="https://krebsonsecurity.com/2020/07/three-charged-in-july-15-twitter-compromise/" target="_blank" rel="noopener noreferrer">federal authorities charged several people with taking part in the Twitter hack</a>.</p>
<p>&#8220;A lot of people just shut their brains off when they hear the latest big hack wasn&#8217;t done by hackers in North Korea or Russia but instead some teenagers in the United States,&#8221; Nixon said. &#8220;When people hear it&#8217;s just teenagers involved, they tend to discount it. But the kinds of people responsible for these voice phishing attacks have now been doing this for several years. And unfortunately, they&#8217;ve gotten pretty advanced, and their operational security is much better now.&#8221;</p>
<div id="attachment_52749" style="width: 604px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-52749" class=" wp-image-52749" src="media/be0d85df.vzw-employee.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/vzw-employee.png" alt="" width="594" height="392" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/08/vzw-employee.png 696w, https://krebsonsecurity.com/wp-content/uploads/2020/08/vzw-employee-580x383.png 580w" sizes="(max-width: 594px) 100vw, 594px" /><p id="caption-attachment-52749" class="wp-caption-text">A phishing page (vzw-employee[.]com) targeting employees of Verizon. Image: DomainTools</p></div>
<h4>PROPER ADULT MONEY-LAUNDERING</h4>
<p>While it may seem amateurish or myopic for attackers who gain access to a Fortune 100 company&#8217;s internal systems to focus mainly on stealing bitcoin and social media accounts, that access &#8212; once established &#8212; can be re-used and re-sold to others in a variety of ways.</p>
<p>&#8220;These guys do intrusion work for hire, and will accept money for any purpose,&#8221; Nixon said. &#8220;This stuff can very quickly branch out to other purposes for hacking.&#8221;</p>
<p>For example, Allen said he suspects that once inside of a target company&#8217;s VPN, the attackers may try to add a new mobile device or phone number to the phished employee&#8217;s account as a way to generate additional one-time codes for future access by the phishers themselves or anyone else willing to pay for that access.</p>
<p>Nixon and Allen said the activities of this vishing gang have drawn the attention of U.S. federal authorities, who are growing concerned over indications that those responsible are starting to expand their operations to include criminal organizations overseas.</p>
<p>&#8220;What we see now is this group is really good on the intrusion part, and really weak on the cashout part,&#8221; Nixon said. &#8220;But they are learning how to maximize the gains from their activities. That&#8217;s going to require interactions with foreign gangs and learning how to do proper adult money laundering, and we&#8217;re already seeing signs that they&#8217;re growing up very quickly now.&#8221;</p>
<h4>WHAT CAN COMPANIES DO?</h4>
<p>Many companies now make security awareness and training an integral part of their operations. Some firms even <a href="https://krebsonsecurity.com/2019/05/should-failing-phish-tests-be-a-fireable-offense/" rel="noopener noreferrer" target="_blank">periodically send test phishing messages to their employees to gauge their awareness levels</a>, and then require employees who miss the mark to undergo additional training.</p>
<p>Such precautions, while important and potentially helpful, may do little to combat these phone-based phishing attacks that tend to target new employees. Both Allen and Nixon &#8212; as well as others interviewed for this story who asked not to be named &#8212; said the weakest link in most corporate VPN security setups these days is the method relied upon for multi-factor authentication.</p>
<div id="attachment_28417" style="width: 268px" class="wp-caption alignright"><img aria-describedby="caption-attachment-28417" class=" wp-image-28417" src="media/699f5ad0.yubikey.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/10/yubikey.png" alt="" width="258" height="314" srcset="https://krebsonsecurity.com/wp-content/uploads/2014/10/yubikey.png 468w, https://krebsonsecurity.com/wp-content/uploads/2014/10/yubikey-285x346.png 285w" sizes="(max-width: 258px) 100vw, 258px" /><p id="caption-attachment-28417" class="wp-caption-text">A U2F device made by Yubikey, plugged into the USB port on a computer.</p></div>
<p>One multi-factor option &#8212; physical <strong>security keys</strong> &#8212; appears to be immune to these sophisticated scams. The most commonly used security keys are inexpensive USB-based devices. A security key implements a form of multi-factor authentication known as <a href="https://en.wikipedia.org/wiki/Universal_2nd_Factor" rel="noopener noreferrer" target="_blank">Universal 2nd Factor</a> (U2F), which allows the user to complete the login process simply by inserting the USB device and pressing a button on the device. The key works without the need for any special software drivers.</p>
<p>The allure of U2F devices for multi-factor authentication is that even if an employee who has enrolled a security key for authentication tries to log in at an impostor site, the company’s systems simply refuse to request the security key if the user isn’t on their employer&#8217;s legitimate website, and the login attempt fails. Thus, the second factor cannot be phished, either over the phone or Internet.</p>
<p>In July 2018, <strong>Google</strong> <a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/" target="_blank" rel="noopener noreferrer">disclosed</a> that it had not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical security keys in place of one-time codes.</p>
<p>Probably the most popular maker of security keys is <a href="https://www.yubico.com/" target="_blank" rel="noopener noreferrer">Yubico</a>, which sells a basic U2F <strong>Yubikey</strong> for $20. It offers regular USB versions as well as those made for devices that require USB-C connections, such as Apple’s newer <strong>Mac OS</strong> systems. Yubico also sells more expensive keys designed to work with mobile devices. [Full disclosure: Yubico was recently an advertiser on this site].</p>
<p>Nixon said many companies will likely balk at the price tag associated with equipping each employee with a physical security key. But she said as long as most employees continue to work remotely, this is probably a wise investment given the scale and aggressiveness of these voice phishing campaigns.</p>
<p>&#8220;The truth is some companies are in a lot of pain right now, and they&#8217;re having to put out fires while attackers are setting new fires,&#8221; she said. &#8220;Fixing this problem is not going to be simple, easy or cheap. And there are risks involved if you somehow screw up a bunch of employees accessing the VPN. But apparently these threat actors really hate Yubikey right now.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=52783
title: FBI, CISA Echo Warnings on ‘Vishing’ Threat
uri: FBI-CISA-Echo-Warnings-on-Vishing-Threat
url: https://krebsonsecurity.com/2020/08/fbi-cisa-echo-warnings-on-vishing-threat/
content:
<p>The <strong>Federal Bureau of Investigation</strong> (FBI) and the <strong>Cybersecurity and Infrastructure Security Agency</strong> (CISA) on Thursday issued a joint alert to warn about the growing threat from voice phishing or &#8220;<strong>vishing</strong>&#8221; attacks targeting companies. The advisory came less than 24 hours after KrebsOnSecurity <a href="https://krebsonsecurity.com/2020/08/voice-phishers-targeting-corporate-vpns/" target="_blank" rel="noopener noreferrer">published an in-depth</a> look at a crime group offering a service that people can hire to steal VPN credentials and other sensitive data from employees working remotely during the Coronavirus pandemic.</p>
<p><a class="lightbox" href="media/c807258c.jsa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/jsa.png"><img class="aligncenter wp-image-52786" src="media/c807258c.jsa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/jsa.png" alt="" width="592" height="378" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/08/jsa.png 752w, https://krebsonsecurity.com/wp-content/uploads/2020/08/jsa-580x370.png 580w" sizes="(max-width: 592px) 100vw, 592px" /></a></p>
<p>&#8220;The COVID-19 pandemic has resulted in a mass shift to working from home, resulting in increased use of corporate virtual private networks (VPNs) and elimination of in-person verification,&#8221; the alert reads. &#8220;In mid-July 2020, cybercriminals started a vishing campaign—gaining access to employee tools at multiple companies with indiscriminate targeting — with the end goal of monetizing the access.&#8221;</p>
<p><a href="https://krebsonsecurity.com/2020/08/voice-phishers-targeting-corporate-vpns/" target="_blank" rel="noopener noreferrer">As noted in Wednesday&#8217;s story</a>, the agencies said the phishing sites set up by the attackers tend to include hyphens, the target company&#8217;s name, and certain words &#8212; such as &#8220;support,&#8221; &#8220;ticket,&#8221; and &#8220;employee.&#8221; The perpetrators focus on social engineering new hires at the targeted company, and impersonate staff at the target company&#8217;s IT helpdesk.</p>
<p>The <a href="media/e9e49048.ake_advantage_of_increased_telework_through_vishing_campaign.pdf" data-original-source="https://coronavirus.health.ny.gov/system/files/documents/2020/08/tlp_amber_aa20-233a_cyber_criminals_take_advantage_of_increased_telework_through_vishing_campaign.pdf" target="_blank" rel="noopener noreferrer">joint FBI/CISA alert</a> (PDF) says the vishing gang also compiles dossiers on employees at the specific companies using mass scraping of public profiles on social media platforms, recruiter and marketing tools, publicly available background check services, and open-source research. From the alert:</p>
<blockquote><p>&#8220;Actors first began using unattributed Voice over Internet Protocol (VoIP) numbers to call targeted employees on their personal cellphones, and later began incorporating spoofed numbers of other offices and employees in the victim company. The actors used social engineering techniques and, in some cases, posed as members of the victim company’s IT help desk, using their knowledge of the employee&#8217;s personally identifiable information—including name, position, duration at company, and home address—to gain the trust of the targeted employee.&#8221;</p>
<p>&#8220;The actors then convinced the targeted employee that a new VPN link would be sent and required their login, including any 2FA [2-factor authentication] or OTP [one-time passwords]. The actor logged the information provided by the employee and used it in real-time to gain access to corporate tools using the employee’s account.&#8221;</p></blockquote>
<p>The alert notes that in some cases the the unsuspected employees approved the 2FA or OTP prompt, either accidentally or believing it was the result of the earlier access granted to the help desk impersonator. In other cases, the attackers were able to intercept the one-time codes by targeting the employee with <a href="https://krebsonsecurity.com/?s=sim+swapping&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">SIM swapping</a>, which involves social engineering people at mobile phone companies into to giving them control of the target&#8217;s phone number.<span id="more-52783"></span></p>
<p>The agencies said crooks use the vished VPN credentials to mine the victim company databases for their customers’ personal information to leverage in other attacks.</p>
<p>&#8220;The actors then used the employee access to conduct further research on victims, and/or to fraudulently obtain funds using varying methods dependent on the platform being accessed,&#8221; the alert reads. &#8220;The monetizing method varied depending on the company but was highly aggressive with a tight timeline between the initial breach and the disruptive cashout scheme.&#8221;</p>
<p>The advisory includes a number of suggestions that companies can implement to help mitigate the threat from these vishing attacks, including:</p>
<p>• Restrict VPN connections to managed devices only, using mechanisms like hardware checks or installed certificates, so user input alone is not enough to access the corporate VPN.</p>
<p>• Restrict VPN access hours, where applicable, to mitigate access outside of allowed times.</p>
<p>• Employ domain monitoring to track the creation of, or changes to, corporate, brand-name domains.</p>
<p>• Actively scan and monitor web applications for unauthorized access, modification, and anomalous activities.</p>
<p>• Employ the principle of least privilege and implement software restriction policies or other controls; monitor authorized user accesses and usage.</p>
<p>• Consider using a formalized authentication process for employee-to-employee communications made over the public telephone network where a second factor is used to<br />
authenticate the phone call before sensitive information can be discussed.</p>
<p>• Improve 2FA and OTP messaging to reduce confusion about employee authentication attempts.</p>
<p>• Verify web links do not have misspellings or contain the wrong domain.</p>
<p>• Bookmark the correct corporate VPN URL and do not visit alternative URLs on the sole basis of an inbound phone call.</p>
<p>• Be suspicious of unsolicited phone calls, visits, or email messages from unknown individuals claiming to be from a legitimate organization. Do not provide personal information or information about your organization, including its structure or networks, unless you are certain of a person&#8217;s authority to have the information. If possible, try to verify the caller’s identity directly with the company.</p>
<p>• If you receive a vishing call, document the phone number of the caller as well as the domain that the actor tried to send you to and relay this information to law enforcement.</p>
<p>• Limit the amount of personal information you post on social networking sites. The internet is a public resource; only post information you are comfortable with anyone seeing.</p>
<p>• Evaluate your settings: sites may change their options periodically, so review your security and privacy settings regularly to make sure that your choices are still appropriate.</p>


feed_id: https://krebsonsecurity.com/?p=52808
title: Confessions of an ID Theft Kingpin, Part I
uri: Confessions-of-an-ID-Theft-Kingpin-Part-I
url: https://krebsonsecurity.com/2020/08/confessions-of-an-id-theft-kingpin-part-i/
content:
<p>At the height of his cybercriminal career, the hacker known as &#8220;<strong>Hieupc</strong>&#8221; was earning $125,000 a month running a bustling identity theft service that siphoned consumer dossiers from some of the world&#8217;s top data brokers. That is, until his greed and ambition played straight into an elaborate snare set by the <strong>U.S. Secret Service</strong>. Now, after more than seven years in prison Hieupc is back in his home country and hoping to convince other would-be cybercrooks to use their computer skills for good.</p>
<div id="attachment_52847" style="width: 218px" class="wp-caption alignright"><img aria-describedby="caption-attachment-52847" class="wp-image-52847 size-full" src="media/3f23dd48.ngo-p.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/ngo-p.png" alt="" width="208" height="316" /><p id="caption-attachment-52847" class="wp-caption-text">Hieu Minh Ngo, in his teens.</p></div>
<p>For several years beginning around 2010, a lone teenager in Vietnam named <strong>Hieu Minh Ngo</strong> ran one of the Internet&#8217;s most profitable and popular services for selling &#8220;<strong>fullz</strong>,&#8221; stolen identity records that included a consumer&#8217;s name, date of birth, Social Security number and email and physical address.</p>
<p>Ngo got his treasure trove of consumer data by hacking and social engineering his way into a string of major data brokers. By the time the Secret Service caught up with him in 2013, he&#8217;d made over $3 million selling fullz data to identity thieves and organized crime rings operating throughout the United States.</p>
<p><strong>Matt O&#8217;Neill</strong> is the Secret Service agent who in February 2013 successfully executed a scheme to lure Ngo out of Vietnam and into Guam, where the young hacker was arrested and sent to the mainland U.S. to face prosecution. O&#8217;Neill now heads the agency&#8217;s <strong>Global Investigative Operations Center</strong>, which supports investigations into transnational organized criminal groups.</p>
<p>O&#8217;Neill said he opened the investigation into Ngo&#8217;s identity theft business after reading about it in a 2011 KrebsOnSecurity story, &#8220;<a href="https://krebsonsecurity.com/2011/11/how-much-is-your-identity-worth/" target="_blank" rel="noopener noreferrer">How Much is Your Identity Worth?</a>&#8221; According to O&#8217;Neill, what&#8217;s remarkable about Ngo is that to this day his name is virtually unknown among the pantheon of infamous convicted cybercriminals, the majority of whom were busted for trafficking in huge quantities of stolen credit cards.</p>
<p>Ngo&#8217;s businesses enabled an entire generation of cybercriminals to commit an estimated $1 billion worth of <em>new account fraud</em>, and to sully the credit histories of countless Americans in the process.</p>
<p><span class="pullquote pqleft">&#8220;I don&#8217;t know of any other cybercriminal who has caused more material financial harm to more Americans than Ngo,&#8221;</span> O&#8217;Neill told KrebsOnSecurity. &#8220;He was selling the personal information on more than 200 million Americans and allowing anyone to buy it for pennies apiece.&#8221;</p>
<p>Freshly released from the U.S. prison system and deported back to Vietnam, Ngo is currently finishing up a mandatory three-week COVID-19 quarantine at a government-run facility. He contacted KrebsOnSecurity from inside this facility with the stated aim of telling his little-known story, and to warn others away from following in his footsteps.</p>
<h4>BEGINNINGS</h4>
<p>Ten years ago, then 19-year-old hacker Ngo was a regular on the Vietnamese-language computer hacking forums. Ngo says he came from a middle-class family that owned an electronics store, and that his parents bought him a computer when he was around 12 years old. From then on out, he was hooked.</p>
<p>In his late teens, he traveled to New Zealand to study English at a university there. By that time, he was already an administrator of several dark web hacker forums, and between his studies he discovered a vulnerability in the school&#8217;s network that exposed payment card data.</p>
<p>&#8220;I did contact the IT technician there to fix it, but nobody cared so I hacked the whole system,&#8221; Ngo recalled. &#8220;Then I used the same vulnerability to hack other websites. I was stealing lots of credit cards.&#8221;</p>
<p>Ngo said he decided to use the card data to buy concert and event tickets from <strong>Ticketmaster</strong>, and then sell the tickets at a New Zealand auction site called <a href="https://www.trademe.co.nz/" target="_blank" rel="noopener noreferrer">TradeMe</a>. The university later learned of the intrusion and Ngo&#8217;s role in it, and the Auckland police got involved. Ngo&#8217;s travel visa was not renewed after his first semester ended, and in retribution <a href="http://staceyknott.blogspot.com/2009/08/ex-unitec-student-hacks-unitec-website.html" target="_blank" rel="noopener noreferrer">he attacked the university&#8217;s site</a>, shutting it down for at least two days.</p>
<p>Ngo said he started taking classes again back in Vietnam, but soon found he was spending most of his time on cybercrime forums.</p>
<p><span class="pullquote pqright">&#8220;I went from hacking for fun to hacking for profits when I saw how easy it was to make money stealing customer databases,&#8221;</span> Ngo said. &#8220;I was hanging out with some of my friends from the underground forums and we talked about planning a new criminal activity.&#8221;</p>
<p>&#8220;My friends said doing credit cards and bank information is very dangerous, so I started thinking about selling identities,&#8221; Ngo continued. &#8220;At first I thought well, it&#8217;s just information, maybe it&#8217;s not that bad because it&#8217;s not related to bank accounts directly. But I was wrong, and the money I started making very fast just blinded me to a lot of things.&#8221;</p>
<h4>MICROBILT</h4>
<p>His first big target was a consumer credit reporting company in New Jersey called <a href="https://en.wikipedia.org/wiki/MicroBilt_Corporation" target="_blank" rel="noopener noreferrer">MicroBilt</a>.</p>
<p>&#8220;I was hacking into their platform and stealing their customer database so I could use their customer logins to access their [consumer] databases,&#8221; Ngo said. &#8220;I was in their systems for almost a year without them knowing.&#8221;</p>
<p>Very soon after gaining access to MicroBilt, Ngo says, he stood up <strong>Superget[.]info</strong>, a website that advertised the sale of individual consumer records. Ngo said initially his service was quite manual, requiring customers to request specific states or consumers they wanted information on, and he would conduct the lookups by hand.</p>
<p><div id="attachment_12183" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/199086ca.supergethome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2011/11/supergethome.png"><img aria-describedby="caption-attachment-12183" class="wp-image-12183" src="media/199086ca.supergethome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2011/11/supergethome.png" alt="" width="594" height="347" srcset="https://krebsonsecurity.com/wp-content/uploads/2011/11/supergethome.png 1001w, https://krebsonsecurity.com/wp-content/uploads/2011/11/supergethome-300x175.png 300w" sizes="(max-width: 594px) 100vw, 594px" /></a><p id="caption-attachment-12183" class="wp-caption-text">Ngo&#8217;s former identity theft service, superget[.]info</p></div>&#8221;</p>
<p>I was trying to get more records at once, but the speed of our Internet in Vietnam then was very slow,&#8221; Ngo recalled. &#8220;I couldn&#8217;t download it because the database was so huge. So I just manually search for whoever need identities.&#8221;</p>
<p>But Ngo would soon work out how to use more powerful servers in the United States to automate the collection of larger amounts of consumer data from MicroBilt&#8217;s systems, and from other data brokers. As I wrote of Ngo&#8217;s service back in November 2011:</p>
<blockquote><p>&#8220;Superget lets users search for specific individuals by name, city, and state. Each “credit” costs USD$1, and a successful hit on a Social Security number or date of birth costs 3 credits each. The more credits you buy, the cheaper the searches are per credit: Six credits cost $4.99; 35 credits cost $20.99, and $100.99 buys you 230 credits. Customers with special needs can avail themselves of the “reseller plan,” which promises 1,500 credits for $500.99, and 3,500 credits for $1000.99.</p>
<p>&#8220;Our Databases are updated EVERY DAY,&#8221; the site’s owner enthuses. &#8220;About 99% nearly 100% US people could be found, more than any sites on the internet now.&#8221;</p></blockquote>
<p>Ngo&#8217;s intrusion into MicroBilt eventually was detected, and the company kicked him out of their systems. But he says he got back in using another vulnerability.</p>
<p>&#8220;I was hacking them and it was back and forth for months,&#8221; Ngo said. &#8220;They would discover [my accounts] and fix it, and I would discover a new vulnerability and hack them again.&#8221;</p>
<h4>COURT (AD)VENTURES, AND EXPERIAN</h4>
<p>This game of cat and mouse continued until Ngo found a much more reliable and stable source of consumer data: A U.S. based company called <strong>Court Ventures</strong>, which aggregated public records from court documents. Ngo wasn&#8217;t interested in the data collected by Court Ventures, but rather in its data sharing agreement with a third-party data broker called <strong>U.S. Info Search</strong>, which had access to far more sensitive consumer records.</p>
<p>Using forged documents and more than a few lies, Ngo was able to convince Court Ventures that he was a private investigator based in the United States.</p>
<p>&#8220;At first [when] I sign up they asked for some documents to verify,&#8221; Ngo said. &#8220;So I just used some skill about social engineering and went through the security check.&#8221;</p>
<p>Then, in March 2012, something even more remarkable happened: Court Ventures was purchased by <strong>Experian</strong>, one of the big three major consumer credit bureaus in the United States. And for nine months after the acquisition, Ngo was able to maintain his access.</p>
<p><img class="aligncenter wp-image-52840" src="media/41cb51a2.experian-cv.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/experian-cv.png" alt="" width="596" height="127" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/08/experian-cv.png 1356w, https://krebsonsecurity.com/wp-content/uploads/2020/08/experian-cv-580x124.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/08/experian-cv-940x200.png 940w, https://krebsonsecurity.com/wp-content/uploads/2020/08/experian-cv-768x164.png 768w" sizes="(max-width: 596px) 100vw, 596px" /></p>
<p>&#8220;After that, the database was under control by Experian,&#8221; he said. &#8220;I was paying Experian good money, thousands of dollars a month.&#8221;</p>
<p>Whether anyone at Experian ever performed due diligence on the accounts grandfathered in from Court Ventures is unclear. But it wouldn&#8217;t have taken a rocket surgeon to figure out that this particular customer was up to something fishy.</p>
<p>For one thing, Ngo paid the monthly invoices for his customers&#8217; data requests using wire transfers from a multitude of banks around the world, but mostly from new accounts at financial institutions in China, Malaysia and Singapore.</p>
<p>O&#8217;Neill said Ngo&#8217;s identity theft website generated tens of thousands of queries each month. For example, the first invoice Court Ventures sent Ngo in December 2010 was for 60,000 queries. By the time Experian acquired the company, Ngo&#8217;s service had attracted more than 1,400 regular customers, and was averaging 160,000 monthly queries.</p>
<p>More importantly, Ngo&#8217;s profit margins were enormous.</p>
<p>&#8220;His service was quite the racket,&#8221; he said. &#8220;Court Ventures charged him 14 cents per lookup, but he charged his customers about $1 for each query.&#8221;</p>
<p>By this time, O&#8217;Neill and his fellow Secret Service agents had served dozens of subpoenas tied to Ngo&#8217;s identity theft service, including one that granted them access to the email account he used to communicate with customers and administer his site. The agents discovered several emails from Ngo instructing an accomplice to pay Experian using wire transfers from different Asian banks.<span id="more-52808"></span></p>
<h4>TLO</h4>
<p>Working with the Secret Service, Experian quickly zeroed in on Ngo&#8217;s accounts and shut them down. Aware of an opportunity here, the Secret Service contacted Ngo through an intermediary in the United Kingdom &#8212; a known, convicted cybercriminal who agreed to play along. The U.K.-based collaborator told Ngo he had personally shut down Ngo&#8217;s access to Experian because he had been there first and Ngo was interfering with his business.</p>
<p>&#8220;The U.K. guy told Ngo, &#8216;Hey, you&#8217;re treading on my turf, and I decided to lock you out. But as long as you&#8217;re paying a vig through me, your access won&#8217;t go away&#8217;,&#8221; O&#8217;Neill recalled.</p>
<p>The U.K. cybercriminal, acting at the behest of the Secret Service and U.K. authorities, told Ngo that if he wanted to maintain his access, he could agree to meet up in person. But Ngo didn&#8217;t immediately bite on the offer.</p>
<p>Instead, he weaseled his way into another huge data store. In much the same way he&#8217;d gained access to Court Ventures, Ngo got an account at a company called <a href="https://www.tlo.com/" target="_blank" rel="noopener noreferrer">TLO</a>, another data broker that sells access to extremely detailed and sensitive information on most Americans.</p>
<p>TLO&#8217;s service is accessible to law enforcement agencies and to a limited number of vetted professionals who can demonstrate they have a lawful reason to access such information. In 2014, TLO was acquired by <strong>Trans Union</strong>, one of the other three big U.S. consumer credit reporting bureaus.</p>
<p>And for a short time, Ngo used his access to TLO to power a new iteration of his business &#8212; an identity theft service rebranded as <strong>usearching[.]info</strong>. This site also pulled consumer data from a payday loan company that Ngo hacked into, as documented in my Sept. 2012 story, <a href="https://krebsonsecurity.com/2012/09/id-theft-service-tied-to-payday-loan-sites/" target="_blank" rel="noopener noreferrer">ID Theft Service Tied to Payday Loan Sites</a>. Ngo said the hacked payday loans site gave him instant access to roughly 1,000 new fullz records each day.</p>
<div id="attachment_52832" style="width: 608px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-52832" class=" wp-image-52832" src="media/9883f735.ussearch.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/ussearch.png" alt="" width="598" height="448" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/08/ussearch.png 889w, https://krebsonsecurity.com/wp-content/uploads/2020/08/ussearch-580x435.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/08/ussearch-768x575.png 768w" sizes="(max-width: 598px) 100vw, 598px" /><p id="caption-attachment-52832" class="wp-caption-text">Ngo&#8217;s former ID theft service usearching[.]info.</p></div>
<h4>BLINDED BY GREED</h4>
<p>By this time, Ngo was a multi-millionaire: His various sites and reselling agreements with three Russian-language cybercriminal stores online had earned him more than USD $3 million. He told his parents his money came from helping companies develop websites, and even used some of his ill-gotten gains to pay off the family&#8217;s debts (its electronics business had gone belly up, and a family member had borrowed but never paid back a significant sum of money).</p>
<p>But mostly, Ngo said, he spent his money on frivolous things, although he says he&#8217;s never touched drugs or alcohol.</p>
<p>&#8220;I spent it on vacations and cars and a lot of other stupid stuff,&#8221; he said.</p>
<p>When TLO locked Ngo out of his account there, the Secret Service used it as another opportunity for their cybercriminal mouthpiece in the U.K. to turn the screws on Ngo yet again.</p>
<p>&#8220;He told Ngo he&#8217;d locked him out again, and the he could do this all day long,&#8221; O&#8217;Neill said. &#8220;And if he truly wanted lasting access to all of these places he used to have access to, he would agree to meet and form a more secure partnership.&#8221;</p>
<p>After several months of conversing with his apparent U.K.-based tormentor, Ngo agreed to meet him in Guam to finalize the deal. Ngo says he understood at the time that Guam is an unincorporated territory of the United States, but that he discounted the chances that this was all some kind of elaborate law enforcement sting operation.</p>
<p>&#8220;I was so desperate to have a stable database, and I got blinded by greed and started acting crazy without thinking,&#8221; Ngo said. &#8220;Lots of people told me &#8216;Don&#8217;t go!,&#8217; but I told them I have to try and see what&#8217;s going on.&#8221;</p>
<p>But immediately after stepping off of the plane in Guam, he was apprehended by Secret Service agents.</p>
<p>&#8220;One of the names of his identity theft services was <strong>findget[.]me</strong>,&#8221; O&#8217;Neill said. &#8220;We took that seriously, and we did like he asked.&#8221;</p>
<p><em>This is Part I of a multi-part series. Check back tomorrow (Aug. 27) for Part II, which will examine what investigators learned following Ngo&#8217;s arrest, and delve into his more recent effort to right the wrongs he&#8217;s done.</em></p>


feed_id: https://krebsonsecurity.com/?p=52861
title: Confessions of an ID Theft Kingpin, Part II
uri: Confessions-of-an-ID-Theft-Kingpin-Part-II
url: https://krebsonsecurity.com/2020/08/confessions-of-an-id-theft-kingpin-part-ii/
content:
<p>Yesterday&#8217;s piece told the tale of <strong>Hieu Minh Ngo</strong>, a hacker the <strong>U.S. Secret Service</strong> described as someone who caused more material financial harm to more Americans than any other convicted cybercriminal. Ngo was recently deported back to his home country after serving more than seven years in prison for running multiple identity theft services. He now says he wants to use his experience to convince other cybercriminals to use their skills for good. Here&#8217;s a look at what happened after he got busted.</p>
<div id="attachment_52874" style="width: 460px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-52874" class="size-full wp-image-52874" src="media/76d43d35.hieuminhngo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/hieuminhngo.png" alt="" width="450" height="421" /><p id="caption-attachment-52874" class="wp-caption-text">Hieu Minh Ngo, 29, in a recent photo.</p></div>
<p><a href="https://krebsonsecurity.com/2020/08/confessions-of-an-id-theft-kingpin-part-i/" target="_blank" rel="noopener noreferrer">Part I of this series</a> ended with Ngo in handcuffs after disembarking a flight from his native Vietnam to Guam, where he believed he was going to meet another cybercriminal who&#8217;d promised to hook him up with the mother of all consumer data caches.</p>
<p>Ngo had been making more than $125,000 a month reselling ill-gotten access to some of the biggest data brokers on the planet. But the Secret Service discovered his various accounts at these data brokers and had them shut down one by one. Ngo became obsessed with restarting his business and maintaining his previous income. By this time, his ID theft services had earned roughly USD $3 million.</p>
<p>As this was going on, Secret Service agents used an intermediary to trick Ngo into thinking he&#8217;d trodden on the turf of another cybercriminal. From Part I:</p>
<blockquote><p>The Secret Service contacted Ngo through an intermediary in the United Kingdom — a known, convicted cybercriminal who agreed to play along. The U.K.-based collaborator told Ngo he had personally shut down Ngo’s access to Experian because he had been there first and Ngo was interfering with his business.</p>
<p>“The U.K. guy told Ngo, ‘Hey, you’re treading on my turf, and I decided to lock you out. But as long as you’re paying a vig through me, your access won’t go away’,” the Secret Service&#8217;s <strong>Matt O’Neill</strong> recalled.</p>
<p>After several months of conversing with his apparent U.K.-based tormentor, Ngo agreed to meet him in Guam to finalize the deal. But immediately after stepping off of the plane in Guam, he was apprehended by Secret Service agents.</p>
<p>“One of the names of his identity theft services was findget[.]me,” O’Neill said. “We took that seriously, and we did like he asked.”</p></blockquote>
<p>In an interview with KrebsOnSecurity, Ngo said he spent about two months in a Guam jail awaiting transfer to the United States. A month passed before he was allowed a 10 minute phone call to his family and explain what he&#8217;d gotten himself into.</p>
<p>&#8220;This was a very tough time,&#8221; Ngo said. &#8220;They were so sad and they were crying a lot.&#8221;</p>
<p>First stop on his prosecution tour was New Jersey, where he ultimately pleaded guilty to hacking into <strong>MicroBilt</strong>, the first of several data brokers whose consumer databases would power different iterations of his identity theft service over the years.</p>
<p>Next came New Hampshire, where another guilty plea forced him to testify in three different trials against identity thieves who had used his services for years. Among them was <a href="https://krebsonsecurity.com/?s=lance+ealy&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">Lance Ealy</a>, a serial ID thief from Dayton, Ohio who used Ngo&#8217;s service to purchase more than 350 &#8220;<strong>fullz</strong>&#8221; &#8212; a term used to describe a package of everything one would need to steal someone&#8217;s identity, including their Social Security number, mother&#8217;s maiden name, birth date, address, phone number, email address, bank account information and passwords.</p>
<p>Ealy used Ngo&#8217;s service primarily to conduct <a href="https://krebsonsecurity.com/?s=tax+refund+fraud&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">tax refund fraud</a> with the <strong>U.S. Internal Revenue Service</strong> (IRS), claiming huge refunds in the names of ID theft victims who first learned of the fraud when they went to file their taxes and found someone else had beat them to it.</p>
<p>Ngo&#8217;s cooperation with the government ultimately led to 20 arrests, with a dozen of those defendants lured into the open by O&#8217;Neill and other Secret Service agents posing as Ngo.</p>
<p>The Secret Service had difficulty pinning down the exact amount of financial damage inflicted by Ngo&#8217;s various ID theft services over the years, primarily because those services only kept records of what customers searched for &#8212; not which records they purchased.</p>
<p>But based on the records they did have, the government estimated that Ngo&#8217;s service enabled approximately $1.1 billion in new account fraud at banks and retailers throughout the United States, and roughly $64 million in tax refund fraud with the states and the IRS.</p>
<p>&#8220;We interviewed a number of Ngo&#8217;s customers, who were pretty open about why they were using his services,&#8221; O&#8217;Neill said. <span class="pullquote pqright">&#8220;Many of them told us the same thing: Buying identities was so much better for them than stolen payment card data, because card data could be used once or twice before it was no good to them anymore. But identities could be used over and over again for years.&#8221;</span></p>
<p>O&#8217;Neill said he still marvels at the fact that Ngo&#8217;s name is practically unknown when compared to the world&#8217;s most infamous credit card thieves, some of whom were responsible for stealing hundreds of millions of cards from big box retail merchants.</p>
<p>&#8220;I don&#8217;t know of anyone who has come close to causing more material harm than Ngo did to the average American,&#8221; O&#8217;Neill said. &#8220;But most people have probably never heard of him.&#8221;</p>
<p>Ngo said he wasn&#8217;t surprised that his services were responsible for so much financial damage. But he was utterly unprepared to hear about the human toll. Throughout the court proceedings, Ngo sat through story after dreadful story of how his work had ruined the financial lives of people harmed by his services.</p>
<p>&#8220;When I was running the service, I didn&#8217;t really care because I didn&#8217;t know my customers and I didn&#8217;t know much about what they were doing with it,&#8221; Ngo said. &#8220;But during my case, the federal court received like 13,000 letters from victims who complained they lost their houses, jobs, or could no longer afford to buy a home or maintain their financial life because of me. That made me feel really bad, and I realized I&#8217;d been a terrible person.&#8221;</p>
<p>Even as he bounced from one federal detention facility to the next, Ngo always seemed to encounter ID theft victims wherever he went, including prison guards, healthcare workers and counselors.</p>
<p>&#8220;When I was in jail at Beaumont, Texas I talked to one of the correctional officers there who shared with me a story about her friend who lost her identity and then lost everything after that,&#8221; Ngo recalled. &#8220;Her whole life fell apart. I don&#8217;t know if that lady was one of my victims, but that story made me feel sick. I know now that was I was doing was just evil.&#8221;</p>
<p><div id="attachment_52832" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/9883f735.ussearch.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/ussearch.png"><img aria-describedby="caption-attachment-52832" class="wp-image-52832" src="media/9883f735.ussearch.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/ussearch.png" alt="" width="595" height="446" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/08/ussearch.png 889w, https://krebsonsecurity.com/wp-content/uploads/2020/08/ussearch-580x435.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/08/ussearch-768x575.png 768w" sizes="(max-width: 595px) 100vw, 595px" /></a><p id="caption-attachment-52832" class="wp-caption-text">Ngo&#8217;s former ID theft service usearching[.]info.</p></div><br />
<span id="more-52861"></span></p>
<p>The Vietnamese hacker was released from prison a few months ago, and is now finishing up a mandatory three-week COVID-19 quarantine in a government-run facility near Ho Chi Minh city. In the final months of his detention, Ngo started reading everything he could get his hands on about computer and Internet security, and even authored a <a href="https://www.linkedin.com/feed/update/urn:li:activity:6704062401446334464/" target="_blank" rel="noopener noreferrer">lengthy guide</a> written for the average Internet user with advice about how to avoid getting hacked or becoming the victim of identity theft.</p>
<p>Ngo said while he would like to one day get a job working in some cybersecurity role, he&#8217;s in no hurry to do so. He&#8217;s already had at least one job offer in Vietnam, but he turned it down. He says he&#8217;s not ready to work yet, but is looking forward to spending time with his family &#8212; and specifically with his dad, who was recently diagnosed with Stage 4 cancer.</p>
<p>Longer term, Ngo says, he wants to mentor young people and help guide them on the right path, and away from cybercrime. He&#8217;s been brutally honest about his crimes and the destruction he&#8217;s caused. <a href="https://www.linkedin.com/in/hieu-minh-ngo-hieupc/" target="_blank" rel="noopener noreferrer">His LinkedIn profile</a> states up front that he&#8217;s a convicted cybercriminal.</p>
<p>&#8220;I hope my work can help to change the minds of somebody, and if at least one person can change and turn to do good, I&#8217;m happy,&#8221; Ngo said. &#8220;It&#8217;s time for me to do something right, to give back to the world, because I know I can do something like this.&#8221;</p>
<p>Still, the recidivism rate among cybercriminals tends to be extremely high, and it would be easy for him to slip back into his old ways. After all, few people know as well as he does how best to exploit access to identity data.</p>
<p>O&#8217;Neill said he believes Ngo probably will keep his nose clean. But he added that Ngo&#8217;s service if it existed today probably would be even more successful and lucrative given the <a href="https://krebsonsecurity.com/?s=unemployment+insurance&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">sheer number of scammers involved in using stolen identity data to defraud states and the federal government out of pandemic assistance loans and unemployment insurance benefits</a>.</p>
<p>&#8220;It doesn&#8217;t appear he&#8217;s looking to get back into that life of crime,&#8221; O&#8217;Neill said. &#8220;But I firmly believe the people doing fraudulent small business loans and unemployment claims cut their teeth on his website. He was definitely the new coin of the realm.&#8221;</p>
<p>Ngo maintains he has zero interest in doing anything that might send him back to prison.</p>
<p>&#8220;Prison is a difficult place, but it gave me time to think about my life and my choices,&#8221; he said. &#8220;I am committing myself to do good and be better every day. I now know that money is just a part of life. It’s not everything and it can’t bring you true happiness. I hope those cybercriminals out there can learn from my experience. I hope they stop what they are doing and instead use their skills to help make the world better.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=52812
title: Sendgrid Under Siege from Hacked Accounts
uri: Sendgrid-Under-Siege-from-Hacked-Accounts
url: https://krebsonsecurity.com/2020/08/sendgrid-under-siege-from-hacked-accounts/
content:
<p>Email service provider <strong>Sendgrid</strong> is grappling with an unusually large number of customer accounts whose passwords have been cracked, sold to spammers, and abused for sending phishing and email malware attacks. Sendgrid&#8217;s parent company <strong>Twilio</strong> says it is working on a plan to require multi-factor authentication for all of its customers, but that solution may not come fast enough for organizations having trouble dealing with the fallout in the meantime.</p>
<div id="attachment_52894" style="width: 607px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-52894" class=" wp-image-52894" src="media/8e6ac457.sendgrid.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/sendgrid.png" alt="" width="597" height="391" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/08/sendgrid.png 792w, https://krebsonsecurity.com/wp-content/uploads/2020/08/sendgrid-580x380.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/08/sendgrid-768x503.png 768w" sizes="(max-width: 597px) 100vw, 597px" /><p id="caption-attachment-52894" class="wp-caption-text">Image: Wikipedia</p></div>
<p>Many companies use Sendgrid to communicate with their customers via email, or else pay marketing firms to do that on their behalf using Sendgrid&#8217;s systems. Sendgrid takes steps to validate that new customers are legitimate businesses, and that emails sent through its platform carry the proper digital signatures that other companies can use to validate that the messages have been authorized by its customers.</p>
<p>But this also means when a Sendgrid customer account gets hacked and used to send malware or phishing scams, the threat is particularly acute because a large number of organizations allow email from Sendgrid&#8217;s systems to sail through their spam-filtering systems.</p>
<p>To make matters worse, links included in emails sent through Sendgrid are obfuscated (mainly for tracking deliverability and other metrics), so it is not immediately clear to recipients where on the Internet they will be taken when they click.</p>
<p>Dealing with compromised customer accounts is a constant challenge for any organization doing business online today, and certainly Sendgrid is not the only email marketing platform dealing with this problem. But according to multiple emails from readers, recent threads on <a href="https://www.mail-archive.com/search?l=mailop%40mailop.org&amp;q=sendgrid" target="_blank" rel="noopener noreferrer">several anti-spam</a> <a href="https://cwiki.apache.org/confluence/display/SPAMASSASSIN/MailingLists" target="_blank" rel="noopener noreferrer">discussion lists</a>, and interviews with people in the anti-spam community, over the past few months there has been a marked increase in malicious, phishous and outright spammy email being blasted out via Sendgrid&#8217;s servers.</p>
<p><strong>Rob McEwen</strong> is CEO of <a href="https://www.invaluement.com/" target="_blank" rel="noopener noreferrer">Invaluement.com</a>, an anti-spam firm whose data on junk email trends are used to improve the spam-blocking technologies deployed by several Fortune 100 companies. McEwen said no other email service provider has come close to generating the volume of spam that&#8217;s been emanating from Sendgrid accounts lately.</p>
<p>&#8220;As far as the nasty criminal phishes and viruses, I think there&#8217;s not even a close second in terms of how bad it&#8217;s been with Sendgrid over the past few months,&#8221; he said.</p>
<p>Trying to filter out bad emails coming from a major email provider that so many legitimate companies rely upon to reach their customers can be a dicey business. If you filter the emails too aggressively you end up with an unacceptable number of &#8220;false positives,&#8221; i.e., benign or even desirable emails that get flagged as spam and sent to the junk folder or blocked altogether.</p>
<p>But McEwen said the incidence of malicious spam coming from Sendgrid has gotten so bad that he recently launched a new anti-spam block list specifically to filter out email from Sendgrid accounts that have been known to be blasting large volumes of junk or malicious email.</p>
<p>&#8220;Before I implemented this in my own filtering system a week ago, I was getting three to four phone calls or stern emails a week from angry customers wondering why these malicious emails were getting through to their inboxes,&#8221; McEwen said. &#8220;And I just am not seeing anything this egregious in terms of viruses and spams from the other email service providers.&#8221;<span id="more-52812"></span></p>
<p>In an interview with KrebsOnSecurity, Sendgrid parent firm Twilio acknowledged the company had recently seen an increase in compromised customer accounts being abused for spam. While Sendgrid does allow customers to use multi-factor authentication (also known as two-factor authentication or 2FA), this protection is not mandatory.</p>
<p>But <strong>Twilio Chief Security Officer Steve Pugh</strong> said the company is working on changes that would require customers to use some form of 2FA in addition to usernames and passwords.</p>
<p>&#8220;Twilio believes that requiring 2FA for customer accounts is the right thing to do, and we’re working towards that end,&#8221; Pugh said. &#8220;2FA has proven to be a powerful tool in securing communications channels. This is part of the reason we acquired Authy and created a line of account security products and services. Twilio, like other platforms, is forming a plan on how to better secure our customers’ accounts through native technologies such as Authy and additional account level controls to mitigate known attack vectors.&#8221;</p>
<p>Requiring customers to use some form of 2FA would go a long way toward neutralizing the underground market for compromised Sendgrid accounts, which are sold by a variety of cybercriminals who specialize in gaining access to accounts by targeting users who re-use the same passwords across multiple websites.</p>
<p>One such individual, who goes by the handle &#8220;Kromatix&#8221; on several forums, is currently selling access to more than 400 compromised Sendgrid user accounts. The pricing attached to each account is based on volume of email it can send in a given month. Accounts that can send up to 40,000 emails a month go for $15, whereas those capable of blasting 10 million missives a month sell for $400.</p>
<p><a class="lightbox" href="media/77a6cac7.sendgridseller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/sendgridseller.png"><img class="aligncenter wp-image-52905" src="media/77a6cac7.sendgridseller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/sendgridseller.png" alt="" width="598" height="294" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/08/sendgridseller.png 1406w, https://krebsonsecurity.com/wp-content/uploads/2020/08/sendgridseller-580x285.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/08/sendgridseller-940x462.png 940w, https://krebsonsecurity.com/wp-content/uploads/2020/08/sendgridseller-768x377.png 768w" sizes="(max-width: 598px) 100vw, 598px" /></a></p>
<p>&#8220;I have a large supply of cracked Sendgrid accounts that can be used to generate an API key which you can then plug into your mailer of choice and send massive amounts of emails with ensured delivery,&#8221; Kromatix wrote in an Aug. 23 sales thread. &#8220;Sendgrid servers maintain a very good reputation with [email service providers] so your content becomes much more likely to get into the inbox so long as your setup is correct.&#8221;</p>
<p><strong>Neil Schwartzman</strong>, executive director of the anti-spam group <a href="https://www.cauce.org/" target="_blank" rel="noopener noreferrer">CAUCE</a>, said Sendgrid&#8217;s 2FA plans are long overdue, noting that the company bought Authy back in 2015.</p>
<p>&#8220;<span class="pullquote pqright">Single-factor authentication for a company like this in 2020 is just ludicrous given the potential damage and malicious content we&#8217;re seeing</span>,&#8221; Schwartzman said.</p>
<p>&#8220;I understand that it&#8217;s a task to invoke 2FA, and given the volume of customers Sendgrid has that&#8217;s something to consider because there&#8217;s going to be a lot of customer overhead involved,&#8221; he continued. &#8220;But it&#8217;s not like your bank, social media account, email and plenty of other places online don&#8217;t already insist on it.&#8221;</p>
<p>Schwartzman said if Twilio doesn&#8217;t act quickly enough to fix the problem on its end, the major email providers of the world (think Google, Microsoft and Apple) &#8212; and their various machine-learning anti-spam algorithms &#8212; may do it for them.</p>
<p>&#8220;There is a tipping point after which receiving firms start to lose patience and start more aggressively filter this stuff,&#8221; he said. &#8220;If seeing a Sendgrid email according to machine learning becomes a sign of abuse, trust me the machines will make the decisions even if the people don&#8217;t.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=45506
title: The Joys of Owning an ‘OG’ Email Account
uri: The-Joys-of-Owning-an-OG-Email-Account
url: https://krebsonsecurity.com/2020/09/the-joys-of-owning-an-og-email-account/
content:
<p>When you own a short email address at a popular email provider, you are bound to get gobs of spam, and more than a few alerts about random people trying to seize control over the account. If your account name is short and desirable enough, this kind of activity can make the account less reliable for day-to-day communications because it tends to bury emails you do want to receive. But there is also a puzzling side to all this noise: Random people tend to use your account as if it were theirs, and often for some fairly sensitive services online.</p>
<p><img loading="lazy" class="alignright wp-image-24825 size-medium" src="media/ee10c30a.emaildevil-285x285.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/02/emaildevil-285x285.jpg" alt="" width="285" height="285" srcset="https://krebsonsecurity.com/wp-content/uploads/2014/02/emaildevil-285x285.jpg 285w, https://krebsonsecurity.com/wp-content/uploads/2014/02/emaildevil-150x150.jpg 150w, https://krebsonsecurity.com/wp-content/uploads/2014/02/emaildevil-600x600.jpg 600w, https://krebsonsecurity.com/wp-content/uploads/2014/02/emaildevil.jpg 693w" sizes="(max-width: 285px) 100vw, 285px" /></p>
<p>About 16 years ago &#8212; <a href="https://www.quora.com/How-long-was-Gmail-in-private-(invitation-only)-beta" target="_blank" rel="noopener noreferrer">back when you actually had to be invited by an existing Google Mail user in order to open a new Gmail account</a> &#8212; I was able to get hold of a very short email address on the service that hadn&#8217;t yet been reserved. Naming the address here would only invite more spam and account hijack attempts, but let&#8217;s just say the account name has something to do with computer hacking.</p>
<p>Because it&#8217;s a relatively short username, it is what&#8217;s known as an &#8220;<strong>OG</strong>&#8221; or &#8220;<strong>original gangster</strong>&#8221; account. These account names tend to be highly prized among certain communities, <a href="https://krebsonsecurity.com/?s=original+gangster&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">who busy themselves with trying to hack them for personal use or resale</a>. Hence, the constant account takeover requests.</p>
<p>What is endlessly fascinating is how many people think it&#8217;s a good idea to sign up for important accounts online using my email address. Naturally, my account has been signed up involuntarily for nearly every dating and porn website there is. That is to be expected, I suppose.</p>
<p>But what still blows me away is the number of financial and other sensitive accounts I could access if I were of a devious mind. This particular email address has accounts that I never asked for at <strong>H&amp;R Block</strong>, <strong>Turbotax</strong>, <strong>TaxAct</strong>, <strong>iTunes</strong>, <strong>LastPass</strong>, <strong>Dashlane</strong>, <strong>MyPCBackup</strong>, and <strong>Credit Karma</strong>, to name just a few. I&#8217;ve lost count of the number of active bank, ISP and web hosting accounts I can tap into.</p>
<p>I&#8217;m perpetually amazed by how many other Gmail users and people on similarly-sized webmail providers have opted to pick my account as a backup address if they should ever lose access to their inbox. Almost certainly, these users just lazily picked my account name at random when asked for a backup email &#8212; apparently without fully realizing the potential ramifications of doing so. At last check, my account is listed as the backup for more than three dozen <strong>Yahoo</strong>, <strong>Microsoft</strong> and other Gmail accounts and their associated file-sharing services.</p>
<p>If for some reason I ever needed to order pet food or medications online, my phantom accounts at <strong>Chewy</strong>, <strong>Coupaw</strong> and <strong>Petco</strong> have me covered. If any of my <strong>Weber</strong> grill parts ever fail, I&#8217;m set for life on that front. The Weber emails I periodically receive remind me of a piece I wrote many years ago for <em>The Washington Post</em>, about companies sending email from [companynamehere]@donotreply.com, without considering that someone might own that domain. Someone did, <a href="http://voices.washingtonpost.com/securityfix/2008/03/they_told_you_not_to_reply.html" target="_blank" rel="noopener noreferrer">and the results were often hilarious</a>.</p>
<p>It&#8217;s probably a good thing I&#8217;m not massively into computer games, because the online gaming (and gambling) profiles tied to my old Gmail account are innumerable.</p>
<p>For several years until recently, I was receiving the monthly statements intended for an older gentleman in India who had the bright idea of using my Gmail account to manage his substantial retirement holdings. Thankfully, after reaching out to him he finally removed my address from his profile, although he never responded to questions about how this might have happened.</p>
<p>On balance, I&#8217;ve learned it&#8217;s better just not to ask. On multiple occasions, I&#8217;d spend a few minutes trying to figure out if the email addresses using my Gmail as a backup were created by real people or just spam bots of some sort. And then I&#8217;d send a polite note to those that fell into the former camp, explaining why this was a bad idea and ask what motivated them to do so.</p>
<p>Perhaps because my Gmail account name includes a hacking term, the few responses I&#8217;ve received have been less than cheerful. Despite my including detailed instructions on how to undo what she&#8217;d done, one woman in Florida screamed in an ALL CAPS reply that I was trying to phish her and that her husband was a police officer who would soon hunt me down. Alas, I still get notifications anytime she logs into her Yahoo account.</p>
<p>Probably for the same reason the Florida lady assumed I was a malicious hacker, my account constantly gets requests from random people who wish to hire me to hack into someone else&#8217;s account. I never respond to those either, although I&#8217;ll admit that sometimes when I&#8217;m procrastinating over something the temptation arises.</p>
<p>Losing access to your inbox can open you up to <a href="https://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank" rel="noopener noreferrer">a cascading nightmare of other problems</a>. Having a backup email address tied to your inbox is a good idea, but obviously only if you also control that backup address.<span id="more-45506"></span></p>
<p>More importantly, make sure you&#8217;re availing yourself of the most secure form of multi-factor authentication offered by the provider. These may range from authentication options like <a href="https://searchsecurity.techtarget.com/definition/time-based-one-time-password-TOTP" target="_blank" rel="noopener noreferrer">one-time codes</a> sent via email, phone calls, SMS or mobile app, to more robust, true “2-factor authentication” or 2FA options (something you have and something you know), such as <a href="https://krebsonsecurity.com/?s=security+keys&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">security keys</a> or push-based 2FA such as <a href="https://duo.com/" target="_blank" rel="noopener noreferrer">Duo Security</a> (an advertiser on this site and a service I have used for years).</p>
<p>Email, SMS and app-based one-time codes are considered less robust from a security perspective because they can be undermined by a variety of well-established attack scenarios, from <a href="https://krebsonsecurity.com/?s=sim+swap&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">SIM-swapping</a> to mobile-based malware. So it makes sense to secure your accounts with the strongest form of MFA available. But please bear in mind that if the only added authentication options offered by a site you frequent are SMS and/or phone calls, this is still better than simply relying on a password to secure your account.</p>
<p>Maybe you&#8217;ve put off enabling multi-factor authentication for your important accounts, and if that describes you, please take a moment to visit <a href="https://www.twofactorauth.org" target="_blank" rel="noopener noreferrer">twofactorauth.org</a> and see whether you can harden your various accounts.</p>
<p>As I noted in June&#8217;s story, <a href="https://krebsonsecurity.com/2020/06/turn-on-mfa-before-crooks-do-it-for-you/" target="_blank" rel="noopener noreferrer">Turn on MFA Before Crooks Do It For You</a>, people who don’t take advantage of these added safeguards may find it far more difficult to regain access when their account gets hacked, because increasingly thieves will enable multi-factor options and tie the account to a device they control.</p>
<p>Are you in possession of an OG email account? Feel free to sound off in the comments below about some of the more gonzo stuff that winds up in your inbox.</p>


feed_id: https://krebsonsecurity.com/?p=52959
title: Microsoft Patch Tuesday, Sept. 2020 Edition
uri: Microsoft-Patch-Tuesday-Sept-2020-Edition
url: https://krebsonsecurity.com/2020/09/microsoft-patch-tuesday-sept-2020-edition/
content:
<p><strong>Microsoft </strong>today released updates to remedy nearly 130 security vulnerabilities in its<strong> Windows</strong> operating system and supported software. None of the flaws are known to be currently under active exploitation, but 23 of them could be exploited by malware or malcontents to seize complete control of Windows computers with little or no help from users.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="579" height="425" /></p>
<p>The majority of the most dangerous or &#8220;critical&#8221; bugs deal with issues in Microsoft&#8217;s various Windows operating systems and its web browsers, <strong>Internet Explorer</strong> and <strong>Edge</strong>. September marks the seventh month in a row Microsoft has shipped fixes for more than 100 flaws in its products, and the fourth month in a row that it fixed more than 120.</p>
<p>Among the chief concerns for enterprises this month is <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16875" target="_blank" rel="noopener noreferrer">CVE-2020-16875</a>, which involves a critical flaw in the email software <strong>Microsoft Exchange Server 2016 and 2019. </strong>An attacker could leverage the Exchange bug to run code of his choosing just by sending a booby-trapped email to a vulnerable Exchange server.</p>
<p>&#8220;That doesn’t quite make it wormable, but it’s about the worst-case scenario for Exchange servers,&#8221; said <strong>Dustin Childs</strong>, of <strong>Trend Micro&#8217;s Zero Day Initiative</strong>. &#8220;We have seen the previously patched Exchange bug <a href="https://krebsonsecurity.com/2020/03/microsoft-patch-tuesday-march-2020-edition/" target="_blank" rel="noopener noreferrer">CVE-2020-0688</a> used in the wild, and that requires authentication. We’ll likely see this one in the wild soon. This should be your top priority.&#8221;</p>
<p>Also not great for companies to have around is <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1210" target="_blank" rel="noopener noreferrer">CVE-2020-1210</a>, which is a remote code execution flaw in supported versions of <strong>Microsoft Sharepoint</strong> document management software that bad guys could attack by uploading a file to a vulnerable Sharepoint site. Security firm <strong>Tenable</strong> notes that this bug is reminiscent of <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604" target="_blank" rel="noopener noreferrer">CVE-2019-0604</a>, another Sharepoint problem that&#8217;s been exploited for cybercriminal gains since April 2019.</p>
<p>Microsoft fixed at least five other serious bugs in Sharepoint versions 2010 through 2019 that also could be used to compromise systems running this software. And because ransomware purveyors have a history of seizing upon Sharepoint flaws to wreak havoc inside enterprises, companies should definitely prioritize deployment of these fixes, says <strong>Alan Liska</strong>, senior security architect at <strong>Recorded Future</strong>.<span id="more-52959"></span></p>
<p><strong>Todd Schell</strong> at <strong>Ivanti</strong> reminds us that Patch Tuesday isn&#8217;t just about Windows updates: Google has shipped a critical update for its Chrome browser that resolves at least five security flaws that are rated high severity. If you use Chrome and notice an icon featuring a small upward-facing arrow inside of a circle to the right of the address bar, it&#8217;s time to update. Completely closing out Chrome and restarting it should apply the pending updates.</p>
<p>Once again, there are no security updates available today for <strong>Adobe&#8217;s Flash Player</strong>, although the company did ship a non-security software update for the browser plugin. The last time Flash got a security update was June 2020, which may suggest researchers and/or attackers have stopped looking for flaws in it. Adobe says it will retire the plugin at the end of this year, and Microsoft has said it plans to completely remove the program from all Microsoft browsers via Windows Update by then.</p>
<p>Before you update with this month’s patch batch, please make sure you have backed up your system and/or important files. It’s not uncommon for Windows updates to hose one’s system or prevent it from booting properly, and some updates even have known to erase or corrupt files.</p>
<p>So do yourself a favor and backup <em>before</em> installing any patches. Windows 10 even has <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">some built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, see <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">this guide</a>.</p>
<p>As always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips.</p>


feed_id: https://krebsonsecurity.com/?p=52428
title: Due Diligence That Money Can’t Buy
uri: Due-Diligence-That-Money-Can-t-Buy
url: https://krebsonsecurity.com/2020/09/due-diligence-that-money-cant-buy/
content:
<p>Most of us automatically put our guard up when someone we don&#8217;t know promises something too good to be true. But when the too-good-to-be-true thing starts as our idea, sometimes that instinct fails to kick in. Here&#8217;s the story of how companies searching for investors to believe in their ideas can run into trouble.</p>
<p><img loading="lazy" class="aligncenter wp-image-52977" src="media/7aaab735.investmoney.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/investmoney.png" alt="" width="571" height="406" /></p>
<p>Nick is an investment banker who runs a firm that helps raise capital for its clients (Nick is not his real name, and like other investment brokers interviewed in this story spoke with KrebsOnSecurity on condition of anonymity). Nick&#8217;s company works primarily in the mergers and acquisitions space, and his job involves advising clients about which companies and investors might be a good bet.</p>
<p>In one recent engagement, a client of Nick&#8217;s said they&#8217;d reached out to an investor from Switzerland &#8212; <a href="https://the-private-office.ch/" target="_blank" rel="noopener noreferrer">The Private Office of John Bernard</a> &#8212; whose name was included on a list of angel investors focused on technology startups.</p>
<p>&#8220;We ran into a group that one of my junior guys found on a list of data providers that compiled information on investors,&#8221; Nick explained. &#8220;I told them what we do and said we were working with a couple of companies that were interested in financing, and asked them to send some materials over. The guy had a British accent, claimed to have made his money in tech and in the dot-com boom, and said he&#8217;d sold a company to Geocities that was then bought by Yahoo.&#8221;</p>
<p>But Nick wasn&#8217;t convinced Mr. Bernard&#8217;s company was for real. Nick and his colleagues couldn&#8217;t locate the company Mr. Bernard claimed to have sold, and while Bernard said he was based in Switzerland, virtually all of his staff <a href="https://www.linkedin.com/search/results/people/?facetCurrentCompany=%5B%2218987858%22%5D&amp;origin=COMPANY_PAGE_CANNED_SEARCH" target="_blank" rel="noopener noreferrer">were all listed on LinkedIn</a> as residing in Ukraine.</p>
<p>Nick told his clients about his reservations, but each nevertheless was excited that someone was finally interested enough to invest in their ideas.</p>
<p>&#8220;The CEO of the client firm said, &#8216;This is great, someone is willing to believe in our company&#8217;,&#8221; Nick said. &#8220;After one phone call, he made an offer to invest tens of millions of dollars. I advised them not to pursue it, and one of the clients agreed. The other was very gung ho.&#8221;</p>
<p>When companies wish to link up with investors, what follows involves a legal process known as &#8220;due diligence&#8221; wherein each side takes time to research the other&#8217;s finances, management, and any lurking legal liabilities or risks associated with the transaction. Typically, each party will cover their own due diligence costs, but sometimes the investor or the company that stands to benefit from the transaction will cover the associated fees for both parties.</p>
<p>Nick said he wasn&#8217;t surprised when Mr. Bernard&#8217;s office insisted that its due diligence fees of tens of thousands of dollars be paid up front by his client. And he noticed the website for the due diligence firm that Mr. Bernard suggested using &#8212; <a href="https://www.insideknowledge.ch/" target="_blank" rel="noopener noreferrer">insideknowledge.ch</a> &#8212; also was filled with generalities and stock photos, just like John Bernard&#8217;s private office website.</p>
<p>&#8220;He said we used to use big accounting firms for this but found them to be ineffective,&#8221; Nick said. &#8220;The company they wanted us to use looked like a real accounting firm, but we couldn&#8217;t find any evidence that they were real. Also, we asked to see an investment portfolio. He said he&#8217;s invested in over 30 companies, so I would expect to see a document that says, &#8220;here&#8217;s the various companies we&#8217;ve invested in.&#8221; But instead, we got two recommendation letters on letterhead saying how great these investors were.&#8221;</p>
<p>KrebsOnSecurity located two other investment bankers who had similar experiences with Mr. Bernard&#8217;s office.</p>
<p>&#8220;A number of us have been comparing notes on this guy, and he never actually delivers,&#8221; said one investment banker who asked not to be named because he did not have permission from his clients. &#8220;In each case, he agreed to invest millions with no push back, the documentation submitted from their end was shabby and unprofessional, and they seem focused on companies that will write a check for due diligence fees. After their fees are paid, the experience has been an ever increasing and inventive number of reasons why the deal can&#8217;t close, including health problems and all sorts of excuses.&#8221;</p>
<p>Mr. Bernard&#8217;s investment firm did not respond to multiple requests for comment. The one technology company this author could tie to Mr. Bernard was <a href="https://web.archive.org/web/20171015221959/https://secureswissdata.com/" target="_blank" rel="noopener noreferrer">secureswissdata.com</a>, a Swiss concern that provides encrypted email and data services. The domain was registered in 2015 by Inside Knowledge. In February 2020, Secure Swiss Data <a href="https://finance.yahoo.com/news/safeswiss-com-acquires-secure-swiss-110010835.html" target="_blank" rel="noopener noreferrer">was purchased in an &#8220;undisclosed multimillion buyout&#8221;</a> by <strong>SafeSwiss Secure Communication AG</strong>.</p>
<p>SafeSwiss co-CEO and Secure Swiss Data founder <a href="https://www.linkedin.com/in/david-bruno-62864512/" target="_blank" rel="noopener noreferrer">David Bruno</a> said he couldn&#8217;t imagine that Mr. Bernard would be involved in anything improper.</p>
<p>&#8220;I can confirm that I know John <span class="il">Bernard</span> and have always found him very honourable and straight forward in my dealings with him as an investor,&#8221; Bruno said. &#8220;To be honest with you, I struggle to believe that he would, or would even need to be, involved in the activity you mentioned, and quite frankly I&#8217;ve never heard about those things.&#8221;<span id="more-52428"></span></p>
<h4>DUE DILIGENCE</h4>
<p>John Bernard is named in historic WHOIS domain name registration records from 2015 as the owner of the due diligence firm <strong>insideknowledge.ch. </strong>Another &#8220;capital investment&#8221; company tied to John Bernard&#8217;s Swiss address is <strong>liftinvest.ch</strong>, which was registered in November 2017.</p>
<p>Curiously, in May 2018, its WHOIS ownership records switched to a new name with the same initials: one &#8220;<strong>Jonathan Bibi</strong>,&#8221; with an address in the <a href="https://www.icij.org/investigations/offshore/sun-and-shadows-how-island-paradise-became-haven-dirty-money/" target="_blank" rel="noopener noreferrer">offshore company haven of Seychelles</a>. Likewise, Mr. Bibi was listed as a onetime owner of the domain for Mr. Bernard&#8217;s company  &#8212;<strong>the-private-office.ch </strong>&#8212; as well as <strong>johnbernard.ch</strong>.</p>
<p>Running a reverse WHOIS search through <a href="https://www.domaintools.com" target="_blank" rel="noopener noreferrer">domaintools.com</a> [an advertiser on this site] reveals several other interesting domains historically tied to a Jonathan Bibi from the Seychelles. Among those is <strong>acheterdubitcoin.org</strong>, a business that was <a href="https://coingeek.com/france-blacklists-21-websites-promoting-crypto-scams/" target="_blank" rel="noopener noreferrer">blacklisted by French regulators in 2018</a> for promoting cryptocurrency scams.</p>
<p>Another Seychelles concern tied to Mr. Bibi was <strong>effectivebets.com</strong>, which <a href="https://bitcointalk.org/index.php?topic=2203160.0" target="_blank" rel="noopener noreferrer">in 2017 and 2018 promoted sports betting via cryptocurrencies</a> and offered tips on picking winners.</p>
<p>A Google search on Jonathan Bibi from Seychelles reveals he was listed as a respondent in <a href="https://webcache.googleusercontent.com/search?q=cache:se638YnKS_UJ:https://www.sos.mo.gov/CMSImages/Securities/orders/AP-16-18.pdf+&amp;cd=2&amp;hl=en&amp;ct=clnk&amp;gl=us&amp;client=ubuntu" target="_blank" rel="noopener noreferrer">a lawsuit filed in 2018 by the State of Missouri</a>, which named him as a participant in an unlicensed &#8220;binary options&#8221; investment scheme that bilked investors out of their money.</p>
<p>Jonathan Bibi from Seychelles also was named as the director of another binary options scheme called the <a href="https://webcache.googleusercontent.com/search?q=cache:_vc7EYyjcEcJ:https://binaryoptionszone.net/the-dao-goldmanoptions-scam-exposed/+&amp;cd=3&amp;hl=en&amp;ct=clnk&amp;gl=us&amp;client=ubuntu" target="_blank" rel="noopener noreferrer">GoldmanOptions scam</a> that was ultimately shut down by regulators in the Czech Republic.</p>
<p><strong>Jason Kane</strong> is an attorney with <strong>Peiffer Wolf</strong>, a litigation firm that focuses on investment fraud. Kane said companies bilked by small-time investment schemes rarely pursue legal action, mainly because the legal fees involved can quickly surpass the losses. What&#8217;s more, most victims will likely be too ashamed to come forward.</p>
<p>&#8220;These are cases where you might win but you&#8217;ll never collect any money,&#8221; Kane said. &#8220;This seems like an investment twist on those fairly simple scams we all can&#8217;t believe people fall for, but as scams go this one is pretty good. Do this a few times a year and you can make a decent living and no one is really going to come after you.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=52989
title: Two Russians Charged in $17M Cryptocurrency Phishing Spree
uri: Two-Russians-Charged-in-17M-Cryptocurrency-Phishing-Spree
url: https://krebsonsecurity.com/2020/09/two-russians-charged-in-17m-cryptocurrency-phishing-spree/
content:
<p>U.S. authorities today announced criminal charges and financial sanctions against two Russian men accused of stealing nearly $17 million worth of virtual currencies in a series of phishing attacks throughout 2017 and 2018 that spoofed websites for some of the most popular cryptocurrency exchanges.</p>
<p><img loading="lazy" src="media/1d542076.coinphish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/coinphish.png" alt="" width="552" height="426" class="aligncenter size-full wp-image-52998" /><br />
<strong>The Justice Department</strong> unsealed indictments against Russian nationals <strong>Danil Potekhin</strong> and <strong>Dmitirii Karasavidi</strong>, alleging the duo was responsible for a sophisticated phishing and money laundering campaign that resulted in the theft of $16.8 million in cryptocurrencies and fiat money from victims.</p>
<p>Separately, the <strong>U.S. Treasury Department </strong> <a href="https://home.treasury.gov/news/press-releases/sm1123" rel="noopener noreferrer" target="_blank">announced economic sanctions against Potekhin and Karasavidi</a>, effectively freezing all property and interests of these persons (subject to U.S. jurisdiction) and making it a crime to transact with them. </p>
<p>According to the indictments, the two men set up fake websites that spoofed login pages for the currency exchanges <strong>Binance</strong>, <strong>Gemini</strong> and <strong>Poloniex</strong>. Armed with stolen login credentials, the men allegedly stole more than $10 million from 142 Binance victims, $5.24 million from 158 Poloniex users, and $1.17 million from 42 Gemini customers.</p>
<p>Prosecutors say the men then laundered the stolen funds through an array of intermediary cryptocurrency accounts &#8212; including compromised and fictitiously created accounts &#8212; on the targeted cryptocurrency exchange platforms. In addition, the two are alleged to have artificially inflated the value of their ill-gotten gains by engaging in cryptocurrency price manipulation using some of the stolen funds.</p>
<p>For example, investigators alleged Potekhin and Karasavidi used compromised Poloniex accounts to place orders to purchase large volumes of &#8220;<a href="https://support.blockchain.com/hc/en-us/articles/360027772571-What-is-gas-" rel="noopener noreferrer" target="_blank">GAS</a>,&#8221; the digital currency token used to pay the cost of executing transactions on the <a href="https://neo.org/" rel="noopener noreferrer" target="_blank">NEO blockchain</a> &#8212; China&#8217;s first open source blockchain platform. </p>
<p>&#8220;Using digital crurency in one victim Poloniex account, they placed an order to purchase approximately 8,000 GAS, thereby immediately increasing the market price of GAS from approximately $18 to $2,400,&#8221; the indictment explains. </p>
<p>Potekhin and others then converted the artificially inflated GAS in their own fictitious Poloniex accounts into other cryptocurrencies, including Ethereum (ETH) and Bitcoin (BTC). From the complaint:</p>
<blockquote><p>&#8220;Before the Eight Fictitious Poloniex Accounts were frozen, POTEKHIN and others transferred approximately 759 ETH to nine digital currency addresses. Through a sophisticated and layered manner, the ETH from these nine digital currency addresses was sent through multiple intermediary accounts, before ultimately being deposited into a Bitfinex account controlled by Karasavidi.&#8221;</p></blockquote>
<p>The Treasury&#8217;s action today <a href="https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20200916" rel="noopener noreferrer" target="_blank">lists several of the cryptocurrency accounts</a> thought to have been used by the defendants. Searching on some of those accounts at various cryptocurrency transaction tracking sites points to a number of phishing victims.</p>
<p>&#8220;I would like to blow your bitch ass away, if you even had the balls to show yourself,&#8221; exclaimed one victim, posting in a comment <a href="https://etherscan.io/address/0x6aef2850c2ce2ef583ae8a36be3357080608bdc3#comments" rel="noopener noreferrer" target="_blank">on the Etherscan lookup service</a>.<span id="more-52989"></span></p>
<p>One victim said he contemplated suicide after being robbed of his ETH holdings in a 2017 phishing attack. Another said he&#8217;d been relieved of funds needed to pay for his 3-year-old daughter&#8217;s medical treatment. </p>
<p>&#8220;You and your team will leave a trail and will be found,&#8221; wrote one victim, using the handle &#8216;Illfindyou.&#8217; &#8220;You&#8217;ll only be able to hide behind the facade for a short while. Go steal from whales you piece of shit.&#8221;</p>
<p>There is potentially some good news for victims of these phishing attacks. According to the Treasury Department, millions of dollars in virtual currency and U.S. dollars traced to Karasavidi’s account was seized in a forfeiture action by the United States Secret Service.</p>
<p>Whether any of those funds can be returned to victims of this phishing spree remains to be seen. And assuming that does happen, it could take years. In February 2020, KrebsOnSecurity wrote about being contacted by an Internal Revenue Service investigator <a href="https://krebsonsecurity.com/2020/02/a-light-at-the-end-of-liberty-reserves-demise/" rel="noopener noreferrer" target="_blank">seeking to return funds seized seven years earlier as part of the governments 2013 seizure of Liberty Reserve</a>, a virtual currency service that acted as a $6 billion hub for the cybercrime world.</p>
<p>Today&#8217;s action is the latest indication that the Treasury Department is increasingly willing to use its authority to restrict the financial resources tied to various cybercrime activities. Earlier this month, the agency&#8217;s Office of Foreign Asset Control (OFAC) added three Russian nationals and a host of cryptocurrency addresses to its sanctions lists in a case <a href="https://www.coindesk.com/ofac-sanctions-election-interference" rel="noopener noreferrer" target="_blank">involving efforts by Russian online troll farms to influence the 2018 mid-term elections</a>.</p>
<p>In June, OFAC <a href="https://home.treasury.gov/news/press-releases/sm1034" rel="noopener noreferrer" target="_blank">took action against six Nigerian nationals suspected of stealing $6 million</a> from U.S. businesses and individuals through Business Email Compromise fraud and romance scams. </p>
<p>And in 2019, OFAC <a href="https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/" rel="noopener noreferrer" target="_blank">sanctioned 17 members allegedly associated with &#8220;Evil Corp.,&#8221;</a> an Eastern European cybercrime syndicate that has stolen more than $100 million from small businesses via malicious software over the past decade.</p>
<p>A copy of the indictments against Potekhin and Karasavidi is available <a href="media/76b56b59.filed-Superseding-Indictment.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/filed-Superseding-Indictment.pdf" rel="noopener noreferrer" target="_blank">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=53008
title: Chinese Antivirus Firm Was Part of APT41 ‘Supply Chain’ Attack
uri: Chinese-Antivirus-Firm-Was-Part-of-APT41-Supply-Chain-Attack
url: https://krebsonsecurity.com/2020/09/chinese-antivirus-firm-was-part-of-apt41-supply-chain-attack/
content:
<p>The <strong>U.S. Justice Department</strong> this week indicted seven Chinese nationals for a decade-long hacking spree that targeted more than 100 high-tech and online gaming companies. The government alleges the men used malware-laced phishing emails and &#8220;supply chain&#8221; attacks to steal data from companies and their customers. One of the alleged hackers was first profiled here in 2012 as the owner of a Chinese antivirus firm.</p>
<div id="attachment_53015" style="width: 595px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53015" loading="lazy" class="size-full wp-image-53015" src="media/9dcc79f3.apt41-group.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/apt41-group.png" alt="" width="585" height="499" /><p id="caption-attachment-53015" class="wp-caption-text">Image: FBI</p></div>
<p><a href="https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer" target="_blank" rel="noopener noreferrer">Charging documents</a> say the seven men are part of a hacking group known variously as &#8220;<strong>APT41</strong>,&#8221; &#8220;<strong>Barium</strong>,&#8221; &#8220;<strong>Winnti</strong>,&#8221; &#8220;<strong>Wicked Panda</strong>,&#8221; and &#8220;<strong>Wicked Spider</strong>.&#8221; Once inside of a target organization, the hackers stole source code, software code signing certificates, customer account data and other information they could use or resell.</p>
<p>APT41&#8217;s activities span from the mid-2000s to the present day. Earlier this year, for example, the group was tied to a particularly aggressive malware campaign that exploited recent vulnerabilities in widely-used networking products, including flaws in <strong>Cisco</strong> and <strong>D-Link</strong> routers, as well as <strong>Citrix</strong> and <strong>Pulse</strong> VPN appliances. Security firm <a href="https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html" target="_blank" rel="noopener noreferrer">FireEye</a> dubbed that hacking blitz &#8220;one of the broadest campaigns by a Chinese cyber espionage actor we have observed in recent years.&#8221;</p>
<p>The government alleges the group monetized its illicit access by deploying ransomware and &#8220;<a href="https://www.malwarebytes.com/cryptojacking/" target="_blank" rel="noopener noreferrer">cryptojacking</a>&#8221; tools (using compromised systems to mine cryptocurrencies like Bitcoin). In addition, the gang targeted video game companies and their customers in a bid to steal digital items of value that could be resold, such as points, powers and other items that could be used to enhance the game-playing experience.</p>
<p>APT41 was known to hide its malware inside fake resumes that were sent to targets. It also deployed more complex supply chain attacks, in which they would hack a software company and modify the code with malware.</p>
<p>&#8220;The victim software firm &#8212; unaware of the changes to its product, would subsequently distribute the modified software to its third-party customers, who were thereby defrauded into installing malicious software code on their own computers,&#8221; the indictments explain.</p>
<p>While the various charging documents released in this case do not mention it per se, it is clear that members of this group also favored another form of supply chain attacks &#8212; hiding their malware inside commercial tools they created and advertised as legitimate security software and PC utilities.</p>
<p>One of the men indicted as part of APT41 &#8212; now 35-year-old <strong>Tan DaiLin</strong> &#8212; was the subject of <a href="https://krebsonsecurity.com/2012/11/infamous-hacker-heading-chinese-antivirus-firm" target="_blank" rel="noopener noreferrer">a 2012 KrebsOnSecurity story</a> that sought to shed light on a Chinese antivirus product marketed as <strong>Anvisoft</strong>. At the time, the product had been &#8220;whitelisted&#8221; or marked as safe by competing, more established antivirus vendors, although the company seemed unresponsive to user complaints and to questions about its leadership and origins.</p>
<div id="attachment_17528" style="width: 584px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-17528" loading="lazy" class="size-full wp-image-17528" src="media/95f8449e.wickedrose.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2012/11/wickedrose.png" alt="" width="574" height="524" srcset="https://krebsonsecurity.com/wp-content/uploads/2012/11/wickedrose.png 574w, https://krebsonsecurity.com/wp-content/uploads/2012/11/wickedrose-285x260.png 285w" sizes="(max-width: 574px) 100vw, 574px" /><p id="caption-attachment-17528" class="wp-caption-text">Tan DaiLin, a.k.a. &#8220;Wicked Rose,&#8221; in his younger years. Image: iDefense</p></div>
<p>Anvisoft claimed to be based in California and Canada, but a search on the company’s brand name turned up trademark registration records that put Anvisoft in the high-tech zone of <strong>Chengdu</strong> in the Sichuan Province of China.</p>
<p>A review of Anvisoft&#8217;s website registration records showed the company&#8217;s domain originally was created by Tan DaiLin, an infamous Chinese hacker who went by the aliases &#8220;Wicked Rose&#8221; and &#8220;Withered Rose.&#8221; At the time of story, DaiLin was 28 years old.</p>
<p>That story cited <a href="media/47adca69.WickedRose_andNCPH.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2012/11/WickedRose_andNCPH.pdf" target="_blank" rel="noopener noreferrer">a 2007 report</a> (PDF) from <strong>iDefense</strong>, which detailed DaiLin&#8217;s role as the leader of a state-sponsored, four-man hacking team called NCPH (short for Network Crack Program Hacker). According to iDefense, in 2006 the group was responsible for crafting a rootkit that took advantage of a zero-day vulnerability in Microsoft Word, and was used in attacks on “a large DoD entity” within the USA.</p>
<p>“Wicked Rose and the NCPH hacking group are implicated in multiple Office based attacks over a two year period,” the iDefense report stated.</p>
<p>When I first scanned Anvisoft at Virustotal.com back in 2012, none of the antivirus products detected it as suspicious or malicious. But in the days that followed, several antivirus products began flagging it for bundling at least two trojan horse programs designed to steal passwords from various online gaming platforms.<span id="more-53008"></span></p>
<p>Security analysts and U.S. prosecutors say APT41 operated out of a Chinese enterprise called <strong>Chengdu 404</strong> that purported to be a network technology company but which served a legal front for the hacking group&#8217;s illegal activities, and that Chengdu 404 used its global network of compromised systems as a kind of dragnet for information that might be useful to the Chinese Communist Party.</p>
<div id="attachment_53013" style="width: 530px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53013" loading="lazy" class="size-full wp-image-53013" src="media/a2e3db04.chengdu404.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/chengdu404.png" alt="" width="520" height="391" /><p id="caption-attachment-53013" class="wp-caption-text">Chengdu404&#8217;s offices in China. Image: DOJ.</p></div>
<p>&#8220;CHENGDU 404 developed a &#8216;big data&#8217; product named &#8216;<strong>SonarX</strong>,&#8217; which was described&#8230;as an &#8216;Information Risk Assessment System,'&#8221; the government&#8217;s indictment reads. &#8220;SonarX served as an easily searchable repository for social media data that previously had been obtained by CHENGDU 404.&#8221;</p>
<p>The group allegedly used SonarX to search for individuals linked to various Hong Kong democracy and independence movements, and snoop on a U.S.-backed media outlet that ran stories examining the Chinese government&#8217;s treatment of <a href="https://en.wikipedia.org/wiki/Xinjiang_re-education_camps#:~:text=The%20Xinjiang%20re%2Deducation%20camps,government%20and%20its%20CCP%20committee." target="_blank" rel="noopener noreferrer">Uyghur people living in its Xinjian region</a>.</p>
<p>As noted by TechCrunch, after the indictments were filed prosecutors said they obtained warrants to seize websites, domains and servers associated with the group’s operations, effectively shutting them down and hindering their operations.</p>
<p>&#8220;The alleged hackers are still believed to be in China, but the allegations serve as a &#8216;name and shame&#8217; effort employed by the Justice Department in recent years against state-backed cyber attackers,&#8221; <a href="https://techcrunch.com/2020/09/16/justice-department-charges-apt41-chinese-hackers/" target="_blank" rel="noopener noreferrer">wrote</a> TechCrunch&#8217;s <strong>Zack Whittaker</strong>.</p>


feed_id: https://krebsonsecurity.com/?p=53058
title: Govt. Services Firm Tyler Technologies Hit in Apparent Ransomware Attack
uri: Govt-Services-Firm-Tyler-Technologies-Hit-in-Apparent-Ransomware-Atta
url:
https://krebsonsecurity.com/2020/09/govt-services-firm-tyler-technologies-hit-in-apparent-ransomware-attack/

content:
<p><strong>Tyler Technologies</strong>, a Texas-based company that bills itself as the largest provider of software and technology services to the United States public sector, is battling a network intrusion that has disrupted its operations. The company declined to discuss the exact cause of the disruption, but their response so far is straight out of the playbook for responding to ransomware incidents.</p>
<p><img loading="lazy" class="aligncenter wp-image-53062" src="media/ee776d1d.tylertech.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/tylertech.png" alt="" width="593" height="182" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/09/tylertech.png 1282w, https://krebsonsecurity.com/wp-content/uploads/2020/09/tylertech-768x235.png 768w" sizes="(max-width: 593px) 100vw, 593px" /></p>
<p>Plano, Texas-based Tyler Technologies [<a href="https://finance.yahoo.com/quote/TYL/" target="_blank" rel="noopener noreferrer">NYSE:TYL</a>] has some 5,300 employees and brought in revenues of more than $1 billion in 2019. It sells a broad range of services to state and local governments, including appraisal and tax software, integrated software for courts and justice agencies, enterprise financial software systems, public safety software, records/document management software solutions and transportation software solutions for schools.</p>
<p>Earlier today, the normal content on <strong>tylertech.com</strong> was replaced with a notice saying the site was offline. In a statement provided to KrebsOnSecurity after the markets closed central time, Tyler Tech said early this morning the company became aware that an unauthorized intruder had gained access to its phone and information technology systems.</p>
<p>&#8220;Upon discovery and out of an abundance of caution, we shut down points of access to external systems and immediately began investigating and remediating the problem,&#8221; Tyler&#8217;s Chief Information Officer <strong>Matt Bieri</strong> said. &#8220;We have since engaged outside IT security and forensics experts to conduct a detailed review and help us securely restore affected equipment. We are implementing enhanced monitoring systems, and we have notified law enforcement.&#8221;</p>
<p>&#8220;At this time and based on the evidence available to us to-date, all indications are that the impact of this incident is limited to our internal network and phone systems,&#8221; their statement continues. &#8220;We currently have no reason to believe that any client data, client servers, or hosted systems were affected.&#8221;<span id="more-53058"></span></p>
<p>While it may be comforting to hear that last bit, the reality is that it is still early in the company&#8217;s investigation. Also, ransomware has moved well past just holding a victim firm&#8217;s IT systems hostage in exchange for an extortion payment: These days, ransomware purveyors will offload as much personal and financial data that they can before unleashing their malware, and then often demand a second ransom payment in exchange for a promise to delete the stolen information or to refrain from publishing it online.</p>
<p>Tyler Technologies declined to say how the intrusion is affecting its customers. But several readers who work in IT roles at local government systems that rely on Tyler Tech said the outage had disrupted the ability of people to pay their water bills or court payments.</p>
<p>&#8220;Tyler has access to a lot of these servers in cities and counties for remote support, so it was very thoughtful of them to keep everyone in the dark and possibly exposed if the attackers made off with remote support credentials while waiting for the stock market to close,&#8221; said one reader who asked to remain anonymous.</p>
<p>Depending on how long it takes for Tyler to recover from this incident, it could have a broad impact on the ability of many states and localities to process payments for services or provide various government resources online.</p>
<p>Tyler Tech has pivoted on the threat of ransomware as a selling point for many of its services, using its presence on social media to promote ransomware survival guides and incident response checklists. With any luck, the company was following some of its own advice and will weather this storm quickly.</p>
<p><img loading="lazy" class="aligncenter wp-image-53063" src="media/a2c37ddc.tyler-tech-ransom.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/tyler-tech-ransom.png" alt="" width="594" height="386" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/09/tyler-tech-ransom.png 1312w, https://krebsonsecurity.com/wp-content/uploads/2020/09/tyler-tech-ransom-768x499.png 768w" sizes="(max-width: 594px) 100vw, 594px" /></p>


feed_id: https://krebsonsecurity.com/?p=53073
title: Microsoft: Attackers Exploiting ‘ZeroLogon’ Windows Flaw
uri: Microsoft-Attackers-Exploiting-ZeroLogon-Windows-Flaw
url: https://krebsonsecurity.com/2020/09/microsoft-attackers-exploiting-zerologon-windows-flaw/
content:
<p><strong>Microsoft</strong> warned on Wednesday that malicious hackers are exploiting a particularly dangerous flaw in <strong>Windows Server</strong> systems that could be used to give attackers the keys to the kingdom inside a vulnerable corporate network. Microsoft&#8217;s warning comes just days after the <strong>U.S. Department of Homeland Security</strong> issued an emergency directive instructing all federal agencies to patch the vulnerability by Sept. 21 at the latest.</p>
<p><img loading="lazy" class="aligncenter  wp-image-53074" src="media/f9cd9b20.msi-tweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/msi-tweet.png" alt="" width="592" height="270" /></p>
<p>DHS&#8217;s <strong>Cybersecurity and Infrastructure Agency</strong> (CISA) said <a href="https://us-cert.cisa.gov/ncas/current-activity/2020/09/18/cisa-releases-emergency-directive-microsoft-windows-netlogon" target="_blank" rel="noopener noreferrer">in the directive</a> that it expected imminent exploitation of the flaw &#8212; <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472" target="_blank" rel="noopener noreferrer">CVE-2020-1472</a> and dubbed &#8220;ZeroLogon&#8221; &#8212; because exploit code which can be used to take advantage of it <a href="https://us-cert.cisa.gov/ncas/current-activity/2020/09/14/exploit-netlogon-remote-protocol-vulnerability-cve-2020-1472" target="_blank" rel="noopener noreferrer">was circulating online</a>.</p>
<p>Last night, Microsoft&#8217;s Security Intelligence unit <a href="https://twitter.com/MsftSecIntel/status/1308941504707063808" target="_blank" rel="noopener noreferrer">tweeted</a> that the company is &#8220;tracking threat actor activity using exploits for the CVE-2020-1472 Netlogon vulnerability.&#8221;</p>
<p>&#8220;We have observed attacks where public exploits have been incorporated into attacker playbooks,&#8221; Microsoft said. &#8220;We strongly recommend customers to immediately apply security updates.&#8221;</p>
<p>Microsoft <a href="https://krebsonsecurity.com/2020/08/microsoft-patch-tuesday-august-2020-edition/" target="_blank" rel="noopener noreferrer">released a patch for the vulnerability in August</a>, but it is not uncommon for businesses to delay deploying updates for days or weeks while testing to ensure the fixes do not interfere with or disrupt specific applications and software.</p>
<p>CVE-2020-1472 earned Microsoft&#8217;s most-dire &#8220;critical&#8221; severity rating, meaning attackers can exploit it with little or no help from users. The flaw is present in most supported versions of Windows Server, from <strong>Server 2008</strong> through <strong>Server 2019</strong>.<span id="more-53073"></span></p>
<p>The vulnerability could let an unauthenticated attacker gain administrative access to a Windows domain controller and run an application of their choosing. A domain controller is a server that responds to security authentication requests in a Windows environment, and a compromised domain controller can give attackers the keys to the kingdom inside a corporate network.</p>
<p><strong>Scott Caveza</strong>, research engineering manager at security firm <a href="https://www.tenable.com" target="_blank" rel="noopener noreferrer">Tenable</a>, said several samples of malicious .NET executables with the filename ‘SharpZeroLogon.exe’ have been uploaded to VirusTotal, a service owned by Google that scans suspicious files against dozens of antivirus products.</p>
<p>&#8220;Given the flaw is easily exploitable and would allow an attacker to completely take over a Windows domain, it should come as no surprise that we’re seeing attacks in the wild,&#8221; Caveza said. &#8220;Administrators should prioritize patching this flaw as soon as possible. Based on the rapid speed of exploitation already, we anticipate this flaw will be a popular choice amongst attackers and integrated into malicious campaigns.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=53027
title: Who is Tech Investor John Bernard?
uri: Who-is-Tech-Investor-John-Bernard
url: https://krebsonsecurity.com/2020/09/who-is-tech-investor-john-bernard/
content:
<p><strong>John Bernard</strong>, the subject of a story here last week about <a href="https://krebsonsecurity.com/2020/09/due-diligence-that-money-cant-buy/" target="_blank" rel="noopener noreferrer">a self-proclaimed millionaire investor who has bilked countless tech startups</a>, appears to be a pseudonym for <strong>John Clifton Davies</strong>, a U.K. man who absconded from justice before being convicted on multiple counts of fraud in 2015. Prior to his conviction, Davies served 16 months in jail before being cleared of murdering his wife on their honeymoon in India.</p>
<p><a href="https://archive.vn/KKywg" target="_blank" rel="noopener noreferrer">The Private Office of John Bernard</a>, which advertises itself as a capital investment firm based in Switzerland, has for years been listed on multiple investment sites as the home of a millionaire who made his fortunes in the dot-com boom 20 years ago and who has oodles of cash to invest in tech startups.</p>
<p><img loading="lazy" class="aligncenter wp-image-53031" src="media/62badb37.privateoffice.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/privateoffice.png" alt="" width="595" height="410" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/09/privateoffice.png 853w, https://krebsonsecurity.com/wp-content/uploads/2020/09/privateoffice-768x529.png 768w" sizes="(max-width: 595px) 100vw, 595px" /></p>
<p>But as last week&#8217;s story noted, Bernard&#8217;s investment company is a bit like a bad slot machine that never pays out. KrebsOnSecurity interviewed multiple investment brokers who all told the same story: After promising to invest millions after one or two phone calls and with little or no pushback, Bernard would insist that companies pay tens of thousands of dollars worth of due diligence fees up front.</p>
<p>However, the due diligence company he insisted on using &#8212; another Swiss firm called <a href="https://web.archive.org/web/20200917195829/https://www.insideknowledge.ch/" target="_blank" rel="noopener noreferrer">Inside Knowledge</a> &#8212; also was secretly owned by Bernard, who would invariably pull out of the deal after receiving the due diligence money.</p>
<p>Neither Mr. Bernard nor anyone from his various companies responded to multiple requests for comment over the past few weeks. What&#8217;s more, virtually all of the employee profiles tied to Bernard&#8217;s office have since last week removed those firms from their work experience as listed on their LinkedIn resumes &#8212; or else deleted their profiles altogether.</p>
<p>Sometime on Thursday John Bernard&#8217;s main website &#8212; <a href="https://web.archive.org/web/20200917102043/https://the-private-office.ch/" target="_blank" rel="noopener noreferrer">the-private-office.ch</a> &#8212; replaced the content on its homepage with a note saying it was closing up shop.</p>
<p>&#8220;We are pleased to announce that we are currently closing The Private Office fund as we have reached our intended investment level and that we now plan to focus on helping those companies we have invested into to grow and succeed,&#8221; the message reads.</p>
<p><img loading="lazy" class="aligncenter  wp-image-53099" src="media/8422fe51.bye-bernard.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/bye-bernard.png" alt="" width="598" height="267" /></p>
<p>As noted in last week&#8217;s story, the beauty of a scam like the one multiple investment brokers said was being run by Mr. Bernard is that companies bilked by small-time investment schemes rarely pursue legal action, mainly because the legal fees involved can quickly surpass the losses. What’s more, most victims will likely be too ashamed to come forward.</p>
<p>Also, John Bernard&#8217;s office typically did not reach out to investment brokers directly. Rather, he had his firm included on a list of angel investors focused on technology companies, so those seeking investments usually came to him.</p>
<p>Finally, multiple sources interviewed for this story said Bernard&#8217;s office offered a finders fee for any investment leads that brokers brought his way. While such commissions are not unusual, the amount promised &#8212; five percent of the total investment in a given firm that signed an agreement &#8212; is extremely generous. However, none of the investment brokers who spoke to KrebsOnSecurity were able to collect those fees, because Bernard&#8217;s office never actually consummated any of the deals they referred to him.<span id="more-53027"></span></p>
<h4>PAY NO ATTENTION TO THE EMPTY BOOKSHELVES</h4>
<p>After last week&#8217;s story ran, KrebsOnSecurity heard from a number of other investment brokers who had near identical experiences with Bernard. Several said they at one point spoke with him via phone or Zoom conference calls, and that he had a distinctive British accent.</p>
<p>When questioned about why his staff was virtually all based in Ukraine when his companies were supposedly in Switzerland, Bernard replied that his wife was Ukrainian and that they were living there to be closer to her family.</p>
<p>One investment broker who recently got into a deal with Bernard shared a screen shot from a recent Zoom call with him. That screen shot shows Bernard bears a striking resemblance to one <strong>John Clifton Davies</strong>, a 59-year-old from <a href="https://en.wikipedia.org/wiki/Milton_Keynes" target="_blank" rel="noopener noreferrer">Milton Keynes</a>, a large town in Buckinghamshire, England about 50 miles (80 km) northwest of London.</p>
<div id="attachment_53032" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/c95e44e6.Bernard-sbs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/Bernard-sbs.png"><img aria-describedby="caption-attachment-53032" loading="lazy" class="wp-image-53032" src="media/c95e44e6.Bernard-sbs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/Bernard-sbs.png" alt="" width="595" height="315" /></a><p id="caption-attachment-53032" class="wp-caption-text">John Bernard (left) in a recent Zoom call, and a photo of John Clifton Davies from 2015.</p></div>
<p>In 2015, Mr. Davies was convicted of stealing more than GBP 750,000 from struggling companies looking to restructure their debt. For at least seven years, Davies ran multiple scam businesses that claimed to provide insolvency consulting to distressed companies, even though he was not licensed to do so.</p>
<p>&#8220;After gaining the firm’s trust, he took control of their assets and would later pocket the cash intended for creditors,&#8221; according to <a href="https://www.bridgingandcommercial.co.uk/article-desc-4781_manhunt-begi" target="_blank" rel="noopener noreferrer">a U.K. news report from 2015</a>. &#8220;After snatching the cash, Davies proceeded to spend the stolen money on a life of luxury, purchasing a new upmarket home fitted with a high-tech cinema system and new kitchen.&#8221;</p>
<p>Davies disappeared before he was convicted of fraud in 2015. Two years before that, Davies was released from prison after being held in custody for 16 months on <a href="https://www.bbc.com/news/uk-wales-21850549" target="_blank" rel="noopener noreferrer">suspicion of murdering his new bride in 2004 on their honeymoon in India</a>.</p>
<p>Davies&#8217; former wife <strong>Colette Davies</strong>, 39, died after falling 80 feet from a viewing point at a steep gorge in the Himachal Pradesh region of India. Mr. Davies was charged with murder and fraud after he attempted to collect GBP 132,000 in her life insurance payout, but British prosecutors ultimately conceded they did not have enough evidence to convict him.</p>
<h4>THE SWISS AND UKRAINE CONNECTIONS</h4>
<p>While the photos above are similar, there are other clues that suggest the two identities may be the same person. A review of business records tied to Davies&#8217; <a href="https://beta.companieshouse.gov.uk/company/05457712" target="_blank" rel="noopener noreferrer">phony insolvency consulting businesses</a> between 2007 and 2013 provides some additional pointers.</p>
<p>John Clifton Davies&#8217; former listing at the official U.K. business registrar <strong>Companies House</strong> show his company was registered at the address 26 Dean Forest Way, Broughton, Milton Keynes.</p>
<p>A search on that street address at <a href="https://www.4iq.com" target="_blank" rel="noopener noreferrer">4iq.com</a> turns up several interesting results, including a listing for <strong>senecaequities.com</strong> registered to a John Davies at the email address <strong>john888@myswissmail.ch</strong>.</p>
<p>A Companies House official record for <a href="https://beta.companieshouse.gov.uk/company/08737929/officers" target="_blank" rel="noopener noreferrer">Seneca Equities</a> puts it at John Davies&#8217; old U.K. address at 26 Dean Forest Way and lists 46-year-old <strong>Iryna Davies</strong> as a director. &#8220;Iryna&#8221; is a uniquely Ukrainian spelling of the name Irene (the Russian equivalent is typically &#8220;Irina&#8221;).</p>
<p>A search on John Clifton Davies and Iryna turned up <a href="https://www.mirror.co.uk/news/uk-news/john-davies-man-cleared-over-1844409" target="_blank" rel="noopener noreferrer">this 2013 story</a> from <em>The Daily Mirror</em> which says Iryna is John C. Davies&#8217; fourth wife, and that the two were married in 2010.</p>
<p>KrebsOnSecurity sought comment from both the U.K. police district that prosecuted Davies&#8217; case and the U.K.&#8217;s <strong>National Crime Agency</strong> (NCA). Neither wished to comment on the findings. &#8220;We can neither confirm nor deny the existence of an investigation or subjects of interest,&#8221; a spokesperson for the NCA said.</p>


feed_id: https://krebsonsecurity.com/?p=53121
title: Who’s Behind Monday’s 14-State 911 Outage?
uri: Who-s-Behind-Monday-s-14-State-911-Outage
url: https://krebsonsecurity.com/2020/09/whos-behind-mondays-14-state-911-outage/
content:
<p>Emergency 911 systems were down for more than an hour on Monday in towns and cities across 14 U.S. states. The outages led many news outlets to speculate the problem was related to <strong>Microsoft</strong>&#8216;s <strong>Azure</strong> web services platform, which also was struggling with a widespread outage at the time. However, multiple sources tell KrebsOnSecurity the 911 issues stemmed from some kind of technical snafu involving <strong>Intrado</strong> and <strong>Lumen</strong>, two companies that together handle 911 calls for a broad swath of the United States.</p>
<div id="attachment_53132" style="width: 608px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53132" loading="lazy" class=" wp-image-53132" src="media/0cc31152.intrado.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/intrado.png" alt="" width="598" height="393" /><p id="caption-attachment-53132" class="wp-caption-text">Image: West.com</p></div>
<p>On the afternoon of Monday, Sept. 28, several states including Arizona, California, Colorado, Delaware, Florida, Illinois, Indiana, Minnesota, Nevada, North Carolina, North Dakota, Ohio, Pennsylvania and Washington reported 911 outages in various cities and localities.</p>
<p>Multiple news reports suggested the outages might have been related to an ongoing service disruption at Microsoft. But a spokesperson for the software giant told KrebsOnSecurity, &#8220;we&#8217;ve seen no indication that the multi-state 911 outage was a result of yesterday&#8217;s Azure service disruption.&#8221;</p>
<p>Inquiries made with emergency dispatch centers at several of the towns and cities hit by the 911 outage pointed to a different source: Omaha, Neb.-based Intrado &#8212; until last year known as <strong>West Safety Communications</strong> &#8212; a provider of 911 and emergency communications infrastructure, systems and services to telecommunications companies and public safety agencies throughout the country.</p>
<p>Intrado did not respond to multiple requests for comment. But according to officials in Henderson County, NC, which experienced its own 911 failures yesterday, Intrado said the outage was the result of a problem with an unspecified service provider.</p>
<p>&#8220;On September 28, 2020, at 4:30pm MT, our 911 Service Provider observed conditions internal to their network that resulted in impacts to 911 call delivery,&#8221; reads a statement Intrado provided to county officials. &#8220;The impact was mitigated, and service was restored and confirmed to be functional by 5:47PM MT.  Our service provider is currently working to determine root cause.&#8221;</p>
<p>The service provider referenced in Intrado&#8217;s statement appears to be <a href="https://www.centurylink.com/wholesale/pcat/911.html" target="_blank" rel="noopener noreferrer">Lumen</a>, a communications firm and 911 provider that until very recently was known as <strong>CenturyLink Inc</strong>. A look at the company&#8217;s <a href="https://status.ctl.io/" target="_blank" rel="noopener noreferrer">status page</a> indicates multiple Lumen systems experienced total or partial service disruptions on Monday, including its <a href="https://www.ctl.io/vpn/" target="_blank" rel="noopener noreferrer">private</a> and <a href="https://www.ctl.io/product-overview/#networking" target="_blank" rel="noopener noreferrer">internal cloud networks</a> and its <a href="https://www.ctl.io/product-overview/" target="_blank" rel="noopener noreferrer">control systems network</a>.</p>
<div id="attachment_53137" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/a72e6b7f.Lumen-status.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/Lumen-status.png"><img aria-describedby="caption-attachment-53137" loading="lazy" class="wp-image-53137" src="media/a72e6b7f.Lumen-status.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/Lumen-status.png" alt="" width="598" height="297" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/09/Lumen-status.png 1379w, https://krebsonsecurity.com/wp-content/uploads/2020/09/Lumen-status-768x381.png 768w" sizes="(max-width: 598px) 100vw, 598px" /></a><p id="caption-attachment-53137" class="wp-caption-text">Lumen&#8217;s status page indicates the company&#8217;s private and internal cloud and control system networks had outages or service disruptions on Monday.</p></div>
<p>In a statement provided to KrebsOnSecurity, Lumen blamed the issue on Intrado.</p>
<p style="font-weight: 400;">&#8220;At approximately 4:30 p.m. MT, some Lumen customers were affected by a vendor partner event that impacted 911 services in AZ, CO, NC, ND, MN, SD, and UT,&#8221; the statement reads. &#8220;Service was restored in less than an hour and all 911 traffic is routing properly at this time. The vendor partner is in the process of investigating the event.&#8221;</p>
<p>It may be no accident that both of these companies are now operating under new names, as this would hardly be the first time a problem between the two of them has disrupted 911 access for a large number of Americans.<span id="more-53121"></span></p>
<p>In 2019, Intrado/West and CenturyLink agreed to pay $575,000 to settle an investigation by the <strong>Federal Communications Commission</strong> (FCC) into <a href="https://www.fcc.gov/document/companies-agree-pay-575000-multi-state-911-outage-aug-2018" target="_blank" rel="noopener noreferrer">an Aug. 2018 outage</a> that lasted 65 minutes. The FCC found that incident was the result of a West Safety technician bungling a configuration change to the company&#8217;s 911 routing network.</p>
<p>On April 6, 2014, some 11 million people across the United States were disconnected from 911 services for eight hours thanks to an &#8220;entirely preventable&#8221; software error tied to Intrado&#8217;s systems. The incident affected 81 call dispatch centers, rendering emergency services inoperable in all of Washington and parts of North Carolina, South Carolina, Pennsylvania, California, Minnesota and Florida.</p>
<p>According to <a href="https://www.washingtonpost.com/news/the-switch/wp/2014/10/20/how-a-dumb-software-glitch-kept-6600-calls-from-getting-to-911/" target="_blank" rel="noopener noreferrer">a 2014 Washington Post story</a> about a subsequent investigation and <a href="https://www.fcc.gov/document/april-2014-multistate-911-outage-report" target="_blank" rel="noopener noreferrer">report</a> released by the FCC, that issue involved a problem with the way Intrado&#8217;s automated system assigns a unique identifying code to each incoming call before passing it on to the appropriate &#8220;public safety answering point,&#8221; or <a href="https://en.wikipedia.org/wiki/Public_safety_answering_point" target="_blank" rel="noopener noreferrer">PSAP</a>.</p>
<p>&#8220;On April 9, the software responsible for assigning the codes maxed out at a pre-set limit,&#8221; The Post explained. &#8220;The counter literally stopped counting at 40 million calls. As a result, the routing system stopped accepting new calls, leading to a bottleneck and a series of cascading failures elsewhere in the 911 infrastructure.&#8221;</p>
<p>Compounding the length of the 2014 outage, the FCC found, was that the Intrado server responsible for categorizing and keeping track of service interruptions classified them as &#8220;low level&#8221; incidents that were never flagged for manual review by human beings.</p>
<p>The FCC ultimately fined Intrado and CenturyLink $17.4 million for the multi-state 2014 outage. An FCC spokesperson declined to comment on Monday&#8217;s outage, but said the agency was investigating the incident.</p>


feed_id: https://krebsonsecurity.com/?p=53169
title: Ransomware Victims That Pay Up Could Incur Steep Fines from Uncle Sam
uri: Ransomware-Victims-That-Pay-Up-Could-Incur-Steep-Fines-from-Uncle-Sam
url:
https://krebsonsecurity.com/2020/10/ransomware-victims-that-pay-up-could-incur-steep-fines-from-uncle-sam/

content:
<p>Companies victimized by ransomware and firms that facilitate negotiations with ransomware extortionists could face steep fines from the U.S. federal government if the crooks who profit from the attack are already under economic sanctions, the <strong>Treasury Department</strong> warned today.</p>
<div id="attachment_53174" style="width: 606px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53174" loading="lazy" class=" wp-image-53174" src="media/42f96b60.treasury.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/treasury.png" alt="" width="596" height="397" /><p id="caption-attachment-53174" class="wp-caption-text">Image: Shutterstock</p></div>
<p>In <a href="media/d9db80d1.ofac_ransomware_advisory_10012020_1.pdf" data-original-source="https://home.treasury.gov/system/files/126/ofac_ransomware_advisory_10012020_1.pdf" target="_blank" rel="noopener noreferrer">its advisory</a> (PDF), the Treasury&#8217;s <strong>Office of Foreign Assets Control</strong> (OFAC) said &#8220;companies that facilitate ransomware payments to cyber actors on behalf of victims, including financial institutions, cyber insurance firms, and companies involved in digital forensics and incident response, not only encourage future ransomware payment demands but also may risk violating OFAC regulations.&#8221;</p>
<p>As financial losses from cybercrime activity and ransomware attacks in particular have skyrocketed in recent years, the Treasury Department has imposed economic sanctions on several cybercriminals and cybercrime groups, effectively freezing all property and interests of these persons (subject to U.S. jurisdiction) and making it a crime to transact with them.</p>
<p>A number of those sanctioned have been closely tied with ransomware and malware attacks, including the <a href="https://home.treasury.gov/news/press-releases/sm774" target="_blank" rel="noopener noreferrer">North Korean Lazarus Group</a>; two Iranians thought to be tied to the <a href="https://home.treasury.gov/news/press-releases/sm556" target="_blank" rel="noopener noreferrer">SamSam ransomware attacks</a>; <a href="https://krebsonsecurity.com/2015/08/inside-the-100m-business-club-crime-gang/" target="_blank" rel="noopener noreferrer">Evgeniy Bogachev</a>, the developer of <strong>Cryptolocker</strong>; and <a href="https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/" target="_blank" rel="noopener noreferrer">Evil Corp</a>, a Russian cybercriminal syndicate that has used malware to extract more than $100 million from victim businesses.</p>
<p>Those that run afoul of OFAC sanctions without a special dispensation or &#8220;license&#8221; from Treasury can face several legal repercussions, including fines of up to $20 million.<span id="more-53169"></span></p>
<p>The <strong>Federal Bureau of Investigation</strong> (FBI) and other law enforcement agencies have tried to discourage businesses hit by ransomware from paying their extortionists, noting that doing so only helps bankroll further attacks.</p>
<p>But in practice, a fair number of victims find paying up is the fastest way to resume business as usual. In addition, insurance providers often help facilitate the payments because the amount demanded ends up being less than what the insurer might have to pay to cover the cost of the affected business being sidelined for days or weeks at a time.</p>
<p>While it may seem unlikely that companies victimized by ransomware might somehow be able to know whether their extortionists are currently being sanctioned by the U.S. government, they still can be fined either way, said <strong>Ginger Faulk</strong>, a partner in the Washington, D.C. office of the law firm <a href="https://us.eversheds-sutherland.com/mobile/People/Ginger-T-Faulk" target="_blank" rel="noopener noreferrer">Eversheds Sutherland</a>.</p>
<p>Faulk said OFAC may impose civil penalties for sanctions violations based on &#8220;strict liability,&#8221; meaning that a person subject to U.S. jurisdiction may be held civilly liable <em>even if it did not know or have reason to know it was engaging in a transaction with a person that is prohibited under sanctions laws and regulations administered by OFAC.</em></p>
<p>&#8220;In other words, in order to be held liable as a civil (administrative) matter (as opposed to criminal), no mens rea or even &#8216;reason to know&#8217; that the person is sanctioned is necessary under OFAC regulations,&#8221; Faulk said.</p>
<p>But<strong> Fabian Wosar</strong>, chief technology officer at computer security firm <a href="https://www.emsisoft.com" target="_blank" rel="noopener noreferrer">Emsisoft</a>, said Treasury&#8217;s policies here are nothing new, and that they mainly constitute a warning for individual victim firms who may not already be working with law enforcement and/or third-party security firms.</p>
<p>Wosar said companies that help ransomware victims negotiate lower payments and facilitate the financial exchange are already aware of the legal risks from OFAC violations, and will generally refuse clients who get hit by certain ransomware strains.</p>
<p>&#8220;In my experience, OFAC and cyber insurance with their contracted negotiators are in constant communication,&#8221; he said. &#8220;There are often even clearing processes in place to ascertain the risk of certain payments violating OFAC.&#8221;</p>
<p>Along those lines, OFAC said the degree of a person/company’s awareness of the conduct at issue is a factor the agency may consider in assessing civil penalties. OFAC said it would consider &#8220;a company’s self-initiated, timely, and complete report of a ransomware attack to law enforcement to be a significant mitigating factor in determining an appropriate enforcement outcome if the situation is later determined to have a sanctions nexus.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=53197
title: Attacks Aimed at Disrupting the Trickbot Botnet
uri: Attacks-Aimed-at-Disrupting-the-Trickbot-Botnet
url: https://krebsonsecurity.com/2020/10/attacks-aimed-at-disrupting-the-trickbot-botnet/
content:
<p>Over the past 10 days, someone has been launching a series of coordinated attacks designed to disrupt <strong>Trickbot</strong>, an enormous collection of more than two million malware-infected Windows PCs that are constantly being harvested for financial data and are often used as the entry point for deploying ransomware within compromised organizations.</p>
<div id="attachment_53200" style="width: 264px" class="wp-caption alignright"><a class="lightbox" href="media/1012535c.trickbotupdate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/trickbotupdate.png"><img aria-describedby="caption-attachment-53200" loading="lazy" class="wp-image-53200" src="media/1012535c.trickbotupdate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/trickbotupdate.png" alt="" width="254" height="288" /></a><p id="caption-attachment-53200" class="wp-caption-text">A text snippet from one of the bogus Trickbot configuration updates. Source: Intel 471</p></div>
<p>On Sept. 22, someone pushed out a new configuration file to Windows computers currently infected with Trickbot. The crooks running the Trickbot botnet typically use these config files to pass new instructions to their fleet of infected PCs, such as the Internet address where hacked systems should download new updates to the malware.</p>
<p>But the new configuration file pushed on Sept. 22 told all systems infected with Trickbot that their new malware control server had the address 127.0.0.1, which is a &#8220;localhost&#8221; address that is not reachable over the public Internet, according to an analysis by cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener noreferrer">Intel 471</a>.</p>
<p>It&#8217;s not known how many Trickbot-infected systems received the phony update, but it seems clear this wasn&#8217;t just a mistake by Trickbot&#8217;s overlords. Intel 471 found that it happened yet again on Oct. 1, suggesting someone with access to the inner workings of the botnet was trying to disrupt its operations.</p>
<p>&#8220;Shortly after the bogus configs were pushed out, all Trickbot controllers stopped responding correctly to bot requests,&#8221; Intel 471 wrote in a note to its customers. &#8220;This possibly means central Trickbot controller infrastructure was disrupted. The close timing of both events suggested an intentional disruption of Trickbot botnet operations.&#8221;</p>
<p>Intel 471 CEO <strong>Mark Arena</strong> said it&#8217;s anyone&#8217;s guess at this point who is responsible.</p>
<p>&#8220;Obviously, someone is trying to attack Trickbot,&#8221; Arena said. &#8220;<span class="pullquote pqleft">It could be someone in the security research community, a government, a disgruntled insider, or a rival cybercrime group. We just don&#8217;t know at this point.</span>&#8221;</p>
<p>Arena said it&#8217;s unclear how successful these bogus configuration file updates will be given that the Trickbot authors built a fail-safe recovery system into their malware. Specifically, Trickbot has a backup control mechanism: A domain name registered on EmerDNS, a decentralized domain name system.</p>
<p>&#8220;This domain should still be in control of the Trickbot operators and could potentially be used to recover bots,&#8221; Intel 471 wrote.</p>
<p>But whoever is screwing with the Trickbot purveyors appears to have adopted a multi-pronged approach: Around the same time as the second bogus configuration file update was pushed on Oct. 1, someone stuffed the control networks that the Trickbot operators use to keep track of data on infected systems with millions of new records.</p>
<p><strong>Alex Holden</strong> is chief technology officer and founder of <a href="https://www.holdsecurity.com" target="_blank" rel="noopener noreferrer">Hold Security</a>, a Milwaukee-based cyber intelligence firm that helps recover stolen data. Holden said at the end of September Trickbot held passwords and financial data stolen from more than 2.7 million Windows PCs.</p>
<p>By October 1, Holden said, that number had magically grown to more than seven million.</p>
<p>&#8220;Someone is flooding the Trickbot system with fake data,&#8221; Holden said. &#8220;Whoever is doing this is generating records that include machine names indicating these are infected systems in a broad range of organizations, including the Department of Defense, U.S. Bank, JP Morgan Chase, PNC and Citigroup, to name a few.&#8221;<span id="more-53197"></span></p>
<p>Holden said the flood of new, apparently bogus, records appears to be an attempt by someone to dilute the Trickbot database and confuse or stymie the Trickbot operators. But so far, Holden said, the impact has been mainly to annoy and aggravate the criminals in charge of Trickbot.</p>
<p>&#8220;Our monitoring found at least one statement from one of the ransomware groups that relies on Trickbot saying this pisses them off, and they&#8217;re going to double the ransom they&#8217;re asking for from a victim,&#8221; Holden said. &#8220;We haven&#8217;t been able to confirm whether they actually followed through with that, but these attacks are definitely interfering with their business.&#8221;</p>
<p>Intel 471&#8217;s Arena said this could be part of an ongoing campaign to dismantle or wrest control over the Trickbot botnet. Such an effort would hardly be unprecedented. In 2014, for example, U.S. and international law enforcement agencies teamed up with multiple security firms and private researchers <a href="https://krebsonsecurity.com/2014/06/operation-tovar-targets-gameover-zeus-botnet-cryptolocker-scourge/" target="_blank" rel="noopener noreferrer">to commandeer the Gameover Zeus Botnet</a>, a particularly aggressive and sophisticated malware strain that had enslaved up to 1 million Windows PCs globally.</p>
<p>Trickbot would be an attractive target for such a takeover effort because it is widely viewed as a platform used to find potential ransomware victims. Intel 471 <a href="https://public.intel471.com/blog/understanding-the-relationship-between-emotet-ryuk-and-trickbot/" target="_blank" rel="noopener noreferrer">describes Trickbot</a> as &#8220;a malware-as-a-service platform that caters to a relatively small number of top-tier cybercriminals.&#8221;</p>
<p>One of the top ransomware gangs in operation today &#8212; which deploys ransomware strains known variously as &#8220;<strong>Ryuk</strong>&#8221; and &#8220;<strong>Conti</strong>,&#8221; is known to be closely associated with Trickbot infections. Both ransomware families have been used in some of the most damaging and costly malware incidents to date.</p>
<p>The <a href="https://www.bleepingcomputer.com/news/security/uhs-hospitals-hit-by-reported-country-wide-ryuk-ransomware-attack/" target="_blank" rel="noopener noreferrer">latest Ryuk victim</a> is <strong>Universal Health Services</strong> (UHS), a Fortune 500 hospital and healthcare services provider that operates more than 400 facilities in the U.S. and U.K.</p>
<p>On Sunday, Sept. 27, UHS shut down its computer systems at healthcare facilities across the United States in a bid to stop the spread of the malware. The disruption has reportedly caused the affected hospitals to redirect ambulances and relocate patients in need of surgery to other nearby hospitals.</p>


feed_id: https://krebsonsecurity.com/?p=53110
title: Promising Infusions of Cash, Fake Investor John Bernard Walked Away With $30M
uri: Promising-Infusions-of-Cash-Fake-Investor-John-Bernard-Walked-Away-Wi
url:
https://krebsonsecurity.com/2020/10/promising-infusions-of-cash-fake-investor-john-bernard-walked-away-with-30m/

content:
<p>September featured <a href="https://krebsonsecurity.com/2020/09/due-diligence-that-money-cant-buy/" target="_blank" rel="noopener noreferrer">two</a> <a href="https://krebsonsecurity.com/2020/09/who-is-tech-investor-john-bernard/" target="_blank" rel="noopener noreferrer">stories</a> on a phony tech investor named <strong>John Bernard</strong>, a pseudonym used by a convicted thief named <strong>John Clifton Davies</strong> who&#8217;s fleeced dozens of technology companies out of an estimated $30 million with the promise of lucrative investments. Those stories prompted a flood of tips from Davies&#8217; victims that paints a much clearer picture of this serial con man and his cohorts, including allegations of hacking, smuggling, bank fraud and murder.</p>
<p>KrebsOnSecurity interviewed more than a dozen of Davies&#8217; victims over the past five years, none of whom wished to be quoted here out of fear of reprisals from a man they say runs with mercenaries and has connections to organized crime.</p>
<p>As described in <a href="https://krebsonsecurity.com/2020/09/who-is-tech-investor-john-bernard/" target="_blank" rel="noopener noreferrer">Part II of this series</a>, John Bernard is in fact John Clifton Davies, a 59-year-old U.K. citizen who absconded from justice before being convicted on multiple counts of fraud in 2015. Prior to his conviction, Davies served 16 months in jail before being cleared of murdering his third wife on their honeymoon in India.</p>
<div id="attachment_53032" style="width: 605px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53032" loading="lazy" class=" wp-image-53032" src="media/c95e44e6.Bernard-sbs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/Bernard-sbs.png" alt="" width="595" height="315" /><p id="caption-attachment-53032" class="wp-caption-text">The scam artist John Bernard (left) in a recent Zoom call, and a photo of John Clifton Davies from 2015.</p></div>
<p>After eluding justice in the U.K., Davies reinvented himself as <a href="https://archive.vn/KKywg" target="_blank" rel="noopener noreferrer">The Private Office of John Bernard</a>, pretending to a be billionaire Swiss investor who made his fortunes in the dot-com boom 20 years ago and who was seeking investment opportunities.</p>
<p>In case after case, Bernard would promise to invest millions in tech startups, and then insist that companies pay tens of thousands of dollars worth of due diligence fees up front. However, the due diligence company he insisted on using — another Swiss firm called <a href="https://web.archive.org/web/20200917195829/https://www.insideknowledge.ch/" target="_blank" rel="noopener noreferrer">Inside Knowledge</a> — also was secretly owned by Bernard, who would invariably pull out of the deal after receiving the due diligence money.</p>
<p>Bernard found a constant stream of new marks by offering extraordinarily generous finders fees to investment brokers who could introduce him to companies seeking an infusion of cash. When it came time for companies to sign legal documents, Bernard&#8217;s victims interacted with a 40-something Inside Knowledge employee named &#8220;<strong>Katherine Miller</strong>,&#8221; who claimed to be his lawyer.</p>
<p>It turns out that Katherine Miller is a onetime Moldovan attorney who was previously known as <strong>Ecaterina &#8220;<a href="https://twitter.com/KatyaDudorenco" target="_blank" rel="noopener noreferrer">Katya</a>&#8221; Dudorenko</strong>. She is listed as a Romanian lawyer in the <strong>U.K. Companies House</strong> records for several companies tied to John Bernard, including <a href="https://beta.companieshouse.gov.uk/company/10128903" target="_blank" rel="noopener noreferrer">Inside Knowledge Solutions Ltd</a>., <a href="https://beta.companieshouse.gov.uk/officers/zZAT-9Bz8HEvH_AbO9E2ltrcRPg/appointments" target="_blank" rel="noopener noreferrer">Docklands Enterprise Ltd</a>., and <a href="https://beta.companieshouse.gov.uk/company/10223332" target="_blank" rel="noopener noreferrer">Secure Swiss Data Ltd</a> (more on Secure Swiss data in a moment).</p>
<p>Another of Bernard&#8217;s associates listed as a director at Docklands Enterprise Ltd. is <strong>Sergey Valentinov Pankov</strong>. This is notable because in 2018, <a href="https://www.mynewsdesk.com/uk/hm-revenue-customs-hmrc/pressreleases/cigarette-smuggling-couple-flee-before-trial-2598842" target="_blank" rel="noopener noreferrer">Pankov and Dudorenko were convicted of cigarette smuggling in the United Kingdom</a>.</p>
<div id="attachment_53190" style="width: 606px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53190" loading="lazy" class=" wp-image-53190" src="media/a41c13c5.dudorenko-pankov.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/dudorenko-pankov.png" alt="" width="596" height="334" /><p id="caption-attachment-53190" class="wp-caption-text">Sergey Pankov and Ecaterina Dudorenco, in undated photos. Source: Mynewsdesk.com</p></div>
<p>According to the <a href="https://www.reportingproject.net/underground/index.php?limitstart=5" target="_blank" rel="noopener noreferrer">Organized Crime and Corruption Reporting Project</a>, &#8220;illicit trafficking of tobacco is a multibillion-dollar business today, fueling organized crime and corruption [and] robbing governments of needed tax money. So profitable is the trade that tobacco is the world’s most widely smuggled legal substance. This booming business now stretches from counterfeiters in China and renegade factories in Russia to Indian reservations in New York and warlords in Pakistan and North Africa.&#8221;</p>
<p>Like their erstwhile boss Mr. Davies, both Pankov and Dudorenko disappeared before their convictions in the U.K. They were sentenced in absentia to two and a half years in prison.</p>
<p>Incidentally, Davies was detained by Ukrainian authorities in 2018, although he is not mentioned by name in <a href="https://translate.google.com/translate?depth=1&amp;hl=en&amp;ie=UTF8&amp;nv=1&amp;prev=_t&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.pravda.com.ua/news/2018/10/10/7194694/&amp;xid=17259,15700023,15700124,15700126,15700149,15700186,15700190,15700201,15700214" target="_blank" rel="noopener noreferrer">this story</a> from the Ukrainian daily <em>Pravda</em>. The story notes that the suspect moved to Kiev in 2014 <span class="">and lived in a rented apartment with his Ukrainian wife. </span><span id="more-53110"></span></p>
<p><span class="">John&#8217;s fourth wife, <strong>Iryna Davies</strong>, is listed as a director of <a href="https://beta.companieshouse.gov.uk/company/08737929/officers" target="_blank" rel="noopener noreferrer">one of the insolvency consulting businesses</a> in the U.K. that was part of John Davies&#8217; 2015 fraud conviction. Pravda reported that i</span><span class="">n order to confuse the Ukrainian police and hide from them, Mr. Davies constantly changed their place of residence.</span></p>
<div id="attachment_53214" style="width: 530px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53214" loading="lazy" class=" wp-image-53214" src="media/4d000bcb.davis-ukraine.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/davis-ukraine.png" alt="" width="520" height="643" /><p id="caption-attachment-53214" class="wp-caption-text">John Clifton Davies, a.k.a. John Bernard. Image: Ukrainian National Police.</p></div>
<div></div>
<div>
<p><span class="gmail-">The Pravda story says Ukrainian authorities were working with the U.K. government to secure Davies&#8217; extradition, but he appears to have slipped away once again. That&#8217;s according to one investment broker who&#8217;s been tracking Davies&#8217; trail of fraud since 2015.</span></p>
<p>According to that source &#8212; who we&#8217;ll call &#8220;Ben&#8221; &#8212; Inside Knowledge and The Private Office of John Bernard have fleeced dozens of companies out of nearly USD $30 million in due diligence fees over the years, with one company reportedly paying over $1 million.</p>
<p>Ben said he figured out that Bernard was Davies through a random occurrence. Ben said he&#8217;d been told by a reliable source that Bernard traveled everywhere in Kiev with several armed guards, and that his entourage rode in a convoy that escorted Davies&#8217; <a href="https://www.caranddriver.com/bentley" target="_blank" rel="noopener noreferrer">high-end Bentley</a>. Ben said Davies&#8217; crew was even able to stop traffic in the downtown area in what was described as a quasi military maneuver so that Davies&#8217; vehicle could proceed unobstructed (and presumably without someone following his car).</p>
<p>Ben said he&#8217;s spoken to several victims of Bernard who saw phony invoices for payments to be made to banks in Eastern Europe appear to come from people within their own organization shortly after cutting off contact with Bernard and his team.</p>
<p>While Ben allowed that these invoices could have come from another source, it&#8217;s worth noting that by virtue of participating in the due diligence process, the companies targeted by these schemes would have already given Bernard&#8217;s office detailed information about their finances, bank accounts and security processes.</p>
<p>In some cases, the victims had agreed to use Bernard&#8217;s <strong>Secure Swiss Data</strong> software and services to store documents for the due diligence process. Secure Swiss Data is one of several firms <a href="https://krebsonsecurity.com/wp-content/uploads/2020/10/secureswissdata-originalWHOIS2015.txt" target="_blank" rel="noopener noreferrer">founded by Davies/Inside Knowledge</a> and <a href="https://find-and-update.company-information.service.gov.uk/company/10223332/officers" target="_blank" rel="noopener noreferrer">run by Dudorenko</a>, and it advertised itself as a Swiss company that provides encrypted email and data storage services. In February 2020, Secure Swiss Data <a href="https://finance.yahoo.com/news/safeswiss-com-acquires-secure-swiss-110010835.html" target="_blank" rel="noopener noreferrer">was purchased in an “undisclosed multimillion buyout”</a> by <strong>SafeSwiss Secure Communication AG</strong>.</p>
</div>
<p>Shortly after <a href="https://krebsonsecurity.com/2020/09/due-diligence-that-money-cant-buy/" target="_blank" rel="noopener noreferrer">the first story on John Bernard was published here</a>, virtually all of the employee profiles tied to Bernard’s office removed him from their work experience as listed on their LinkedIn resumes — or else deleted their profiles altogether. Also, John Bernard’s main website — <a href="https://web.archive.org/web/20200917102043/https://the-private-office.ch/" target="_blank" rel="noopener noreferrer">the-private-office.ch</a> — replaced the content on its homepage with a note saying it was closing up shop.</p>
<p>Incredibly, even after the first two stories ran, Bernard/Davies and his crew continued to ply their scam with companies that had already agreed to make due diligence payments, or that had made one or all of several installment payments.</p>
<p>One of those firms actually issued a press release in August saying it had been promised an infusion of millions in cash from John Bernard&#8217;s Private Office. They declined to be quoted here, and continue to hold onto hope that Mr. Bernard is not the crook that he plainly is.</p>


feed_id: https://krebsonsecurity.com/?p=53255
title: Amid an Embarrassment of Riches, Ransom Gangs Increasingly Outsource Their Work
uri: Amid-an-Embarrassment-of-Riches-Ransom-Gangs-Increasingly-Outsource-T
url:
https://krebsonsecurity.com/2020/10/amid-an-embarrassment-of-riches-ransom-gangs-increasingly-outsource-their-work/

content:
<p>There&#8217;s an old adage in information security: &#8220;Every company gets penetration tested, whether or not they pay someone for the pleasure.&#8221; Many organizations that do hire professionals to test their network security posture unfortunately tend to focus on fixing vulnerabilities hackers could use to break in. But judging from the proliferation of help-wanted ads for offensive pentesters in the cybercrime underground, today&#8217;s attackers have exactly zero trouble gaining that initial intrusion: The real challenge seems to be hiring enough people to help everyone profit from the access already gained.</p>
<p><img loading="lazy" class="aligncenter wp-image-53265" src="media/247201c5.doorajar.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/doorajar.png" alt="" width="590" height="393" /></p>
<p>One of the most common ways such access is monetized these days is through <a href="https://krebsonsecurity.com/category/ransomware/" target="_blank" rel="noopener noreferrer">ransomware</a>, which holds a victim&#8217;s data and/or computers hostage unless and until an extortion payment is made. But in most cases, there is a yawning gap of days, weeks or months between the initial intrusion and the deployment of ransomware within a victim organization.</p>
<p>That&#8217;s because it usually takes time and a good deal of effort for intruders to get from a single infected PC to seizing control over enough resources within the victim organization where it makes sense to launch the ransomware.</p>
<p>This includes pivoting from or converting a single compromised <strong>Microsoft Windows</strong> user account to an administrator account with greater privileges on the target network; the ability to sidestep and/or disable any security software; and gaining the access needed to disrupt or corrupt any data backup systems the victim firm may have.</p>
<p>Each day, millions of malware-laced emails are blasted out containing booby-trapped attachments. If the attachment is opened, the malicious document proceeds to quietly download additional malware and hacking tools to the victim machine (<a href="https://app.any.run/tasks/3363fde4-111b-4aaa-b73d-e4144433c284/" target="_blank" rel="noopener noreferrer">here&#8217;s one video example of a malicious Microsoft Office attachment</a> from the malware sandbox service <strong>any.run</strong>). From there, the infected system will report home to a malware control server operated by the spammers who sent the missive.</p>
<p>At that point, control over the victim machine may be transferred or sold multiple times between different cybercriminals who specialize in exploiting such access. These folks are very often contractors who work with established ransomware groups, and who are paid a set percentage of any eventual ransom payments made by a victim company.</p>
<h4>THE DOCTOR IS IN</h4>
<p>Enter subcontractors like &#8220;<strong>Dr. Samuil</strong>,&#8221; a cybercriminal who has maintained a presence on more than a dozen top Russian-language cybercrime forums over the past 15 years. In a series of recent advertisements, Dr. Samuil says he&#8217;s eagerly hiring experienced people who are familiar with tools used by legitimate pentesters for exploiting access once inside of a target company &#8212; specifically, post-exploit frameworks like the closely-guarded <a href="https://www.bleepingcomputer.com/news/security/threat-actors-use-older-cobalt-strike-versions-to-blend-in/" target="_blank" rel="noopener noreferrer">Cobalt Strike</a>.</p>
<p>&#8220;You will be regularly provided select accesses which were audited (these are about 10-15 accesses out of 100) and are worth a try,&#8221; Dr. Samuil wrote in one such help-wanted ad. &#8220;This helps everyone involved to save time. We also have private software that bypasses protection and provides for smooth performance.&#8221;</p>
<p>From other classified ads he posted in August and September 2020, it seems clear Dr. Samuil&#8217;s team has some kind of privileged access to financial data on targeted companies that gives them a better idea of how much cash the victim firm may have on hand to pay a ransom demand. To wit:</p>
<blockquote><p>&#8220;There is huge insider information on the companies which we target, including information if there are tape drives and clouds (for example, Datto that is built to last, etc.), which significantly affects the scale of the conversion rate.</p>
<p>Requirements:<br />
&#8211; experience with cloud storage, ESXi.<br />
&#8211; experience with Active Directory.<br />
&#8211; privilege escalation on accounts with limited rights.</p>
<p>* Serious level of insider information on the companies with which we work. There are proofs of large payments, but only for verified LEADs.<br />
* There is also a private MEGA INSIDE , which I will not write about here in public, and it is only for experienced LEADs with their teams.<br />
* We do not look at REVENUE / NET INCOME / Accountant reports, this is our MEGA INSIDE, in which we know exactly how much to confidently squeeze to the maximum in total.</p></blockquote>
<p>According to cybersecurity firm <a href="https://www.intel471.com" target="_blank" rel="noopener noreferrer">Intel 471</a>, Dr. Samuil&#8217;s ad is hardly unique, and there are several other seasoned cybercriminals who are customers of popular ransomware-as-a-service offerings that are hiring sub-contractors to farm out some of the grunt work.</p>
<p>&#8220;Within the cybercriminal underground, compromised accesses to organizations are readily bought, sold and traded,&#8221; Intel 471 CEO <strong>Mark Arena</strong> said. &#8220;A number of security professionals have previously sought to downplay the business impact cybercriminals can have to their organizations.&#8221;</p>
<p>&#8220;But because of the rapidly growing market for compromised accesses and the fact that <a href="https://public.intel471.com/blog/partners-in-crime-north-koreans-and-elite-russian-speaking-cybercriminals/" target="_blank" rel="noopener noreferrer">these could be sold to anyone</a>, organizations need to focus more on efforts to understand, detect and quickly respond to network compromises,&#8221; Arena continued. &#8220;That covers faster patching of the vulnerabilities that matter, ongoing detection and monitoring for criminal malware, and understanding the malware you are seeing in your environment, how it got there, and what it has or could have dropped subsequently.&#8221;<span id="more-53255"></span></p>
<h4>WHO IS DR. SAMUIL?</h4>
<p>In conducting research for this story, KrebsOnSecurity learned that Dr. Samuil is the handle used by the proprietor of <strong><a href="https://twitter.com/multivpn/" target="_blank" rel="noopener noreferrer">multi-vpn[.]biz</a>,</strong> a long-running virtual private networking (VPN) service marketed to cybercriminals who are looking to anonymize and encrypt their online traffic by bouncing it through multiple servers around the globe.</p>
<div id="attachment_53282" style="width: 607px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53282" loading="lazy" class=" wp-image-53282" src="media/1ae9b99d.multivpn-ad.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/multivpn-ad.png" alt="" width="597" height="330" /><p id="caption-attachment-53282" class="wp-caption-text">Have a Coke and a Molotov cocktail. Image: twitter.com/multivpn</p></div>
<p>MultiVPN is the product of a company called <strong>Ruskod Networks Solutions</strong> (a.k.a. <strong>ruskod[.]net</strong>), which variously claims to be based in the offshore company havens of Belize and the Seychelles, but which appears to be run by a guy living in Russia.</p>
<p>The domain registration records for ruskod[.]net were long ago hidden by WHOIS privacy services. But according to <strong>Domaintools.com</strong> [an advertiser on this site], the original WHOIS records for the site from the mid-2000s indicate the domain was registered by a <strong>Sergey Rakityansky</strong>.</p>
<p>This is not an uncommon name in Russia or in many surrounding Eastern European nations. But a former business partner of MultiVPN who had a rather public falling out with Dr. Samuil in the cybercrime underground told KrebsOnSecurity that Rakityansky is indeed Dr. Samuil&#8217;s real surname, and that he is a 32- or 33-year-old currently living in Bryansk, a city located approximately 200 miles southwest of Moscow.</p>
<p>Neither Dr. Samuil nor MultiVPN have responded to requests for comment.</p>


feed_id: https://krebsonsecurity.com/?p=53307
title: Report: U.S. Cyber Command Behind Trickbot Tricks
uri: Report-U-S-Cyber-Command-Behind-Trickbot-Tricks
url: https://krebsonsecurity.com/2020/10/report-u-s-cyber-command-behind-trickbot-tricks/
content:
<p>A week ago, KrebsOnSecurity <a href="https://krebsonsecurity.com/2020/10/attacks-aimed-at-disrupting-the-trickbot-botnet/" target="_blank" rel="noopener noreferrer">broke the news</a> that someone was attempting to disrupt the <strong>Trickbot botnet</strong>, a malware crime machine that has infected millions of computers and is often used to spread ransomware. A new report Friday says the coordinated attack was part of an operation carried out by the U.S. military&#8217;s <strong>Cyber Command</strong>.</p>
<div id="attachment_53313" style="width: 600px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53313" loading="lazy" class=" wp-image-53313" src="media/c6a4c86e.UScybercommand.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/UScybercommand.png" alt="" width="590" height="451" /><p id="caption-attachment-53313" class="wp-caption-text">Image: Shuttstock.</p></div>
<p>On October 2, KrebsOnSecurity reported that twice in the preceding ten days, an unknown entity that had inside access to the Trickbot botnet sent all infected systems a command telling them to disconnect themselves from the Internet servers the Trickbot overlords used to control compromised <strong>Microsoft Windows</strong> computers.</p>
<p>On top of that, someone had stuffed millions of bogus records about new victims into the Trickbot database &#8212; apparently to confuse or stymie the botnet&#8217;s operators.</p>
<p>In a story published Oct. 9, <em>The Washington Post</em> <a href="https://www.washingtonpost.com/national-security/cyber-command-trickbot-disrupt/2020/10/09/19587aae-0a32-11eb-a166-dc429b380d10_story.html" target="_blank" rel="noopener noreferrer">reported</a> that four U.S. officials who spoke on condition of anonymity said the Trickbot disruption was the work of <a href="https://en.wikipedia.org/wiki/United_States_Cyber_Command" target="_blank" rel="noopener noreferrer">U.S. Cyber Command</a>, a branch of the Department of Defense headed by the director of the <strong>National Security Agency</strong> (NSA).</p>
<p>The Post report suggested the action was a bid to prevent Trickbot from being used to somehow interfere with the upcoming presidential election, noting that Cyber Command was instrumental in disrupting the Internet access of Russian online troll farms during the 2018 midterm elections.</p>
<p>The Post said U.S. officials recognized their operation would not permanently dismantle Trickbot, describing it rather as &#8220;one way to distract them for at least a while as they seek to restore their operations.&#8221;<span id="more-53307"></span></p>
<p><strong>Alex Holden</strong>, chief information security officer and president of Milwaukee-based <a href="https://www.holdsecurity.com" target="_blank" rel="noopener noreferrer">Hold Security</a>, has been monitoring Trickbot activity before and after the 10-day operation. Holden said while the attack on Trickbot appears to have cut its operators off from a large number of victim computers, the bad guys still have passwords, financial data and reams of other sensitive information stolen from more than 2.7 million systems around the world.</p>
<p>Holden said the Trickbot operators have begun rebuilding their botnet, and continue to engage in deploying ransomware at new targets.</p>
<p>&#8220;They are running normally and their ransomware operations are pretty much back in full swing,&#8221; Holden said. &#8220;The are not slowing down because they still have a great deal of stolen data.&#8221;</p>
<p>Holden added that since news of the disruption first broke a week ago, the Russian-speaking cybercriminals behind Trickbot have been discussing how to recoup their losses, and have been toying with the idea of massively increasing the amount of money demanded from future ransomware victims.</p>
<p>&#8220;There is a conversation happening in the back channels,&#8221; Holden said. &#8220;Normally, they will ask for [a ransom amount] that is something like 10 percent of the victim company&#8217;s annual revenues. Now, some of the guys involved are talking about increasing that to 100 percent or 150 percent.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=53319
title: Microsoft Uses Trademark Law to Disrupt Trickbot Botnet
uri: Microsoft-Uses-Trademark-Law-to-Disrupt-Trickbot-Botnet
url: https://krebsonsecurity.com/2020/10/microsoft-uses-copyright-law-to-disrupt-trickbot-botnet/
content:
<p><strong>Microsoft Corp.</strong> has executed a coordinated legal sneak attack in a bid to disrupt the malware-as-a-service botnet <strong>Trickbot</strong>, a global menace that has infected millions of computers and is used to spread ransomware. A court in Virginia granted Microsoft control over many Internet servers Trickbot uses to plunder infected systems, based on novel claims that the crime machine abused the software giant&#8217;s trademarks. However, it appears the operation has not completely disabled the botnet.</p>
<div id="attachment_53335" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/7ca909a9.trickbotemail.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/trickbotemail.png"><img aria-describedby="caption-attachment-53335" loading="lazy" class="wp-image-53335" src="media/7ca909a9.trickbotemail.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/trickbotemail.png" alt="" width="596" height="480" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/10/trickbotemail.png 950w, https://krebsonsecurity.com/wp-content/uploads/2020/10/trickbotemail-768x618.png 768w" sizes="(max-width: 596px) 100vw, 596px" /></a><p id="caption-attachment-53335" class="wp-caption-text">A spam email containing a Trickbot-infected attachment that was sent earlier this year. Image: Microsoft.</p></div>
<p>&#8220;We disrupted Trickbot through a court order we obtained as well as technical action we executed in partnership with telecommunications providers around the world,&#8221; wrote <strong>Tom Burt</strong>, corporate vice president of customer security and trust at Microsoft, in a blog post this morning about the legal maneuver. &#8220;We have now cut off key infrastructure so those operating Trickbot will no longer be able to initiate new infections or activate ransomware already dropped into computer systems.&#8221;</p>
<p>Microsoft&#8217;s action comes just days after the U.S. military&#8217;s <strong>Cyber Command</strong> <a href="https://krebsonsecurity.com/2020/10/report-u-s-cyber-command-behind-trickbot-tricks/" target="_blank" rel="noopener noreferrer">carried out its own attack</a> that sent all infected Trickbot systems a command telling them to disconnect themselves from the Internet servers the Trickbot overlords used to control them. The roughly 10-day operation by Cyber Command also stuffed millions of bogus records about new victims into the Trickbot database in a bid to confuse the botnet&#8217;s operators.</p>
<p>In legal filings, Microsoft argued that Trickbot irreparably harms the company &#8220;by damaging its reputation, brands, and customer goodwill. Defendants physically alter and corrupt Microsoft products such as the Microsoft Windows products. Once infected, altered and controlled by Trickbot, the Windows operating system ceases to operate normally and becomes tools for Defendants to conduct their theft.&#8221;</p>
<p>From the civil complaint Microsoft filed on October 6 with the <strong>U.S. District Court for the Eastern District of Virginia</strong>:</p>
<blockquote><p>&#8220;However, they still bear the Microsoft and Windows trademarks. This is obviously meant to and does mislead Microsoft&#8217;s customers, and it causes extreme damage to Microsoft&#8217;s brands and trademarks.&#8221;</p>
<p>&#8220;Users subject to the negative effects of these malicious applications incorrectly believe that Microsoft and Windows are the source of their computing device problems. There is great risk that users may attribute this problem to Microsoft and associate these problems with Microsoft&#8217;s Windows products, thereby diluting and tarnishing the value of the Microsoft and Windows trademarks and brands.&#8221;</p></blockquote>
<p>Microsoft said it will leverage the seized Trickbot servers to identify and assist Windows users impacted by the Trickbot malware in cleaning the malware off of their systems.</p>
<p>Trickbot has been used to steal passwords from millions of infected computers, and reportedly to hijack access to well more than 250 million email accounts from which new copies of the malware are sent to the victim&#8217;s contacts.</p>
<p>Trickbot&#8217;s malware-as-a-service feature has made it a reliable vehicle for deploying various strains of ransomware, locking up infected systems on a corporate network unless and until the company agrees to make an extortion payment.</p>
<p>A particularly destructive ransomware strain that is closely associated with Trickbot &#8212; known as &#8220;Ryuk&#8221; or &#8220;Conti&#8221; &#8212; has been responsible for costly attacks on countless organizations over the past year, including healthcare providers, medical research centers and hospitals.</p>
<p>One recent Ryuk victim is Universal Health Services (UHS), a Fortune 500 hospital and healthcare services provider that operates more than 400 facilities in the U.S. and U.K.<span id="more-53319"></span></p>
<p>On Sunday, Sept. 27, UHS shut down its computer systems at healthcare facilities across the United States in a bid to stop the spread of the malware. The disruption caused some of the affected hospitals to redirect ambulances and relocate patients in need of surgery to other nearby hospitals.</p>
<p>Microsoft said it did not expect its action to permanently disrupt Trickbot, noting that the crooks behind the botnet will likely make efforts to revive their operations. But so far it&#8217;s not clear whether Microsoft succeeded in commandeering all of Trickbot&#8217;s control servers, or when exactly the coordinated seizure of those servers occurred.</p>
<p>As the company noted in its legal filings, the set of Internet address used as Trickbot controllers is dynamic, making attempts to disable the botnet more challenging.</p>
<p>Indeed, according to real-time information posted by <a href="https://feodotracker.abuse.ch/browse/" target="_blank" rel="noopener noreferrer">Feodo Tracker</a>, a Swiss security site that tracks Internet servers used as controllers for Trickbot and other botnets, nearly two dozen Trickbot control servers &#8212; some of which first went active at beginning of this month &#8212; are still live and responding to requests at the time of this publication.</p>
<div id="attachment_53334" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/b18f9e5a.feodo-trick.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/feodo-trick.png"><img aria-describedby="caption-attachment-53334" loading="lazy" class="wp-image-53334" src="media/b18f9e5a.feodo-trick.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/feodo-trick.png" alt="" width="597" height="454" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/10/feodo-trick.png 1118w, https://krebsonsecurity.com/wp-content/uploads/2020/10/feodo-trick-768x584.png 768w" sizes="(max-width: 597px) 100vw, 597px" /></a><p id="caption-attachment-53334" class="wp-caption-text">Trickbot control servers that are currently online. Source: Feodotracker.abuse.ch</p></div>


feed_id: https://krebsonsecurity.com/?p=53321
title: Microsoft Patch Tuesday, October 2020 Edition
uri: Microsoft-Patch-Tuesday-October-2020-Edition
url: https://krebsonsecurity.com/2020/10/microsoft-patch-tuesday-october-2020-edition/
content:
<p>It&#8217;s Cybersecurity Awareness Month! In keeping with that theme, if you (ab)use <strong>Microsoft Windows</strong> computers you should be aware the company shipped a bevy of software updates today to fix at least 87 security problems in Windows and programs that run on top of the operating system. That means it&#8217;s once again time to backup and patch up.</p>
<p><img loading="lazy" class="aligncenter wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="589" height="432" /></p>
<p>Eleven of the vulnerabilities earned Microsoft&#8217;s most-dire &#8220;critical&#8221; rating, which means bad guys or malware could use them to gain complete control over an unpatched system with little or no help from users.</p>
<p>Worst in terms of outright scariness is probably <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16898" target="_blank" rel="noopener noreferrer">CVE-2020-16898</a>, which is a nasty bug in <strong>Windows 10</strong> and <strong>Windows Server 2019</strong> that could be abused to install malware just by sending a malformed packet of data at a vulnerable system. CVE-2020-16898 earned a <a href="https://www.first.org/cvss/" target="_blank" rel="noopener noreferrer">CVSS Score</a> of 9.8 (10 is the most awful).</p>
<p>Security vendor <strong>McAfee</strong> has dubbed the flaw &#8220;<strong>Bad Neighbor</strong>,&#8221; and in <a href="https://www.mcafee.com/blogs/other-blogs/mcafee-labs/cve-2020-16898-bad-neighbor/" target="_blank" rel="noopener noreferrer">a blog post</a> about it said a proof-of-concept exploit shared by Microsoft with its partners appears to be &#8220;both extremely simple and perfectly reliable,&#8221; noting that this sucker is imminently &#8220;wormable&#8221; &#8212; i.e. capable of being weaponized into a threat that spreads very quickly within networks.</p>
<p>&#8220;It results in an immediate BSOD (Blue Screen of Death), but more so, indicates the likelihood of exploitation for those who can manage to bypass Windows 10 and Windows Server 2019 mitigations,&#8221; McAfee&#8217;s <strong>Steve Povolny</strong> wrote. &#8220;The effects of an exploit that would grant remote code execution would be widespread and highly impactful, as this type of bug could be made wormable.&#8221;</p>
<p><strong>Trend Micro&#8217;s Zero Day Initiative</strong> (ZDI) calls special attention to another critical bug quashed in this month&#8217;s patch batch: <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16947" target="_blank" rel="noopener noreferrer">CVE-2020-16947</a>, which is a problem with <strong>Microsoft Outlook</strong> that could result in malware being loaded onto a system<em> just by previewing a malicious email in Outlook</em>.</p>
<p>&#8220;The Preview Pane is an attack vector here, so you don’t even need to open the mail to be impacted,&#8221; said ZDI&#8217;s<strong> Dustin Childs</strong>.</p>
<p>While there don&#8217;t appear to be any zero-day flaws in October&#8217;s release from Microsoft, <strong>Todd Schell</strong> from <strong>Ivanti</strong> points out that a half-dozen of these flaws were publicly disclosed prior to today, meaning bad guys have jump start on being able to research and engineer working exploits.<span id="more-53321"></span></p>
<p>Other patches released today tackle problems in <strong>Exchange Server</strong>, <strong>Visual Studio</strong>, <strong>.NET Framework</strong>, and a whole mess of other core Windows components.</p>
<p>For any of you who&#8217;ve been pining for a <strong>Flash Player</strong> patch from <strong>Adobe</strong>, your days of waiting are over. After several months of depriving us of Flash fixes, Adobe&#8217;s shipped an update that fixes a single &#8212; <a href="https://helpx.adobe.com/security/products/flash-player/apsb20-58.html" target="_blank" rel="noopener noreferrer">albeit critical</a> &#8212; flaw in the program that crooks could use to install bad stuff on your computer just by getting you to visit a hacked or malicious website.</p>
<p><strong>Chrome</strong> and <strong>Firefox</strong> both now disable Flash by default, and Chrome and <strong>IE/Edge</strong> auto-update the program when new security updates are available. Mercifully, Adobe is slated to retire Flash Player later this year, and Microsoft has said it plans to ship updates at the end of the year that will remove Flash from Windows machines.</p>
<p>It&#8217;s a good idea for Windows users to get in the habit of updating at least once a month, but for regular users (read: not enterprises) it&#8217;s usually safe to wait a few days until after the patches are released, so that Microsoft has time to iron out any chinks in the new armor.</p>
<p>But before you update, please make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates even have known to erase or corrupt files.</p>
<p>So do yourself a favor and backup before installing any patches. Windows 10 even has <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">some built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, see <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">this guide</a>.</p>
<p>As always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips.</p>


feed_id: https://krebsonsecurity.com/?p=53358
title: Breach at Dickey’s BBQ Smokes 3M Cards
uri: Breach-at-Dickey-s-BBQ-Smokes-3M-Cards
url: https://krebsonsecurity.com/2020/10/breach-at-dickeys-bbq-smokes-3m-cards/
content:
<p>One of the digital underground&#8217;s most popular stores for peddling stolen credit card information began selling a batch of more than three million new card records this week. KrebsOnSecurity has learned the data was stolen in a lengthy data breach at more than 100 <strong>Dickey&#8217;s Barbeque Restaurant</strong> locations around the country.</p>
<div id="attachment_53359" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/6a0bb710.js-blazingsun.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/js-blazingsun.png"><img aria-describedby="caption-attachment-53359" loading="lazy" class="wp-image-53359" src="media/6a0bb710.js-blazingsun.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/js-blazingsun.png" alt="" width="596" height="508" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/10/js-blazingsun.png 971w, https://krebsonsecurity.com/wp-content/uploads/2020/10/js-blazingsun-768x654.png 768w" sizes="(max-width: 596px) 100vw, 596px" /></a><p id="caption-attachment-53359" class="wp-caption-text">An ad on the popular carding site Joker&#8217;s Stash for &#8220;BlazingSun,&#8221; which fraud experts have traced back to a card breach at Dickey&#8217;s BBQ.</p></div>
<p>On Monday, the carding bazaar Joker&#8217;s Stash debuted &#8220;<strong>BlazingSun</strong>,&#8221; a new batch of more than three million stolen card records, advertising &#8220;valid rates&#8221; of between 90-100 percent. This is typically an indicator that the breached merchant is either unaware of the compromise or has only just begun responding to it.</p>
<p>Multiple companies that track the sale in stolen payment card data say they have confirmed with card-issuing financial institutions that the accounts for sale in the BlazingSun batch have one common theme: All were used at various <a href="https://www.dickeys.com/" rel="noopener noreferrer" target="_blank">Dickey&#8217;s BBQ</a> locations over the past 13-15 months</p>
<p>KrebsOnSecurity first contacted Dallas-based Dickey&#8217;s on Oct. 13. Today, the company shared a statement saying it was aware of a possible payment card security incident at some of its eateries:</p>
<blockquote><p>&#8220;We received a report indicating that a payment card security incident may have occurred. We are taking this incident very seriously and immediately initiated our response protocol and an investigation is underway. We are currently focused on determining the locations affected and time frames involved. We are utilizing the experience of third parties who have helped other restaurants address similar issues and also working with the FBI and payment card networks. We understand that payment card network rules generally provide that individuals who timely report unauthorized charges to the bank that issued their card are not responsible for those charges.&#8221;</p></blockquote>
<p>The confirmations came from Miami-based <a href="https://www.q6cyber.com" target="_blank" rel="noopener noreferrer">Q6 Cyber</a> and <a href="https://www.geminiadvisory.io" target="_blank" rel="noopener noreferrer">Gemini Advisory</a> in New York City.</p>
<p>Q6Cyber <strong>CEO Eli Dominitz</strong> said the breach appears to extend from May 2019 through September 2020. </p>
<p>&#8220;The financial institutions we&#8217;ve been working with have already seen a significant amount of fraud related to these cards,&#8221; Dominitz said. </p>
<p>Gemini says its data indicated some 156 Dickey&#8217;s locations across 30 states likely had payment systems compromised by card-stealing malware, with the highest exposure in California and Arizona. Gemini puts the exposure window between July 2019 and August 2020.</p>
<div id="attachment_53363" style="width: 608px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53363" loading="lazy" class=" wp-image-53363" src="media/17bc5603.pitsmoked.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/pitsmoked.png" alt="" width="598" height="354" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/10/pitsmoked.png 796w, https://krebsonsecurity.com/wp-content/uploads/2020/10/pitsmoked-768x454.png 768w" sizes="(max-width: 598px) 100vw, 598px" /><p id="caption-attachment-53363" class="wp-caption-text">&#8220;Low-and-slow&#8221; aptly describes the card breach at Dickie&#8217;s, which persisted for at least 13 months.</p></div>
<p>With the threat from ransomware attacks grabbing all the headlines, it may be tempting to assume plain old credit card thieves have moved on to more lucrative endeavors. Alas, cybercrime bazaars like Joker&#8217;s Stash have continued plying their trade, undeterred by a push from the credit card associations to encourage more merchants to install credit card readers that require more secure chip-based payment cards.</p>
<p>That&#8217;s because there are countless restaurant locations &#8212; usually franchise locations of an established eatery chain &#8212; that are left to decide for themselves whether and how quickly they should make the upgrades necessary to dip the chip versus swipe the stripe.</p>
<p>&#8220;Dickey&#8217;s operates on a franchise model, which often allows each location to dictate the type of point-of-sale (POS) device and processors that they utilize,&#8221; Gemini wrote in <a href="https://geminiadvisory.io/jokers-stash-breaches-dickeys/" rel="noopener noreferrer" target="_blank">a blog post</a> about the incident. &#8220;However, given the widespread nature of the breach, the exposure may be linked to a breach of the single central processor, which was leveraged by over a quarter of all Dickey’s locations.&#8221;<span id="more-53358"></span></p>
<p>While there have been <a href="https://krebsonsecurity.com/2020/07/is-your-chip-card-secure-much-depends-on-where-you-bank/" rel="noopener noreferrer" target="_blank">sporadic reports about criminals compromising chip-based payment systems</a> used by merchants in the U.S., the vast majority of the payment card data for sale in the cybercrime underground is stolen from merchants who are still swiping chip-based cards.</p>
<p>This isn&#8217;t conjecture; relatively recent data from the stolen card shops themselves bear this out. In July, KrebsOnSecurity wrote about an analysis by researchers at <strong>New York University</strong>, which looked at patterns surrounding more than 19 million stolen payment cards that were exposed after the hacking of BriansClub, a top competitor to the Joker&#8217;s Stash carding shop.</p>
<p>The NYU researchers found BriansClub earned close to $104 million in gross revenue from 2015 to early 2019, and listed over 19 million unique card numbers for sale. <a href="https://krebsonsecurity.com/2020/07/heres-why-credit-card-fraud-is-still-a-thing/" target="_blank" rel="noopener noreferrer">Around 97% of the inventory was stolen magnetic stripe data</a>, commonly used to produce counterfeit cards for in-person payments.</p>
<p>Visa and MasterCard instituted new rules in October 2015 that put retailers on the hook for all of the losses associated with counterfeit card fraud tied to breaches if they haven&#8217;t implemented chip-based card readers and enforced the dipping of the chip when a customer presents a chip-based card.</p>
<p>Dominitz said he never imagined back in 2015 when he founded Q6Cyber that we would still be seeing so many merchants dealing with magstripe-based data breaches.</p>
<p>&#8220;Five years ago I did not expect we would be in this position today with card fraud,&#8221; he said. &#8220;You&#8217;d think the industry in general would have made a bigger dent in this underground economy a while ago.&#8221;</p>
<p>Tired of having your credit card re-issued and updating your payment records at countless e-commerce sites every time some restaurant you frequent has a breach? Here&#8217;s a radical idea: Next time you visit an eatery (okay, if that ever happens again post-COVID, etc), ask them if they use chip-based card readers. If not, consider taking your business elsewhere.</p>


feed_id: https://krebsonsecurity.com/?p=53377
title: QAnon/8Chan Sites Briefly Knocked Offline
uri: QAnon-8Chan-Sites-Briefly-Knocked-Offline
url: https://krebsonsecurity.com/2020/10/qanon-8chan-sites-briefly-knocked-offline/
content:
<p>A phone call to an Internet provider in Oregon on Sunday evening was all it took to briefly sideline multiple websites related to <a href="https://en.wikipedia.org/wiki/8chan" target="_blank" rel="noopener noreferrer">8chan/8kun</a> &#8212; a controversial online image board linked to several mass shootings &#8212; and <a href="https://en.wikipedia.org/wiki/QAnon" target="_blank" rel="noopener noreferrer">QAnon</a>, the far-right conspiracy theory which holds that a cabal of Satanic pedophiles is running a global child sex-trafficking ring and plotting against <strong>President Donald Trump</strong>. Following a brief disruption, the sites have come back online with the help of an Internet company based in St. Petersburg, Russia.</p>
<div id="attachment_53382" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/c99c5ab7.qanon-8kun-map.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/qanon-8kun-map.png"><img aria-describedby="caption-attachment-53382" loading="lazy" class="wp-image-53382" src="media/c99c5ab7.qanon-8kun-map.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/qanon-8kun-map.png" alt="" width="597" height="263" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/10/qanon-8kun-map.png 1457w, https://krebsonsecurity.com/wp-content/uploads/2020/10/qanon-8kun-map-768x338.png 768w" sizes="(max-width: 597px) 100vw, 597px" /></a><p id="caption-attachment-53382" class="wp-caption-text">The IP address range in the upper-right portion of this map of QAnon and 8kun-related sites &#8212; 203.28.246.0/24 &#8212; is assigned to VanwaTech and briefly went offline this evening. Source: twitter.com/<span class="css-901oao css-16my406 r-1qd0xha r-ad9z0x r-bcqeeo r-qvutc0">Redrum_of_Crows.</span></p></div>
<p>A large number of 8kun and QAnon-related sites (see map above) are connected to the Web via a single Internet provider in Vancouver, Wash. called<strong> VanwaTech</strong> (a.k.a. &#8220;<strong>OrcaTech</strong>&#8220;). Previous appeals to VanwaTech to disconnect these sites have fallen on deaf ears, as the company&#8217;s owner <strong>Nick Lim</strong> <a href="https://www.columbian.com/news/2019/nov/07/8chan-back-online-under-the-name-8kun/" target="_blank" rel="noopener noreferrer">reportedly</a> has been working with 8kun&#8217;s administrators to keep the sites online in the name of protecting free speech.</p>
<p>But VanwaTech also had a single point of failure on its end: The swath of Internet addresses serving the various 8kun/QAnon sites were being protected from otherwise crippling and incessant distributed-denial-of-service (DDoS) attacks by Hillsboro, Ore. based <strong>CNServers LLC</strong>.</p>
<p>On Sunday evening, security researcher <strong>Ron Guilmette</strong> placed a phone call to CNServers&#8217; owner, who professed to be shocked by revelations that his company was helping QAnon and 8kun keep the lights on.</p>
<p>Within minutes of that call, CNServers told its customer &#8212; <strong>Spartan Host Ltd</strong>., which is registered in Belfast, Northern Ireland &#8212; that it would no longer be providing DDoS protection for the set of 254 Internet addresses that Spartan Host was routing on behalf of VanwaTech.</p>
<p>Contacted by KrebsOnSecurity, the person who answered the phone at CNServers asked not to be named in this story for fear of possible reprisals from the 8kun/QAnon crowd. But they confirmed that CNServers had indeed terminated its service with Spartan Host. That person added they weren&#8217;t a fan of either 8kun or QAnon, and said they would not self-describe as a Trump supporter.</p>
<p>CNServers said that shortly after it withdrew its DDoS protection services, Spartan Host changed its settings so that VanwaTech&#8217;s Internet addresses were protected from attacks by <strong>ddos-guard[.]net</strong>, a company based in St. Petersburg, Russia.</p>
<p>Spartan Host&#8217;s founder, 25-year-old <strong>Ryan McCully</strong>, confirmed CNServers&#8217; report. McCully declined to say for how long VanwaTech had been a customer, or whether Spartan Host had experienced any attacks as a result of CNServers&#8217; action.<span id="more-53377"></span></p>
<p>McCully said while he personally doesn&#8217;t subscribe to the beliefs espoused by QAnon or 8kun, he intends to keep VanwaTech as a customer going forward.</p>
<p>&#8220;We follow the &#8216;law of the land&#8217; when deciding what we allow to be hosted with us, with some exceptions to things that may cause resource issues etc.,&#8221; McCully said in a conversation over instant message. &#8220;Just because we host something, it doesn&#8217;t say anything about we do and don&#8217;t support, our opinions don&#8217;t come into hosted content decisions.&#8221;</p>
<p>But according to Guilmette, Spartan Host&#8217;s relationship with VanwaTech wasn&#8217;t widely known previously because Spartan Host had set up what&#8217;s known as a &#8220;private peering&#8221; agreement with VanwaTech. That is to say, the two companies had a confidential business arrangement by which their mutual connections were not explicitly stated or obvious to other Internet providers on the global Internet.</p>
<p>Guilmette said private peering relationships often play a significant role in a good deal of behind-the-scenes-mischief when the parties involved do not want anyone else to know about their relationship.</p>
<p>&#8220;These arrangements are business agreements that are confidential between two parties, and no one knows about them, unless you start asking questions,&#8221; Guilmette said. &#8220;It certainly appears that a private peering arrangement was used in this instance in order to hide the direct involvement of Spartan Host in providing connectivity to VanwaTech and thus to 8kun. Perhaps Mr. McCully was not eager to have his involvement known.&#8221;</p>
<p>8chan, which rebranded last year as 8kun, has been linked to white supremacism, neo-Nazism, antisemitism, multiple mass shootings, and is known for hosting child pornography. After three mass shootings in 2019 revealed the perpetrators had spread their manifestos on 8chan and even streamed their killings live there, 8chan was ostracized by one Internet provider after another.</p>
<p>The FBI last year identified QAnon as <a href="https://news.yahoo.com/fbi-documents-conspiracy-theories-terrorism-160000507.html?soc_src=hl-viewer&amp;soc_trk=tw" target="_blank" rel="noopener noreferrer">a potential domestic terror threat</a>, noting that some of its followers have been linked to violent incidents motivated by fringe beliefs.</p>
<p>Further reading:</p>
<p><a href="https://www.nytimes.com/article/what-is-qanon.html" target="_blank" rel="noopener noreferrer">What Is QAnon?</a></p>
<p><a href="https://www.theguardian.com/us-news/2020/oct/15/qanon-violence-crimes-timeline" target="_blank" rel="noopener noreferrer">QAnon: A Timeline of Violent Linked to the Conspiracy Theory</a></p>


feed_id: https://krebsonsecurity.com/?p=53397
title: The Now-Defunct Firms Behind 8chan, QAnon
uri: The-Now-Defunct-Firms-Behind-8chan-QAnon
url: https://krebsonsecurity.com/2020/10/the-now-defunct-firms-behind-8chan-qanon/
content:
<p>Some of the world&#8217;s largest Internet firms have <a href="https://www.nytimes.com/2020/10/21/technology/tiktok-qanon.html" target="_blank" rel="noopener noreferrer">taken steps</a> to crack down on disinformation spread by <a href="https://www.nytimes.com/2020/10/21/technology/tiktok-qanon.html" target="_blank" rel="noopener noreferrer"><strong>QAnon</strong> conspiracy theorists</a> and the hate-filled anonymous message board <a href="https://en.wikipedia.org/wiki/8chan" target="_blank" rel="noopener noreferrer"><strong>8chan</strong></a>. But according to a California-based security researcher, those seeking to de-platform these communities may have overlooked a simple legal solution to that end: Both the Nevada-based web hosting company owned by 8chan&#8217;s current figurehead and the California firm that provides its sole connection to the Internet are defunct businesses in the eyes of their respective state regulators.</p>
<p>In practical terms, what this means is that the legal contracts which granted these companies temporary control over large swaths of Internet address space are now null and void, and American Internet regulators would be well within their rights to cancel those contracts and reclaim the space.</p>
<div id="attachment_53382" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/c99c5ab7.qanon-8kun-map.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/qanon-8kun-map.png"><img aria-describedby="caption-attachment-53382" loading="lazy" class="wp-image-53382" src="media/c99c5ab7.qanon-8kun-map.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/qanon-8kun-map.png" alt="" width="597" height="263" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/10/qanon-8kun-map.png 1457w, https://krebsonsecurity.com/wp-content/uploads/2020/10/qanon-8kun-map-768x338.png 768w" sizes="(max-width: 597px) 100vw, 597px" /></a><p id="caption-attachment-53382" class="wp-caption-text">The IP address ranges in the upper-left portion of this map of QAnon and 8kun-related sites &#8212; some 21,000 IP addresses beginning in &#8220;206.&#8221; and &#8220;207.&#8221; &#8212; are assigned to N.T. Technology Inc. Image source: twitter.com/Redrum_of_Crows</p></div>
<p>That idea was floated by <strong>Ron Guilmette</strong>, a longtime anti-spam crusader who recently turned his attention to disrupting the online presence of QAnon and 8chan (recently renamed &#8220;8kun&#8221;).</p>
<p>On Sunday, 8chan and a host of other sites related to QAnon conspiracy theories were briefly knocked offline after Guilmette called 8chan&#8217;s anti-DDoS provider and <a href="https://krebsonsecurity.com/2020/10/qanon-8chan-sites-briefly-knocked-offline/" target="_blank" rel="noopener noreferrer">convinced them to stop protecting the site from crippling online attacks</a> (8Chan is now protected by an anti-DDoS provider in St. Petersburg, Russia).</p>
<p>The public face of 8chan is <a href="https://www.washingtonpost.com/technology/2019/09/12/helicopter-repairman-leader-internets-darkest-reaches-life-times-chan-owner-jim-watkins/" target="_blank" rel="noopener noreferrer">Jim Watkins</a>, a pig farmer in the Philippines <a href="https://abcnews.go.com/Politics/men-qanon/story?id=73046374" target="_blank" rel="noopener noreferrer">who many experts believe is also the person behind the shadowy persona of &#8220;Q&#8221;</a> at the center of the conspiracy theory movement.</p>
<p>Watkin owns and operates a Reno, Nev.-based <a href="https://www.nttec.com/" target="_blank" rel="noopener noreferrer">hosting firm</a> called <strong>N.T. Technology Inc</strong>. That company has a legal contract with the <strong>American Registry for Internet Numbers</strong> (ARIN), the non-profit which administers IP addresses for entities based in North America.</p>
<p>ARIN&#8217;s contract with N.T. Technology gives the latter the right to use <a href="https://bgp.he.net/AS32335#_prefixes" target="_blank" rel="noopener noreferrer">more than 21,500 IP addresses</a>. But as Guilmette discovered recently, N.T. Technology is listed in Nevada Secretary of State records as under an &#8220;administrative hold,&#8221; which according to <a href="https://www.leg.state.nv.us/NAC/NAC-088.html" target="_blank" rel="noopener noreferrer">Nevada statute</a> is a &#8220;terminated&#8221; status indicator meaning the company no longer has the right to transact business in the state.</p>
<div id="attachment_53400" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/d89716fc.nttech-NSoS.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/nttech-NSoS.png"><img aria-describedby="caption-attachment-53400" loading="lazy" class="wp-image-53400" src="media/d89716fc.nttech-NSoS.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/nttech-NSoS.png" alt="" width="597" height="157" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/10/nttech-NSoS.png 1388w, https://krebsonsecurity.com/wp-content/uploads/2020/10/nttech-NSoS-768x202.png 768w" sizes="(max-width: 597px) 100vw, 597px" /></a><p id="caption-attachment-53400" class="wp-caption-text">N.T. Technology&#8217;s listing in the Nevada Secretary of State records. Click to Enlarge.</p></div>
<p>The same is true for <a href="http://www.centaurico.com/company/history.asp" target="_blank" rel="noopener noreferrer">Centauri Communications</a>, a Freemont, Calif.-based Internet Service Provider that serves as N.T. Technology&#8217;s colocation provider and <a href="https://bgp.he.net/AS32335#_peers" target="_blank" rel="noopener noreferrer">sole connection to the larger Internet</a>. Centauri was granted <a href="https://bgp.he.net/AS19214/#_prefixes" target="_blank" rel="noopener noreferrer">more than 4,000 IPv4 addresses</a> by ARIN more than a decade ago.</p>
<p>According to the California Secretary of State, Centauri&#8217;s status as a business in the state is &#8220;suspended.&#8221; It appears that Centauri hasn&#8217;t filed any business records with the state since 2009, and the state subsequently suspended the company&#8217;s license to do business in Aug. 2012. Separately, the California State Franchise Tax Board (FTB) suspended this company as of April 1, 2014.</p>
<div id="attachment_53401" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/6d859840.centauri-ca-sos.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/centauri-ca-sos.png"><img aria-describedby="caption-attachment-53401" loading="lazy" class="wp-image-53401" src="media/6d859840.centauri-ca-sos.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/centauri-ca-sos.png" alt="" width="596" height="356" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/10/centauri-ca-sos.png 1156w, https://krebsonsecurity.com/wp-content/uploads/2020/10/centauri-ca-sos-768x458.png 768w" sizes="(max-width: 596px) 100vw, 596px" /></a><p id="caption-attachment-53401" class="wp-caption-text">Centauri Communications&#8217; listing with the California Secretary of State&#8217;s office.</p></div>
<p>Neither Centauri Communications nor N.T. Technology responded to repeated requests for comment.<span id="more-53397"></span></p>
<p>KrebsOnSecurity shared Guilmette&#8217;s findings with ARIN, which said it would investigate the matter.</p>
<p>&#8220;ARIN has received a fraud report from you and is evaluating it,&#8221; a spokesperson for ARIN said. &#8220;We do not comment on such reports publicly.&#8221;</p>
<p>Guilmette said apart from reclaiming the Internet address space from Centauri and NT Technology, ARIN could simply remove each company&#8217;s listings from the global WHOIS routing records. Such a move, he said, would likely result in most ISPs blocking access to those IP addresses.</p>
<p>&#8220;If ARIN were to remove these records from the WHOIS database, it would serve to de-legitimize the use of these IP blocks by the parties involved,&#8221; he said. &#8220;And globally, it would make it more difficult for the parties to find people willing to route packets to and from those blocks of addresses.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=53427
title: Google Mending Another Crack in Widevine
uri: Google-Mending-Another-Crack-in-Widevine
url: https://krebsonsecurity.com/2020/10/google-mending-another-crack-in-widevine/
content:
<p>For the second time in as many years, <strong>Google</strong> is working to fix a weakness in its <strong>Widevine</strong> digital rights management (DRM) technology used by online streaming sites like <strong>Disney</strong>, <strong>Hulu </strong>and<strong> Netflix </strong>to prevent their content from being pirated.</p>
<p><img loading="lazy" class="aligncenter wp-image-53433" src="media/14a149ca.widevine.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/widevine.png" alt="" width="590" height="98" /></p>
<p>The latest cracks in <a href="https://www.widevine.com/" target="_blank" rel="noopener noreferrer">Widevine</a> concern the encryption technology&#8217;s protection for L3 streams, which is used for low-quality video and audio streams only. Google says the weakness does not affect L1 and L2 streams, which encompass more high-definition video and audio content.</p>
<p>&#8220;As code protection is always evolving to address new threats, we are currently working to update our <span class="il">Widevine</span> software DRM with the latest advancements in code protection to address this issue,&#8221; Google said in a written statement provided to KrebsOnSecurity.</p>
<p>In January 2019, researcher <strong>David Buchanan</strong> <a href="https://twitter.com/David3141593/status/1080606827384131590" target="_blank" rel="noopener noreferrer">tweeted about the L3 weakness</a> he found, but didn&#8217;t release any proof-of-concept code that others could use to exploit it before Google fixed the problem.</p>
<p>This latest Widevine hack, however, has been made into an extension for <strong>Microsoft Windows</strong> users of the <strong>Google Chrome</strong> web browser and posted for download on the software development platform Github.<span id="more-53427"></span></p>
<p><strong>Tomer Hadad</strong>, the researcher who developed the browser extension, said his proof-of-concept code &#8220;was done to further show that code obfuscation, anti-debugging tricks, whitebox cryptography algorithms and other methods of security-by-obscurity will eventually by defeated anyway, and are, in a way, pointless.&#8221;</p>
<p>Google called the weakness a bug that would be fixed. But Hadad took issue with that characterization.</p>
<p>&#8220;It&#8217;s not a bug but an inevitable flaw because of the use of software, which is also why L3 does not offer the best quality,&#8221; Hadad wrote in an email. &#8220;L3 is usually used on desktops because of the lack of hardware trusted zones.&#8221;</p>
<p>Media companies that stream video online using Widevine can select different levels of protection for delivering their content, depending on the capabilities of the device requesting access. Most modern smartphones and mobile devices support much more robust L1 and L2 Widevine protections that do not rely on L3.</p>
<p>Further reading: <a href="https://fidusinfosec.com/breaking-content-protection-on-streaming-websites/" target="_blank" rel="noopener noreferrer">Breaking Content Protection on Streaming Websites</a></p>


feed_id: https://krebsonsecurity.com/?p=53445
title: Security Blueprints of Many Companies Leaked in Hack of Swedish Firm Gunnebo
uri: Security-Blueprints-of-Many-Companies-Leaked-in-Hack-of-Swedish-Firm-G
url:
https://krebsonsecurity.com/2020/10/security-blueprints-of-many-companies-leaked-in-hack-of-swedish-firm-gunnebo/

content:
<p>In March 2020, KrebsOnSecurity alerted Swedish security giant <a href="https://en.wikipedia.org/wiki/Gunnebo_Group" target="_blank" rel="noopener noreferrer">Gunnebo Group</a> that hackers had broken into its network and sold the access to a criminal group which specializes in deploying ransomware. In August, Gunnebo said it had successfully thwarted a ransomware attack, but this week it emerged that the intruders stole and published online tens of thousands of sensitive documents &#8212; including schematics of client bank vaults and surveillance systems.</p>
<p><img loading="lazy" class="aligncenter wp-image-53451" src="media/d24a2b26.gunnebo.jpeg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/gunnebo.jpeg" alt="" width="588" height="329" /></p>
<p>The <a href="https://www.gunnebo.com/" target="_blank" rel="noopener noreferrer">Gunnebo Group</a> is a Swedish multinational company that provides physical security to a variety of customers globally, including banks, government agencies, airports, casinos, jewelry stores, tax agencies and even nuclear power plants. The company has operations in 25 countries, more than 4,000 employees, and billions in revenue annually.</p>
<p>Acting on a tip from Milwaukee, Wis.-based cyber intelligence firm <a href="https://www.holdsecurity.com" target="_blank" rel="noopener noreferrer">Hold Security</a>, KrebsOnSecurity in March told Gunnebo about a financial transaction between a malicious hacker and a cybercriminal group which specializes in deploying ransomware. That transaction included credentials to a <a href="https://krebsonsecurity.com/2013/12/hacked-via-rdp-really-dumb-passwords/" target="_blank" rel="noopener noreferrer">Remote Desktop Protocol</a> (RDP) account apparently set up by a Gunnebo Group employee who wished to access the company&#8217;s internal network remotely.</p>
<p>Five months later, Gunnebo <a href="https://news.cision.com/se/gunnebo/r/en-organiserad-it-attack-anmald-till-sapo,c3181154" target="_blank" rel="noopener noreferrer">disclosed</a> it had suffered a cyber attack targeting its IT systems that forced the shutdown of internal servers. Nevertheless, the company said its quick reaction prevented the intruders from spreading the ransomware throughout its systems, and that the overall lasting impact from the incident was minimal.</p>
<p>Earlier this week, Swedish news agency <em>Dagens Nyheter</em> <a href="https://www.dn.se/ekonomi/enorm-sakerhetslacka-hemliga-uppgifter-om-riksdagen-och-banker-ute-pa-natet/" target="_blank" rel="noopener noreferrer">confirmed</a> that hackers recently published online at least 38,000 documents stolen from Gunnebo&#8217;s network. <strong>Linus Larsson</strong>, the journalist who broke the story, says the hacked material was uploaded to a public server during the second half of September, and it is not known how many people may have gained access to it.</p>
<p>Larsson quotes <strong>Gunnebo CEO Stefan Syrén</strong> saying the company never considered paying the ransom the attackers demanded in exchange for not publishing its internal documents. What&#8217;s more, Syrén seemed to downplay the severity of the exposure.</p>
<p>&#8220;I understand that you can see drawings as sensitive, but we do not consider them as sensitive automatically,&#8221; the CEO reportedly said. &#8220;When it comes to cameras in a public environment, for example, half the point is that they should be visible, therefore a drawing with camera placements in itself is not very sensitive.&#8221;</p>
<p><span class="pullquote pqright">It remains unclear whether the stolen RDP credentials were a factor in this incident. But the password to the Gunnebo RDP account &#8212; &#8220;password01&#8221; &#8212; suggests the security of its IT systems may have been lacking in other areas as well.</span></p>
<p>After this author <a href="https://twitter.com/briankrebs/status/1234621914502565890" target="_blank" rel="noopener noreferrer">posted a request for contact from Gunnebo on Twitter</a>, KrebsOnSecurity heard from <strong>Rasmus Jansson</strong>, an account manager at Gunnebo who specializes in protecting client systems from electromagnetic pulse (EMP) attacks or disruption, short bursts of energy that can damage electrical equipment.</p>
<p>Jansson said he relayed the stolen credentials to the company&#8217;s IT specialists, but that he does not know what actions the company took in response. Reached by phone today, Jansson said he quit the company in August, right around the time Gunnebo disclosed the thwarted ransomware attack. He declined to comment on the particulars of the extortion incident.</p>
<p>Ransomware attackers often spend weeks or months inside of a target&#8217;s network before attempting to deploy malware across the network that encrypts servers and desktop systems unless and until a ransom demand is met.</p>
<p>That&#8217;s because gaining the initial foothold is rarely the difficult part of the attack. In fact, many ransomware groups now have such an embarrassment of riches in this regard that <a href="https://krebsonsecurity.com/2020/10/amid-an-embarrassment-of-riches-ransom-gangs-increasingly-outsource-their-work/" target="_blank" rel="noopener noreferrer">they&#8217;ve taken to hiring external penetration testers</a> to carry out the grunt work of escalating that initial foothold into complete control over the victim&#8217;s network and any data backup systems  &#8212; a process that can be hugely time consuming.</p>
<p>But prior to launching their ransomware, it has become common practice for these extortionists to offload as much sensitive and proprietary data as possible. In some cases, this allows the intruders to profit even if their malware somehow fails to do its job. In other instances, victims are asked to pay two extortion demands: One for a digital key to unlock encrypted systems, and another in exchange for a promise not to publish, auction or otherwise trade any stolen data.<span id="more-53445"></span></p>
<p>While it may seem ironic when a physical security firm ends up having all of its secrets published online, the reality is that some of the biggest targets of ransomware groups continue to be companies which may not consider cybersecurity or information systems as their primary concern or business &#8212; regardless of how much may be riding on that technology.</p>
<p>Indeed, companies that persist in viewing cyber and physical security as somehow separate seem to be among the favorite targets of ransomware actors. Last week, a Russian journalist <a href="https://www.youtube.com/watch?v=ZyQCQ1VZp8s" target="_blank" rel="noopener noreferrer">published a video on Youtube</a> claiming to be an interview with the cybercriminals behind <a href="https://krebsonsecurity.com/?s=sodinokibi&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">the REvil/Sodinokibi ransomware strain</a>, which is the handiwork of a particularly aggressive criminal group that&#8217;s been behind some of the biggest and most costly ransom attacks in recent years.</p>
<div style="text-align: center;"><iframe src="https://www.youtube.com/embed/ZyQCQ1VZp8s" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>In the video, the REvil representative stated that the most desirable targets for the group were agriculture companies, manufacturers, insurance firms, and law firms. The REvil actor claimed that on average roughly one in three of its victims agrees to pay an extortion fee.</p>
<p><strong>Mark Arena</strong>, CEO of cybersecurity threat intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener noreferrer">Intel 471</a>, said while it might be tempting to believe that firms which specialize in information security typically have better cybersecurity practices than physical security firms, few organizations have a deep understanding of their adversaries.</p>
<p>Arena said this is <a href="https://krebsonsecurity.com/?s=ransomware+it+provider&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">a particularly acute shortcoming with many managed service providers</a> (MSPs), companies that provide outsourced security services to hundreds or thousands of clients who might not otherwise be able to afford to hire cybersecurity professionals.</p>
<p>&#8220;The harsh and unfortunate reality is the security of a number of security companies is shit,&#8221; Arena said. &#8220;Most companies tend to have a lack of ongoing and up to date understanding of the threat actors they face.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=53465
title: FBI, DHS, HHS Warn of Imminent, Credible Ransomware Threat Against U.S. Hospitals
uri: FBI-DHS-HHS-Warn-of-Imminent-Credible-Ransomware-Threat-Against-U-S
url:
https://krebsonsecurity.com/2020/10/fbi-dhs-hhs-warn-of-imminent-credible-ransomware-threat-against-u-s-hospitals/

content:
<p>On Monday, Oct. 27, KrebsOnSecurity began following up on a tip from a reliable source that an aggressive Russian cybercriminal gang known for deploying ransomware was preparing to disrupt information technology systems at hundreds of hospitals, clinics and medical care facilities across the United States. Today, officials from the <strong>FBI</strong> and the <strong>U.S. Department of Homeland Security</strong> hastily assembled a conference call with healthcare industry executives warning about an &#8220;imminent cybercrime threat to U.S. hospitals and healthcare providers.&#8221;</p>
<p><img loading="lazy" class="aligncenter wp-image-53477" src="media/3791c184.medsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/medsec.png" alt="" width="590" height="646" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/10/medsec.png 800w, https://krebsonsecurity.com/wp-content/uploads/2020/10/medsec-768x841.png 768w" sizes="(max-width: 590px) 100vw, 590px" /></p>
<p>The agencies on the conference call, which included the <strong>U.S. Department of Health and Human Services</strong> (HHS), warned participants about &#8220;credible information of an increased and imminent cybercrime threat to US hospitals and healthcare providers.&#8221;</p>
<p>The agencies said they were sharing the information &#8220;to provide warning to healthcare providers to ensure that they take timely and reasonable precautions to protect their networks from these threats.&#8221;</p>
<p>The warning came less than 24 hours after this author received a tip from <strong>Alex Holden</strong>, founder of Milwaukee-based cyber intelligence firm <a href="https://www.holdsecurity.com" target="_blank" rel="noopener noreferrer">Hold Security</a>. Holden said he saw online communications this week between cybercriminals affiliated with a Russian-speaking ransomware group known as <a href="https://krebsonsecurity.com/?s=ryuk&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">Ryuk</a> in which group members discussed plans to deploy ransomware at more than 400 healthcare facilities in the U.S.</p>
<p>One participant on the government conference call today said the agencies offered few concrete details of how healthcare organizations might better protect themselves against this threat actor or purported malware campaign.</p>
<p>&#8220;They didn&#8217;t share any IoCs [<a href="https://en.wikipedia.org/wiki/Indicator_of_compromise" target="_blank" rel="noopener noreferrer">indicators of compromise</a>], so it&#8217;s just been &#8216;patch your systems and report anything suspicious&#8217;,&#8221; said a healthcare industry veteran who sat in on the discussion.</p>
<p>However, others on the call said IoCs may be of little help for hospitals that have already been infiltrated by the Ryuk gang. That&#8217;s because the malware infrastructure used by the Ryuk gang is often unique to each victim, including everything from the Microsoft Windows executable files that get dropped on the infected hosts to the so-called &#8220;command and control&#8221; servers used to transmit data between and among compromised systems.</p>
<p>Nevertheless, cybersecurity incident response firm <strong>Mandiant</strong> today <a href="https://gist.github.com/aaronst/6aa7f61246f53a8dd4befea86e832456" target="_blank" rel="noopener noreferrer">released a list of domains and Internet addresses used by Ryuk</a> in previous attacks throughout 2020 and up to the present day. Mandiant refers to the group by the threat actor classification &#8220;UNC1878,&#8221; and <a href="https://www.youtube.com/watch?v=BhjQ6zsCVSc" target="_blank" rel="noopener noreferrer">aired a webcast today</a> detailing some of Ryuk&#8217;s latest exploitation tactics.</p>
<p><strong>Charles Carmakal</strong>, senior vice president for Mandiant, <a href="https://www.reuters.com/article/us-usa-healthcare-cyber/fbi-probes-string-of-recent-ransomware-attacks-on-us-hospitals-idUSKBN27D35U" target="_blank" rel="noopener noreferrer">told Reuters</a> that UNC1878 is one of most brazen, heartless, and disruptive threat actors he&#8217;s observed over the course of his career.</p>
<p>&#8220;Multiple hospitals have already been significantly impacted by Ryuk ransomware and their networks have been taken offline,&#8221; Carmakal said.<span id="more-53465"></span></p>
<p>One health industry veteran who participated in the call today and who spoke with KrebsOnSecurity on condition of anonymity said if there truly are hundreds of medical facilities at imminent risk here, that would seem to go beyond the scope of any one hospital group and may implicate some kind of electronic health record provider that integrates with many care facilities.</p>
<p>So far, however, nothing like hundreds of facilities have publicly reported ransomware incidents. But there have been a handful of hospitals dealing with ransomware attacks in the past few days.</p>
<p>&#8211;<em>Becker&#8217;s Hospital Review</em> <a href="https://www.beckershospitalreview.com/cybersecurity/oregon-hospital-shuts-down-computer-system-after-ransomware-attack-4-notes.html" target="_blank" rel="noopener noreferrer">reported today</a> that a ransomware attack hit Klamath Falls, Ore.-based Sky Lakes Medical Center&#8217;s computer systems.</p>
<p>&#8211;<em>WWNY&#8217;s Channel 7 News</em> in New York <a href="https://www.wwnytv.com/2020/10/27/gouverneur-canton-potsdam-hospitals-dealing-with-computer-problems/#:~:text=(WWNY)%20%2D%20St.%20Lawrence,and%20employee%20information%20was%20compromised.&amp;text=Patient%20care%20continues%20to%20be%20delivered%20safely%20and%20effectively.%E2%80%9D" target="_blank" rel="noopener noreferrer">reported yesterday</a> that a Ryuk ransomware attack on St. Lawrence Health System led to computer infections at Caton-Potsdam, Messena and Gouverneur hospitals.</p>
<p>&#8211;<em>SWNewsMedia.com</em> <a href="https://www.swnewsmedia.com/chanhassen_villager/news/local/unusual-network-activity-at-ridgeview-medical-center/article_5fc12f6e-c320-59d4-9ad4-24f5cb985a36.html" target="_blank" rel="noopener noreferrer">on Monday reported</a> on &#8220;unidentified network activity&#8221; that caused disruption to certain operations at Ridgeview Medical Center in Waconia, Minn. SWNews says Ridgeview&#8217;s system includes Chaska’s Two Twelve Medical Center, three hospitals, clinics and other emergency and long-term care sites around the metro area.</p>
<p>This is a developing story. Stay tuned for further updates.</p>


feed_id: https://krebsonsecurity.com/?p=53497
title: Two Charged in SIM Swapping, Vishing Scams
uri: Two-Charged-in-SIM-Swapping-Vishing-Scams
url: https://krebsonsecurity.com/2020/11/two-charged-in-sim-swapping-vishing-scams/
content:
<p>Two young men from the eastern United States have been hit with identity theft and conspiracy charges for allegedly stealing bitcoin and social media accounts by tricking employees at wireless phone companies into giving away credentials needed to remotely access and modify customer account information.</p>
<p><img loading="lazy" class="aligncenter wp-image-45224" src="media/57d2a628.phonescam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/phonescam.png" alt="" width="593" height="374" /></p>
<p>Prosecutors say <strong>Jordan K. Milleson</strong>, 21 of Timonium, Md. and 19-year-old Kingston, Pa. resident <strong>Kyell A. Bryan</strong> hijacked social media and bitcoin accounts using a mix of voice phishing or &#8220;<a href="https://krebsonsecurity.com/?s=vishing&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">vishing</a>&#8221; attacks and &#8220;<a href="https://krebsonsecurity.com/?s=sim+swapping&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">SIM swapping</a>,&#8221; a form of fraud that involves bribing or tricking employees at mobile phone companies.</p>
<p>Investigators allege the duo set up phishing websites that mimicked legitimate employee portals belonging to wireless providers, and then emailed and/or called employees at these providers in a bid to trick them into logging in at these fake portals.</p>
<p>According to <a href="media/94dd553c.KyellBryan.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/KyellBryan.pdf" target="_blank" rel="noopener noreferrer">the indictment</a> (PDF), Milleson and Bryan used their phished access to wireless company employee tools to reassign the subscriber identity module (SIM) tied to a target&#8217;s mobile device. A SIM card is a small, removable smart chip in mobile phones that links the device to the customer&#8217;s phone number, and their purloined access to employee tools meant they could reassign any customer&#8217;s phone number to a SIM card in a mobile device they controlled.</p>
<p>That allowed them to seize control over a target&#8217;s incoming phone calls and text messages, which were used to reset the password for email, social media and cryptocurrency accounts tied to those numbers.</p>
<p>Interestingly, the conspiracy appears to have unraveled over a business dispute between the two men. Prosecutors say on June 26, 2019, &#8220;Bryan called the Baltimore County Police Department and falsely reported that he, purporting to be a resident of the Milleson family residence, had shot his father at the residence.&#8221;<span id="more-53497"></span></p>
<p>&#8220;During the call, Bryan, posing as the purported shooter, threatened to shoot himself and to shoot at police officers if they attempted to confront him,&#8221; reads <a href="https://www.justice.gov/usao-md/pr/two-men-facing-federal-indictment-maryland-scheme-steal-digital-currency-and-social-media" target="_blank" rel="noopener noreferrer">a statement</a> from the U.S. Attorney&#8217;s Office for the District of Maryland. &#8220;The call was a &#8216;swatting&#8217; attack, a criminal harassment tactic in which a person places a false call to authorities that will trigger a police or special weapons and tactics (SWAT) team response &#8212; thereby causing a life-threatening situation.&#8221;</p>
<p>The indictment alleges Bryan swatted his alleged partner in retaliation for Milleson failing to share the proceeds of a digital currency theft. Milleson and Bryan are facing charges of wire fraud, unauthorized access to protected computers, aggravated identity theft and wire fraud conspiracy.</p>
<p>The indictment doesn&#8217;t specify the wireless companies targeted by the phishing and vishing schemes, but sources close to the investigation tell KrebsOnSecurity the two men were active members of <strong>OGusers</strong>, an online forum that caters to people selling access to hijacked social media accounts.</p>
<p>Bryan allegedly used the nickname &#8220;Champagne&#8221; on OGusers. On at least two occasions in the past few years, the OGusers forum <a href="https://krebsonsecurity.com/2019/05/account-hijacking-forum-ogusers-hacked/" target="_blank" rel="noopener noreferrer">was hacked</a> and its user database &#8212; including private messages between forum members &#8212; were posted online. In a private message dated Nov. 15, 2019, Champagne can be seen asking another OGusers member to create a phishing site mimicking T-Mobile&#8217;s employee login page (t-mobileupdates[.]com).</p>
<p>Sources tell KrebsOnSecurity the two men are part of <a href="https://krebsonsecurity.com/2020/08/voice-phishers-targeting-corporate-vpns/" target="_blank" rel="noopener noreferrer">a larger conspiracy</a> involving individuals from the United States and United Kingdom who&#8217;ve used vishing and phishing to trick work-at-home employees into giving away credentials needed to remotely access their employers’ networks.</p>


feed_id: https://krebsonsecurity.com/?p=53505
title: Why Paying to Delete Stolen Data is Bonkers
uri: Why-Paying-to-Delete-Stolen-Data-is-Bonkers
url: https://krebsonsecurity.com/2020/11/why-paying-to-delete-stolen-data-is-bonkers/
content:
<p>Companies hit by ransomware often face a dual threat: Even if they avoid paying the ransom and can restore things from scratch, about half the time the attackers also threaten to release sensitive stolen data unless the victim pays for a promise to have the data deleted. Leaving aside the notion that victims might have any real expectation the attackers will actually destroy the stolen data, new research suggests a fair number of victims who do pay up may see some or all of the stolen data published anyway.</p>
<p><img loading="lazy" class="aligncenter  wp-image-53514" src="media/0df06f89.ransomware.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware.png" alt="" width="595" height="446" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware.png 1016w, https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware-768x575.png 768w" sizes="(max-width: 595px) 100vw, 595px" /></p>
<p>The findings come in <a href="https://www.coveware.com/blog/q3-2020-ransomware-marketplace-report" target="_blank" rel="noopener noreferrer">a report today</a> from <strong>Coveware</strong>, a company that specializes in helping firms recover from ransomware attacks. Coveware says nearly half of all ransomware cases now include the threat to release exfiltrated data.</p>
<p>&#8220;Previously, when a victim of ransomware had adequate backups, they would just restore and go on with life; there was zero reason to even engage with the threat actor,&#8221; the report observes. &#8220;Now, when a threat actor steals data, a company with perfectly restorable backups is often compelled to at least engage with the threat actor to determine what data was taken.&#8221;</p>
<p>Coveware said it has seen ample evidence of victims seeing some or all of their stolen data published after paying to have it deleted; in other cases, the data gets published online before the victim is even given a chance to negotiate a data deletion agreement.</p>
<p>&#8220;Unlike negotiating for a decryption key, negotiating for the suppression of stolen data has no finite end,&#8221; the report continues. &#8220;Once a victim receives a decryption key, it can’t be taken away and does not degrade with time. With stolen data, a threat actor can return for a second payment at any point in the future. The track records are too short and evidence that defaults are selectively occurring is already collecting.&#8221;</p>
<div id="attachment_53511" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/19ab958d.cw-dd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/cw-dd.png"><img aria-describedby="caption-attachment-53511" loading="lazy" class="wp-image-53511" src="media/19ab958d.cw-dd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/cw-dd.png" alt="" width="599" height="126" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/11/cw-dd.png 970w, https://krebsonsecurity.com/wp-content/uploads/2020/11/cw-dd-768x162.png 768w" sizes="(max-width: 599px) 100vw, 599px" /></a><p id="caption-attachment-53511" class="wp-caption-text">Image: Coveware Q3 2020 report.</p></div>
<p>The company said it advises clients never to pay a data deletion ransom, but rather to engage competent privacy attorneys, perform an investigation into what data was stolen, and notify any affected customers according to the advice of counsel and application data breach notification laws.</p>
<p><strong>Fabian Wosar</strong>, chief technology officer at computer security firm <a href="https://www.emsisoft.com/" target="_blank" rel="noopener noreferrer">Emsisoft</a>, said ransomware victims often acquiesce to data publication extortion demands when they are trying to prevent the public from learning about the breach.</p>
<p><span class="pullquote pqleft">&#8220;The bottom line is, ransomware is a business of hope,&#8221; Wosar said.</span> &#8220;The company doesn&#8217;t want the data to be dumped or sold. So they pay for it hoping the threat actor deletes the data. Technically speaking, whether they delete the data or not doesn&#8217;t matter from a legal point of view. The data was lost at the point when it was exfiltrated.&#8221;</p>
<p>Ransomware victims who pay for a digital key to unlock servers and desktop systems encrypted by the malware also are relying on hope, Wosar said, because it&#8217;s also not uncommon that a decryption key fails to unlock some or all of the infected machines.</p>
<p>&#8220;When you look at a lot of ransom notes, you can actually see groups address this very directly and have texts that say stuff along the lines of, Yeah, you are fucked now. But if you pay us, everything can go back to before we fucked you.'&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=53524
title: Body Found in Canada Identified as Neo-Nazi Spam King
uri: Body-Found-in-Canada-Identified-as-Neo-Nazi-Spam-King
url: https://krebsonsecurity.com/2020/11/body-found-in-canada-identified-as-neo-nazi-spam-king/
content:
<p>The body of a man found shot inside a burned out vehicle in Canada three years ago has been identified as that of <strong>Davis Wolfgang Hawke</strong>, a prolific spammer and neo-Nazi who led a failed anti-government march on Washington, D.C. in 1999, according to news reports.</p>
<p>Homicide detectives said they originally thought the man found June 14, 2017 in a torched SUV on a logging road in Squamish, British Columbia was a local rock climber known to others in the area as a politically progressive vegan named Jesse James.</p>
<div id="attachment_53527" style="width: 602px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53527" loading="lazy" class=" wp-image-53527" src="media/f1b9e530.hawke1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/hawke1.png" alt="" width="592" height="479" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/11/hawke1.png 1114w, https://krebsonsecurity.com/wp-content/uploads/2020/11/hawke1-768x621.png 768w" sizes="(max-width: 592px) 100vw, 592px" /><p id="caption-attachment-53527" class="wp-caption-text">Davis Wolfgang Hawke. Image: Spam Kings, by Brian McWilliams.</p></div>
<p>But according to <a href="https://bc.ctvnews.ca/mobile/man-found-dead-in-b-c-believed-to-be-u-s-spam-nazi-linked-to-buried-gold-1.5166131?cache=jhiggtiw%3FclipId%3D1920563%3Fot%3DAjaxLayout#_gus&amp;_gucid=&amp;_gup=Facebook&amp;_gsc=cemNVxP" target="_blank" rel="noopener noreferrer">a report</a> from <em>CTV News</em>, at a press conference late last month authorities said new DNA evidence linked to a missing persons investigation has confirmed the man&#8217;s true identity as Davis Wolfgang Hawke.</p>
<p>A key subject of the book <a href="https://www.amazon.com/Spam-Kings-High-Rolling-Hucksters-Enlargements-ebook-dp-B00NF07FHI/dp/B00NF07FHI/ref=mt_other?_encoding=UTF8&amp;me=&amp;qid=" target="_blank" rel="noopener noreferrer"><em>Spam Kings</em></a> by <strong>Brian McWilliams</strong>, Hawke was a Jewish-born American who&#8217;d legally changed his name from <strong>Andrew Britt Greenbaum</strong>. For many years, Hawke was a big time purveyor of spam emails hawking pornography and male enhancement supplements, such as herbal Viagra.</p>
<p>Hawke had reportedly bragged about the money he earned from spam, but told friends he didn&#8217;t trust banks and decided to convert his earnings into gold and platinum bars. That sparked rumors that he had possibly buried his ill-gotten gains on his parents&#8217; Massachusetts property.</p>
<p>In 2005, AOL won a $12.8 million lawsuit against him for relentlessly spamming its users. A year later, AOL won a court judgment <a href="https://money.cnn.com/2006/08/16/news/companies/aol/index.htm" target="_blank" rel="noopener noreferrer">authorizing them to dig on that property</a>, although no precious metals were ever found.<span id="more-53524"></span></p>
<p>More recently, Hawke&#8217;s Jesse James identity penned a book called <a href="https://www.amazon.com/Psychology-Seduction-Master-Attraction/dp/1533562636?fbclid=IwAR2tgzYVzKO6TYbmdjKmOXXF_N1AiCqoYAyCdppgcZ-97vI6qSv3TW3FaME" target="_blank" rel="noopener noreferrer">Psychology of Seduction</a>, which claimed to merge the &#8220;shady world of the pickup artist with modern science, unraveling the mystery of attraction using evolutionary biology and examining seduction through the lens of social and evolutionary psychology.&#8221;</p>
<p>The book&#8217;s &#8220;about the author&#8221; page said James was a &#8220;disruptive technology pioneer&#8221; who was <a href="https://web.archive.org/web/20160308191229/http://survivorman.net/" target="_blank" rel="noopener noreferrer">into rock climbing</a> and was a resident of Squamish. It also claimed James held a PhD in theoretical physics from Stanford, and that he was an officer in the Israeli Defense Force.</p>
<p>It might be difficult to fathom why, but Hawke may have made a few enemies over the years. Spam Kings author McWilliams notes that Hawke changed his name with regularity and used many pseudonyms.</p>
<p>&#8220;I could definitely see this guy making someone so mad at him they’d want to kill him,” McWilliams told CTV. &#8220;He was a guy who really pushed people that way and was a crook. I mean, he was a conman. That was what he was and I can see how somebody might get mad. I can also see him staging his own death or committing suicide in a fashion like that, if that’s what he chose to do. He was just a perplexing guy. I still don’t feel like I have a handle on him and I spent the better part of a year trying to figure out what made him tick.&#8221;</p>
<p>The father of the deceased, Hy Greenbaum, has <a href="https://www.cbc.ca/news/canada/british-columbia/father-greenbaum-mass-reward-10k-davis-wolfgang-hawke-missing-dead-1.5784697" target="_blank" rel="noopener noreferrer">offered a $10,000 reward</a> to any tipster who can help solve his son&#8217;s homicide. British Columbia&#8217;s Integrated Homicide Investigation Team also is seeking clues, and can be reached at ihitinfo@rcmp-grc.gc.ca.</p>


feed_id: https://krebsonsecurity.com/?p=53550
title: Ransomware Group Turns to Facebook Ads
uri: Ransomware-Group-Turns-to-Facebook-Ads
url: https://krebsonsecurity.com/2020/11/ransomware-group-turns-to-facebook-ads/
content:
<p>It&#8217;s bad enough that many ransomware gangs now have blogs where they publish data stolen from companies that refuse to make an extortion payment. Now, one crime group has started using hacked <strong>Facebook</strong> accounts to run ads publicly pressuring their ransomware victims into paying up.</p>
<p><a class="lightbox" href="media/5b0b0375.campari-fb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/campari-fb.png"><img loading="lazy" class="aligncenter wp-image-53552" src="media/5b0b0375.campari-fb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/campari-fb.png" alt="" width="598" height="391" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/11/campari-fb.png 1332w, https://krebsonsecurity.com/wp-content/uploads/2020/11/campari-fb-768x502.png 768w" sizes="(max-width: 598px) 100vw, 598px" /></a></p>
<p>On the evening of Monday, Nov. 9, an ad campaign apparently taken out by the <a href="https://resources.infosecinstitute.com/topic/ragnar-locker-malware-what-it-is-how-it-works-and-how-to-prevent-it-malware-spotlight/" target="_blank" rel="noopener noreferrer">Ragnar Locker Team</a> began appearing on Facebook. The ad was designed to turn the screws to the Italian beverage vendor <strong>Campari Group</strong>, which <a href="https://ftaonline.com/news/campari-group-vittima-di-un-attacco-malware" target="_blank" rel="noopener noreferrer">acknowledged on Nov. 3</a> that its computer systems had been <a href="https://www.zdnet.com/article/italian-beverage-vendor-campari-knocked-offline-after-ransomware-attack/" target="_blank" rel="noopener noreferrer">sidelined by a malware attack</a>.</p>
<p>On Nov. 6, Campari issued a follow-up statement saying &#8220;at this stage, we cannot completely exclude that some personal and business data has been taken.&#8221;</p>
<p>&#8220;This is ridiculous and looks like a big fat lie,&#8221; reads the Facebook ad campaign from the Ragnar crime group. &#8220;We can confirm that confidential data was stolen and we talking about huge volume of data.&#8221;</p>
<p>The ad went on to say Ragnar Locker Team had offloaded two terabytes of information and would give the Italian firm until 6 p.m. EST today (Nov. 10) to negotiate an extortion payment in exchange for a promise not to publish the stolen files.</p>
<p>The Facebook ad blitz was paid for by <strong>Hodson Event Entertainment</strong>, an account tied to <a href="http://www.djchrishodson.com" target="_blank" rel="noopener noreferrer">Chris Hodson</a>, a deejay based in Chicago. Contacted by KrebsOnSecurity, Hodson said his Facebook account indeed was hacked, and that the attackers had budgeted $500 for the entire campaign.</p>
<p>&#8220;I thought I had two-step verification turned on for all my accounts, but now it looks like the only one I didn&#8217;t have it set for was Facebook,&#8221; Hodson said.</p>
<p>Hodson said a review of his account shows the unauthorized campaign reached approximately 7,150 Facebook users, and generated 770 clicks, with a cost-per-result of 21 cents. Of course, it didn&#8217;t cost the ransomware group anything. Hodson said Facebook billed him $35 for the first part of the campaign, but apparently detected the ads as fraudulent sometime this morning before his account could be billed another $159 for the campaign.<span id="more-53550"></span></p>
<div id="attachment_53555" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/4ce4f57f.hodsoncampaign.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/hodsoncampaign.png"><img aria-describedby="caption-attachment-53555" loading="lazy" class="wp-image-53555" src="media/4ce4f57f.hodsoncampaign.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/hodsoncampaign.png" alt="" width="598" height="178" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/11/hodsoncampaign.png 1321w, https://krebsonsecurity.com/wp-content/uploads/2020/11/hodsoncampaign-768x228.png 768w" sizes="(max-width: 598px) 100vw, 598px" /></a><p id="caption-attachment-53555" class="wp-caption-text">The results of the unauthorized Facebook ad campaign. Image: Chris Hodson.</p></div>
<p>It&#8217;s not clear whether this was an isolated incident, or whether the fraudsters also ran ads using other hacked Facebook accounts. A spokesperson for Facebook said the company is still investigating the incident. A request for comment sent via email to Campari&#8217;s media relations team was returned as undeliverable.</p>
<p>But it seems likely we will continue to see more of this and other mainstream advertising efforts by ransomware groups going forward, even if victims really <a href="https://krebsonsecurity.com/2020/11/why-paying-to-delete-stolen-data-is-bonkers/" target="_blank" rel="noopener noreferrer">have no expectation that paying an extortion demand will result in criminals actually deleting or not otherwise using stolen data</a>.</p>
<p><strong>Fabian Wosar</strong>, chief technology officer at computer security firm <a href="https://www.emsisoft.com" target="_blank" rel="noopener noreferrer">Emsisoft</a>, said some ransomware groups have become especially aggressive of late in pressuring their victims to pay up.</p>
<p>&#8220;They have also started to call victims,&#8221; Wosar said. &#8220;They&#8217;re outsourcing to Indian call centers, who call victims asking when they are going to pay or have their data leaked.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=53522
title: Patch Tuesday, November 2020 Edition
uri: Patch-Tuesday-November-2020-Edition
url: https://krebsonsecurity.com/2020/11/patch-tuesday-november-2020-edition/
content:
<p><strong>Adobe</strong> and <strong>Microsoft</strong> each issued a bevy of updates today to plug critical security holes in their software. Microsoft&#8217;s release includes fixes for 112 separate flaws, including one zero-day vulnerability that is already being exploited to attack Windows users. Microsoft also is taking flak for changing its security advisories and limiting the amount of information disclosed about each bug.</p>
<p><img loading="lazy" class="aligncenter  wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="593" height="435" /></p>
<p>Some 17 of the 112 issues fixed in today&#8217;s patch batch involve &#8220;critical&#8221; problems in Windows, or those that can be exploited by malware or malcontents to seize complete, remote control over a vulnerable Windows computer without any help from users.</p>
<p>Most of the rest were assigned the rating &#8220;important,&#8221; which <a href="https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system" target="_blank" rel="noopener noreferrer">in Redmond parlance</a> refers to a vulnerability whose exploitation could &#8220;compromise the confidentiality, integrity, or availability of user data, or of the integrity or availability of processing resources.&#8221;</p>
<p>A chief concern among all these updates this month is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-17087" target="_blank" rel="noopener noreferrer">CVE-2020-17087</a>, which is an &#8220;important&#8221; bug in the Windows kernel that is already seeing active exploitation. CVE-2020-17087 is not listed as critical because it&#8217;s what&#8217;s known as a privilege escalation flaw that would allow an attacker who has already compromised a less powerful user account on a system to gain administrative control. In essence, it would have to be chained with another exploit.</p>
<p>Unfortunately, this is exactly what Google researchers described witnessing recently. On Oct. 20, <strong>Google</strong> released an update for its <strong>Chrome</strong> browser which fixed a bug (<a href="https://nvd.nist.gov/vuln/detail/CVE-2020-15999" target="_blank" rel="noopener noreferrer">CVE-2020-15999</a>) that was seen being used in conjunction with CVE-2020-17087 to compromise Windows users.</p>
<p>If you take a look at the advisory Microsoft released today for CVE-2020-17087 (or any others from today&#8217;s batch), you might notice they look a bit more sparse. That&#8217;s because Microsoft has opted to restructure those advisories around the <a href="https://nvd.nist.gov/vuln-metrics/cvss" target="_blank" rel="noopener noreferrer">Common Vulnerability Scoring System</a> (CVSS) format to more closely align the format of the advisories with that of other major software vendors.</p>
<p>But in so doing, Microsoft has also removed some useful information, such as the description explaining in broad terms the scope of the vulnerability, how it can be exploited, and what the result of the exploitation might be. Microsoft explained its reasoning behind this shift in <a href="https://msrc-blog.microsoft.com/2020/11/09/vulnerability-descriptions-in-the-new-version-of-the-security-update-guide/" target="_blank" rel="noopener noreferrer">a blog post</a>.</p>
<p>Not everyone is happy with the new format. <strong>Bob Huber</strong>, chief security officer at <a href="https://www.tenable.com" target="_blank" rel="noopener noreferrer">Tenable</a>, praised Microsoft for adopting an industry standard, but said the company should consider that folks who review Patch Tuesday releases aren’t security practitioners but rather IT counterparts responsible for actually applying the updates who often aren’t able (and shouldn’t have to) decipher raw CVSS data.</p>
<p>&#8220;With this new format, end users are completely blind to how a particular CVE impacts them,&#8221; Huber said. &#8220;What’s more, this makes it nearly impossible to determine the urgency of a given patch. It’s difficult to understand the benefits to end-users. However, it’s not too difficult to see how this new format benefits bad actors. They’ll reverse engineer the patches and, by Microsoft not being explicit about vulnerability details, the advantage goes to attackers, not defenders. Without the proper context for these CVEs, it becomes increasingly difficult for defenders to prioritize their remediation efforts.&#8221;<span id="more-53522"></span></p>
<p><strong>Dustin Childs </strong>with <strong>Trend Micro</strong>&#8216;s <a href="https://www.zerodayinitiative.com/" target="_blank" rel="noopener noreferrer">Zero Day Initiative</a> also puzzled over the lack of details included in Microsoft advisories tied to two other flaws fixed today &#8212; including one in <strong>Microsoft Exchange Server </strong>(<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16875" target="_blank" rel="noopener noreferrer">CVE-2020-16875</a>) and <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-17051" target="_blank" rel="noopener noreferrer">CVE-2020-17051</a>, which is a scary-looking weakness in the <strong>Windows Network File System (NFS)</strong>.</p>
<p>The Exchange problem, Childs said, was reported by the winner of the <a href="https://www.thezdi.com/blog/2020/1/21/pwn2own-miami-2020-schedule-and-live-results" target="_blank" rel="noopener noreferrer">Pwn2Own Miami bug finding contest</a>.</p>
<p>&#8220;With no details provided by Microsoft, we can only assume this is the bypass of CVE-2020-16875 he had previously mentioned,&#8221; Childs said. &#8220;It is very likely he will publish the details of these bugs soon. Microsoft rates this as important, but I would treat it as critical, especially since people seem to find it hard to patch Exchange at all.&#8221;</p>
<p>Likewise, with CVE-2020-17051, there was a noticeable lack of detail for bug that earned a CVSS score of 9.8 (10 is the most dangerous).</p>
<p>&#8220;With no description to work from, we need to rely on the CVSS to provide clues about the real risk from the bug,&#8221; Childs said. &#8220;Consider this is listed as no user interaction with low attack complexity, and considering NFS is a network service, you should treat this as wormable until we learn otherwise.&#8221;</p>
<p>Separately, Adobe today released updates to plug at least 14 security holes in Adobe Acrobat and Reader. Details about those fixes are available <a href="https://helpx.adobe.com/security/products/acrobat/apsb20-67.html" target="_blank" rel="noopener noreferrer">here</a>. There are no security updates for Adobe&#8217;s Flash Player, which Adobe has said will be retired at the end of the year. Microsoft, which has bundled versions of Flash with its Web browsers, says it plans to ship an update in December that will remove Flash from Windows PCs, and last month it made the removal tool <a href="https://support.microsoft.com/en-us/help/4577586/update-for-removal-of-adobe-flash-player" target="_blank" rel="noopener noreferrer">available for download</a>.</p>
<p>Windows 10 users should be aware that the operating system will download updates and install them on its own schedule, closing out active programs and rebooting the system. If you wish to ensure Windows has been set to pause updating so you can back up your files and/or system, see <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">this guide</a>.</p>
<p>But please do back up your system before applying any of these updates. Windows 10 even has <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">some built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>As always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips.</p>


feed_id: https://krebsonsecurity.com/?p=53573
title: Be Very Sparing in Allowing Site Notifications
uri: Be-Very-Sparing-in-Allowing-Site-Notifications
url: https://krebsonsecurity.com/2020/11/be-very-sparing-in-allowing-site-notifications/
content:
<p>An increasing number of websites are asking visitors to approve &#8220;notifications,&#8221; browser modifications that periodically display messages on the user&#8217;s mobile or desktop device. In many cases these notifications are benign, but several dodgy firms are paying site owners to install their notification scripts and then selling that communications pathway to scammers and online hucksters.</p>
<div id="attachment_53599" style="width: 600px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53599" loading="lazy" class=" wp-image-53599" src="media/23b6c420.notifications.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/notifications.png" alt="" width="590" height="108" /><p id="caption-attachment-53599" class="wp-caption-text">Notification prompts in Firefox (left) and Google Chrome.</p></div>
<p>When a website you visit asks permission to send notifications and you approve the request, the resulting messages that pop up appear outside of the browser. For example, on Microsoft Windows systems they typically show up in the bottom right corner of the screen &#8212; just above the system clock. These so-called &#8220;push notifications&#8221; rely on <a href="https://tools.ietf.org/html/rfc8030" target="_blank" rel="noopener noreferrer">an Internet standard</a> designed to work similarly across different operating systems and web browsers.</p>
<p>But many users may not fully grasp what they are consenting to when they approve notifications, or how to tell the difference between a notification sent by a website and one made to appear like an alert from the operating system or another program that&#8217;s already installed on the device.</p>
<p>This is evident by the apparent scale of the infrastructure behind a relatively new company based in Montenegro called <strong>PushWelcome</strong>, which advertises the ability for site owners to monetize traffic from their visitors. The company&#8217;s site currently is <a href="https://www.alexa.com/siteinfo/pushwelcome.com" target="_blank" rel="noopener noreferrer">ranked by Alexa.com</a> as among the top 2,000 sites in terms of Internet traffic globally.</p>
<p>Website publishers who sign up with PushWelcome are asked to include a small script on their page which prompts visitors to approve notifications. In many cases, the notification approval requests themselves are deceptive &#8212; disguised as prompts to click &#8220;OK&#8221; to view video material, or as &#8220;CAPTCHA&#8221; requests designed to distinguish automated bot traffic from real visitors.</p>
<div id="attachment_53585" style="width: 606px" class="wp-caption aligncenter"><a href="media/1b95f533.pw-publishers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/pw-publishers.png"><img aria-describedby="caption-attachment-53585" loading="lazy" class="wp-image-53585" src="media/1b95f533.pw-publishers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/pw-publishers.png" alt="" width="596" height="493" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/11/pw-publishers.png 1051w, https://krebsonsecurity.com/wp-content/uploads/2020/11/pw-publishers-768x635.png 768w" sizes="(max-width: 596px) 100vw, 596px" /></a><p id="caption-attachment-53585" class="wp-caption-text">An ad from PushWelcome touting the money that websites can make for embedding their dodgy push notifications scripts.</p></div>
<p>Approving notifications from a site that uses PushWelcome allows any of the company&#8217;s advertising partners to display whatever messages they choose, whenever they wish to, and in real-time. And almost invariably, those messages include misleading notifications about security risks on the user&#8217;s system, prompts to install other software, ads for dating sites, erectile disfunction medications, and dubious investment opportunities.</p>
<p>That&#8217;s according to <a href="https://www.indelible.global/post/pushbug-uncovering-widespread-push-notification-rfc-8030-abuse-in-the-wild" target="_blank" rel="noopener noreferrer">a deep analysis</a> of the PushWelcome network compiled by <a href="https://www.indelible.global" target="_blank" rel="noopener noreferrer">Indelible LLC</a>, a cybersecurity firm based in Portland, Ore. <strong>Frank Angiolelli</strong>, vice president of security at Indelible, said rogue notifications can be abused for credential phishing, as well as foisting malware and other unwanted applications on users.</p>
<p>&#8220;This method is currently being used to deliver something akin to adware or click fraud type activity,&#8221; Angiolelli said. &#8220;The concerning aspect of this is that it is so very undetected by endpoint security programs, and there is a real risk this activity can be used for much more nefarious purposes.&#8221;</p>
<div id="attachment_53586" style="width: 606px" class="wp-caption aligncenter"><a href="media/f7d5c1f7.pw-deception.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/pw-deception.png"><img aria-describedby="caption-attachment-53586" loading="lazy" class="wp-image-53586" src="media/f7d5c1f7.pw-deception.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/pw-deception.png" alt="" width="596" height="318" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/11/pw-deception.png 1247w, https://krebsonsecurity.com/wp-content/uploads/2020/11/pw-deception-768x410.png 768w" sizes="(max-width: 596px) 100vw, 596px" /></a><p id="caption-attachment-53586" class="wp-caption-text">Sites affiliated with PushWelcome often use misleading messaging to trick people into approving notifications.</p></div>
<p><span id="more-53573"></span>Angiolelli said the external Internet addresses, browser user agents and other telemetry tied to people who&#8217;ve accepted notifications is known to PushWelcome, which could give them the ability to target individual organizations and users with any number of fake system prompts.</p>
<p>Indelible also found browser modifications enabled by PushWelcome are poorly detected by antivirus and security products, although he noted Malwarebytes reliably flags as dangerous publisher sites that are associated with the notifications.</p>
<p>Indeed, Malwarebytes&#8217; <strong>Pieter Arntz</strong> warned about malicious browser push notifications <a href="https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/" target="_blank" rel="noopener noreferrer">in a January 2019 blog post</a>. That post includes detailed instructions on how to tell which sites you&#8217;ve allowed to send notifications, and how to remove them.</p>
<p>KrebsOnSecurity installed PushWelcome&#8217;s notifications on a brand new Windows test machine, and found that very soon after the system was peppered with alerts about malware threats supposedly found on the system. One notification was an ad for <strong>Norton</strong> antivirus; the other was for <strong>McAfee</strong>. Clicking either ultimately led to &#8220;buy now&#8221; pages at either Norton.com or McAfee.com.</p>
<div id="attachment_53589" style="width: 604px" class="wp-caption aligncenter"><a href="media/c9e8df20.pw-norton.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/pw-norton.png"><img aria-describedby="caption-attachment-53589" loading="lazy" class="wp-image-53589" src="media/c9e8df20.pw-norton.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/pw-norton.png" alt="" width="594" height="297" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/11/pw-norton.png 1803w, https://krebsonsecurity.com/wp-content/uploads/2020/11/pw-norton-768x384.png 768w, https://krebsonsecurity.com/wp-content/uploads/2020/11/pw-norton-1536x768.png 1536w" sizes="(max-width: 594px) 100vw, 594px" /></a><p id="caption-attachment-53589" class="wp-caption-text">Clicking on the PushWelcome notification in the bottom right corner of the screen opened a Web site claiming my brand new test system was infected with 5 viruses.</p></div>
<p>It seems likely that PushWelcome and/or some of its advertisers are trying to generate commissions for referring customers to purchase antivirus products at these companies. McAfee has not yet responded to requests for comment. Norton issued the following statement:</p>
<blockquote><p>&#8220;We do not believe this actor to be an affiliate of NortonLifeLock. We are continuing to investigate this matter. NortonLifeLock takes affiliate fraud and abuse seriously and monitors ongoing compliance. When an affiliate partner abuses its responsibilities and violates our agreements, we take necessary action to remove these affiliate partners from the program and swiftly terminate our relationships. Additionally, any potential commissions earned as a result of abuse are not paid. Furthermore, NortonLifeLock sends notification to all of our affiliate partner networks about the affiliate’s abuse to ensure the affiliate is not eligible to participate in any NortonLifeLock programs in the future.&#8221;</p></blockquote>
<p><a href="media/207c7682.pw-mcafee2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/pw-mcafee2.png"><img loading="lazy" class="aligncenter wp-image-53590" src="media/207c7682.pw-mcafee2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/pw-mcafee2.png" alt="" width="597" height="311" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/11/pw-mcafee2.png 1794w, https://krebsonsecurity.com/wp-content/uploads/2020/11/pw-mcafee2-768x400.png 768w, https://krebsonsecurity.com/wp-content/uploads/2020/11/pw-mcafee2-1536x801.png 1536w" sizes="(max-width: 597px) 100vw, 597px" /></a></p>
<p>Requests for comment sent to PushWelcome via email were returned as undeliverable. Requests submitted through the contact form on the company&#8217;s website also failed to send.</p>
<p>While scammy notifications may not be the most urgent threat facing Internet users today, most people are probably unaware of how this communications pathway can be abused.</p>
<p>What&#8217;s more, dodgy notification networks could be used for less conspicuous and sneakier purposes, including spreading fake news and malware masquerading as update notices from the user&#8217;s operating system. I hope it&#8217;s clear that regardless of which browser, device or operating system you use, it&#8217;s a good idea to be judicious about which sites you allow to serve notifications.</p>


feed_id: https://krebsonsecurity.com/?p=53618
title: Trump Fires Security Chief Christopher Krebs
uri: Trump-Fires-Security-Chief-Christopher-Krebs
url: https://krebsonsecurity.com/2020/11/trump-fires-security-chief-christopher-krebs/
content:
<p><strong>President Trump</strong> on Tuesday fired his top election security official <strong>Christopher Krebs</strong> (no relation). The dismissal came via Twitter two weeks to the day after Trump lost an election he baselessly claims was stolen by widespread voting fraud.</p>
<div id="attachment_53632" style="width: 603px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53632" loading="lazy" class=" wp-image-53632" src="media/97d87d38.krebs-cisa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/krebs-cisa.png" alt="" width="593" height="375" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/11/krebs-cisa.png 967w, https://krebsonsecurity.com/wp-content/uploads/2020/11/krebs-cisa-768x485.png 768w" sizes="(max-width: 593px) 100vw, 593px" /><p id="caption-attachment-53632" class="wp-caption-text">Chris Krebs. Image: CISA.</p></div>
<p>Krebs, 43, is a former Microsoft executive appointed by Trump to head the <strong>Cybersecurity and Infrastructure Security Agency</strong> (CISA), a division of the <strong>U.S. Department of Homeland Security</strong>. As part of that role, Krebs organized federal and state efforts to improve election security, and to dispel disinformation about the integrity of the voting process.</p>
<p>Krebs&#8217; dismissal was hardly unexpected. Last week, in the face of repeated statements by Trump that the president was robbed of re-election by buggy voting machines and millions of fraudulently cast ballots, Krebs&#8217; agency rejected the claims as &#8220;unfounded,&#8221; asserting that &#8220;the November 3rd election was the most secure in American history.&#8221;</p>
<p>In <a href="https://www.cisa.gov/news/2020/11/12/joint-statement-elections-infrastructure-government-coordinating-council-election" target="_blank" rel="noopener noreferrer">a statement on Nov. 12</a>, CISA declared &#8220;there is no evidence that any voting system deleted or lost votes, changed votes, or was in any way compromised.&#8221;</p>
<p>But in <a href="https://twitter.com/realDonaldTrump/status/1328852354049957888" target="_blank" rel="noopener noreferrer">a tweet Tuesday evening</a>, Trump called that assessment &#8220;highly inaccurate,&#8221; alleging there were &#8220;massive improprieties and fraud &#8212; including dead people voting, Poll watchers not allowed into polling locations, &#8216;glitches&#8217; in the voting machines that changed votes from Trump to Biden, late voting, and many more.&#8221;</p>
<p><img loading="lazy" class="aligncenter wp-image-53634" src="media/80fdd846.trump-krebs-tweets.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/trump-krebs-tweets.png" alt="" width="593" height="522" /></p>
<p>Twitter, as it has done with a remarkable number of the president&#8217;s tweets lately, flagged the statements as disputed.</p>
<p>By most accounts, Krebs was one of the more competent and transparent leaders in the Trump administration. But that same transparency may have cost him his job: Krebs&#8217; agency earlier this year launched &#8220;<a href="https://www.cisa.gov/rumorcontrol" target="_blank" rel="noopener noreferrer">Rumor Control</a>,&#8221; a blog that sought to address many of the conspiracy theories the president has perpetuated in recent days.</p>
<p><strong>Sen. Richard Burr</strong>, a Republican from North Carolina, <a href="https://www.burr.senate.gov/press/releases/senator-burr-statement-on-cisa-director-christopher-krebs-" target="_blank" rel="noopener noreferrer">said</a> Krebs had done &#8220;a remarkable job during a challenging time,&#8221; and that the &#8220;creative and innovative campaign CISA developed to promote cybersecurity should serve as a model for other government agencies.&#8221;</p>
<p><strong>Sen. Angus King,</strong> an Independent from Maine and co-chair of a commission to improve the nation&#8217;s cyber defense posture, called Krebs &#8220;an incredibly bright, high-performing, and dedicated public servant who has helped build up new cyber capabilities in the face of swiftly-evolving dangers.&#8221;</p>
<p>“By firing Mr. Krebs for simply doing his job, President Trump is inflicting severe damage on all Americans – who rely on CISA’s defenses, even if they don’t know it,&#8221; King said in <a href="https://www.king.senate.gov/newsroom/press-releases/solarium-co-chair-king-unjust-firing-of-cisa-director-krebs-makes-americans-less-safe" target="_blank" rel="noopener noreferrer">a written statement</a>. &#8220;If there’s any silver lining in this unjust decision, it’s this: I hope that President-elect Biden will recognize Chris’s contributions, and consult with him as the Biden administration charts the future of this critically important agency.”<span id="more-53618"></span></p>
<p>KrebsOnSecurity has received more than a few messages these past two weeks from readers who wondered why the much-anticipated threat from Russian or other state-sponsored hackers never appeared to materialize in this election cycle.</p>
<p>That seems a bit like asking why the year 2000 came to pass with very few meaningful disruptions from the <a href="https://en.wikipedia.org/wiki/Year_2000_problem" target="_blank" rel="noopener noreferrer">Y2K computer date rollover problem</a>. After all, in advance of the new millennium, the federal government organized a series of task forces that helped coordinate readiness for the changeover, and to minimize the impact of any disruptions.</p>
<p>But the question also ignores a key goal of previous foreign election interference attempts leading up to the 2016 U.S. presidential and 2018 mid-term elections. Namely, to sow fear, uncertainty, doubt, distrust and animosity among the electorate about the democratic process and its outcomes.</p>
<p>To that end, it&#8217;s difficult to see how anyone has done more to advance that agenda than President Trump himself, who has yet to concede the race and continues to challenge the result in state courts and in his public statements.</p>


feed_id: https://krebsonsecurity.com/?p=53615
title: Convicted SIM Swapper Gets 3 Years in Jail
uri: Convicted-SIM-Swapper-Gets-3-Years-in-Jail
url: https://krebsonsecurity.com/2020/11/convicted-sim-swapper-gets-3-years-in-jail/
content:
<p>A 21-year-old Irishman who pleaded guilty to charges of helping to steal millions of dollars in cryptocurrencies from victims has been sentenced to just under three years in prison. The defendant is part of an alleged conspiracy involving at least eight others in the United States who stand accused of theft via <strong>SIM swapping</strong>, a crime that involves convincing mobile phone company employees to transfer ownership of the target&#8217;s phone number to a device the attackers control.</p>
<p><img loading="lazy" class="aligncenter  wp-image-40415" src="media/618d5447.phonefraudsmaller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png" alt="" width="598" height="302" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png 609w, https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller-580x292.png 580w" sizes="(max-width: 598px) 100vw, 598px" /></p>
<p><strong>Conor Freeman</strong> of Dublin took part in the theft of more than two million dollars worth of cryptocurrency from different victims throughout 2018. Freeman was named as a member of a group of alleged SIM swappers called &#8220;The Community&#8221; <a href="https://krebsonsecurity.com/2019/05/nine-charged-in-alleged-sim-swapping-ring/" target="_blank" rel="noopener noreferrer">charged last year with wire fraud in connection with SIM swapping attacks that netted in excess of $2.4 million</a>.</p>
<p>Among the eight others accused are three former wireless phone company employees who allegedly helped the gang hijack mobile numbers tied to their targets. Prosecutors say the men would identify people likely to have significant cryptocurrency holdings, then pay their phone company cohorts to transfer the victim&#8217;s mobile service to a new SIM card &#8212; the smart chip in each phone that ties a customer&#8217;s device to their number.</p>
<p>A fraudulent SIM swap allows the bad guys to intercept a target&#8217;s incoming phone calls and text messages. This is dangerous because a great many sites and services still allow customers to reset their passwords simply by clicking on a link sent via SMS. From there, attackers can gain access to any accounts that allow password resets via SMS or automated calls, from email and social media profiles to virtual currency trading platforms.</p>
<p>Like other accused members of The Community, Freeman was an active member of <a href="https://krebsonsecurity.com/?s=ogusers&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">OGUsers</a>, a forum that caters to people selling access to hijacked social media and other online accounts. But unlike others in the group, Freeman used his real name (username: Conor), and disclosed his hometown and date of birth to others on the forum. At least twice in the past few years <a href="https://krebsonsecurity.com/2019/05/account-hijacking-forum-ogusers-hacked/" target="_blank" rel="noopener noreferrer">OGUsers was hacked</a>, and its database of profiles and user messages posted online.</p>
<p>According to a report in <a href="https://www.irishtimes.com/news/crime-and-law/courts/circuit-court/man-jailed-for-role-in-2-million-cryptocurrency-theft-1.4411641?mode=amp" target="_blank" rel="noopener noreferrer">The Irish Times</a>, Freeman spent approximately €130,000, which he had converted into cash from the stolen cryptocurrency. Conor posted on OGUsers that he spent approximately $14,000 on a Rolex watch. The rest was handed over to the police in the form of an electronic wallet that held the equivalent of more than $2 million.<span id="more-53615"></span></p>
<p>The Irish Times says the judge in the case insisted the three-year sentence was warranted in order to deter the defendant and to prevent others from following in his footsteps. The judge said stealing money of this order is serious because no one can know the effect it will have on the victim, noting that one victim&#8217;s life savings were taken and the proceeds of the sale of his house were stolen.</p>
<p>One way to protect your accounts against SIM swappers is to remove your phone number as a primary or secondary authentication mechanism wherever possible. Many online services require you to provide a phone number upon registering an account, but in many cases that number can be removed from your profile afterwards.</p>
<p>It&#8217;s also important for people to use something other than text messages for two-factor authentication on their email accounts when stronger authentication options are available. Consider instead using a mobile app like <strong>Authy</strong>, <strong>Duo</strong>, or <strong>Google Authenticator</strong> to generate the one-time code. Or better yet, <a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/" target="_blank" rel="noopener noreferrer">a physical security key</a> if that’s an option.</p>


feed_id: https://krebsonsecurity.com/?p=53649
title: GoDaddy Employees Used in Attacks on Multiple Cryptocurrency Services
uri: GoDaddy-Employees-Used-in-Attacks-on-Multiple-Cryptocurrency-Services
url:
https://krebsonsecurity.com/2020/11/godaddy-employees-used-in-attacks-on-multiple-cryptocurrency-services/

content:
<p>Fraudsters redirected email and web traffic destined for several cryptocurrency trading platforms over the past week. The attacks were facilitated by scams targeting employees at <strong>GoDaddy</strong>, the world&#8217;s largest domain name registrar, KrebsOnSecurity has learned.</p>
<p><img loading="lazy" class="aligncenter wp-image-46446" src="media/ec220502.godaddy.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/godaddy.jpg" alt="" width="599" height="312" /></p>
<p>The incident is the latest incursion at GoDaddy that relied on tricking employees into transferring ownership and/or control over targeted domains to fraudsters. In March, a voice phishing scam targeting GoDaddy support employees <a href="https://krebsonsecurity.com/2020/03/phish-of-godaddy-employee-jeopardized-escrow-com-among-others/" target="_blank" rel="noopener noreferrer">allowed attackers to assume control over at least a half-dozen domain names, including transaction brokering site escrow.com</a>.</p>
<p>And in May of this year, GoDaddy <a href="https://securityboulevard.com/2020/05/godaddy-data-breach-affects-28000-user-accounts/" target="_blank" rel="noopener noreferrer">disclosed that 28,000 of its customers&#8217; web hosting accounts were compromised</a> following a security incident in Oct. 2019 that wasn&#8217;t discovered until April 2020.</p>
<p>This latest campaign appears to have begun on or around Nov. 13, with an attack on cryptocurrency trading platform <strong>liquid.com</strong>.</p>
<p>&#8220;A domain hosting provider &#8216;GoDaddy&#8217; that manages one of our core domain names incorrectly transferred control of the account and domain to a malicious actor,&#8221; <strong>Liquid CEO Kayamori</strong> said in <a href="https://blog.liquid.com/security-incident-november-13-2020?=11172020" target="_blank" rel="noopener noreferrer">a blog post</a>. &#8220;This gave the actor the ability to change DNS records and in turn, take control of a number of internal email accounts. In due course, the malicious actor was able to partially compromise our infrastructure, and gain access to document storage.&#8221;</p>
<p>In the early morning hours of Nov. 18 Central European Time (CET), cyptocurrency mining service <a href="https://www.nicehash.com" target="_blank" rel="noopener noreferrer">NiceHash</a> disccovered that some of the settings for its domain registration records at GoDaddy were changed without authorization, briefly redirecting email and web traffic for the site. NiceHash froze all customer funds for roughly 24 hours until it was able to verify that its domain settings had been changed back to their original settings.</p>
<p>&#8220;At this moment in time, it looks like no emails, passwords, or any personal data were accessed, but we do suggest resetting your password and activate 2FA security,&#8221; the company wrote <a href="https://www.nicehash.com/blog/post/nicehash-is-back-online-what-happened" target="_blank" rel="noopener noreferrer">in a blog post</a>.</p>
<p>NiceHash founder <a href="https://krebsonsecurity.com/?s=Matjaz+Skorjanc&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">Matjaz Skorjanc</a> said the unauthorized changes were made from an Internet address at GoDaddy, and that the attackers tried to use their access to its incoming NiceHash emails to perform password resets on various third-party services, including <strong>Slack</strong> and <strong>Github</strong>. But he said GoDaddy was impossible to reach at the time because <a href="https://domainnamewire.com/2020/11/17/godaddy-is-down/" target="_blank" rel="noopener noreferrer">it was undergoing a widespread system outage in which phone and email systems were unresponsive</a>.</p>
<p>&#8220;We detected this almost immediately [and] started to mitigate [the] attack,&#8221; Skorjanc said in an email to this author. &#8220;Luckily, we fought them off well and they did not gain access to any important service. Nothing was stolen.&#8221;</p>
<p>Skorjanc said NiceHash&#8217;s email service was redirected to <strong>privateemail.com</strong>, an email platform run by <a href="https://krebsonsecurity.com/?s=namecheap&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">Namecheap Inc.</a>, another large domain name registrar. Using <a href="https://www.scout.dnsdb.info" target="_blank" rel="noopener noreferrer">Farsight Security</a>, a service which maps changes to domain name records over time, KrebsOnSecurity instructed the service to show all domains registered at GoDaddy that had alterations to their email records in the past week which pointed them to privateemail.com. Those results were then indexed against the top one million most popular websites according to Alexa.com.</p>
<p>The result shows that several other cryptocurrency platforms also may have been targeted by the same group, including <a href="https://www.bibox.com" target="_blank" rel="noopener noreferrer">Bibox.com</a>, <a href="https://www.celsius.network" target="_blank" rel="noopener noreferrer">Celsius.network</a>, and <a href="https://www.wirex.app" target="_blank" rel="noopener noreferrer">Wirex.app</a>. None of these companies responded to requests for comment.</p>
<p>In response to questions from KrebsOnSecurity, GoDaddy acknowledged that &#8220;a small number&#8221; of customer domain names had been modified after a &#8220;limited&#8221; number of GoDaddy employees fell for a social engineering scam. GoDaddy said the outage between 7:00 p.m. and 11:00 p.m. PST on Nov. 17 was not related to a security incident, but rather a technical issue that materialized during planned network maintenance.</p>
<p>&#8220;Separately, and unrelated to the outage, a routine audit of account activity identified potential unauthorized changes to a small number of customer domains and/or account information,&#8221; GoDaddy spokesperson <strong>Dan Race</strong> said. <span class="pullquote pqleft">&#8220;Our security team investigated and confirmed threat actor activity, including social engineering of a limited number of GoDaddy employees.</span>&#8221;</p>
<p>&#8220;We immediately locked down the accounts involved in this incident, reverted any changes that took place to accounts, and assisted affected customers with regaining access to their accounts,&#8221; GoDaddy&#8217;s statement continued. &#8220;As threat actors become increasingly sophisticated and aggressive in their attacks, we are constantly educating employees about new tactics that might be used against them and adopting new security measures to prevent future attacks.&#8221;</p>
<p>Race declined to specify how its employees were tricked into making the unauthorized changes, saying the matter was still under investigation. But <a href="https://krebsonsecurity.com/2020/03/phish-of-godaddy-employee-jeopardized-escrow-com-among-others/" target="_blank" rel="noopener noreferrer">in the attacks earlier this year that affected escrow.com and several other GoDaddy customer domains</a>, the assailants targeted employees over the phone, and were able to read internal notes that GoDaddy employees had left on customer accounts.</p>
<p>What&#8217;s more, the attack on escrow.com redirected the site to an Internet address in Malaysia that hosted fewer than a dozen other domains, including the phishing website <strong>servicenow-godaddy.com</strong>. This suggests the attackers behind the March incident &#8212; and possibly this latest one &#8212; succeeded by calling GoDaddy employees and convincing them to use their employee credentials at a fraudulent GoDaddy login page.<span id="more-53649"></span></p>
<p>In August 2020, KrebsOnSecurity warned about a marked increase in large corporations <a href="https://krebsonsecurity.com/2020/08/voice-phishers-targeting-corporate-vpns/" target="_blank" rel="noopener noreferrer">being targeted in sophisticated voice phishing or &#8220;vishing&#8221; scams</a>. Experts say the success of these scams has been aided greatly by many employees working remotely thanks to the ongoing Coronavirus pandemic.</p>
<p>A typical vishing scam begins with a series of phone calls to employees working remotely at a targeted organization. The phishers often will explain that they’re calling from the employer’s IT department to help troubleshoot issues with the company’s email or virtual private networking (VPN) technology.</p>
<p>The goal is to convince the target either to divulge their credentials over the phone or to input them manually at a website set up by the attackers that mimics the organization’s corporate email or VPN portal.</p>
<p>On July 15, a number of high-profile Twitter accounts were used <a href="https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/" target="_blank" rel="noopener noreferrer">to tweet out a bitcoin scam that earned more than $100,000 in a few hours</a>. According to Twitter, that attack succeeded because the perpetrators were able to social engineer several Twitter employees over the phone into giving away access to internal Twitter tools.</p>
<p><a href="https://krebsonsecurity.com/2020/08/fbi-cisa-echo-warnings-on-vishing-threat/" target="_blank" rel="noopener noreferrer">An alert</a> issued jointly by the <strong>FBI</strong> and the <strong>Cybersecurity and Infrastructure Security Agency</strong> (CISA) says the perpetrators of these vishing attacks compile dossiers on employees at their targeted companies using mass scraping of public profiles on social media platforms, recruiter and marketing tools, publicly available background check services, and open-source research.</p>
<p>The FBI/CISA advisory includes a number of suggestions that companies can implement to help mitigate the threat from vishing attacks, including:</p>
<p>• Restrict VPN connections to managed devices only, using mechanisms like hardware checks or installed certificates, so user input alone is not enough to access the corporate VPN.</p>
<p>• Restrict VPN access hours, where applicable, to mitigate access outside of allowed times.</p>
<p>• Employ domain monitoring to track the creation of, or changes to, corporate, brand-name domains.</p>
<p>• Actively scan and monitor web applications for unauthorized access, modification, and anomalous activities.</p>
<p>• Employ the principle of least privilege and implement software restriction policies or other controls; monitor authorized user accesses and usage.</p>
<p>• Consider using a formalized authentication process for employee-to-employee communications made over the public telephone network where a second factor is used to<br />
authenticate the phone call before sensitive information can be discussed.</p>
<p>• Improve 2FA and OTP messaging to reduce confusion about employee authentication attempts.</p>
<p>• Verify web links do not have misspellings or contain the wrong domain.</p>
<p>• Bookmark the correct corporate VPN URL and do not visit alternative URLs on the sole basis of an inbound phone call.</p>
<p>• Be suspicious of unsolicited phone calls, visits, or email messages from unknown individuals claiming to be from a legitimate organization. Do not provide personal information or information about your organization, including its structure or networks, unless you are certain of a person’s authority to have the information. If possible, try to verify the caller’s identity directly with the company.</p>
<p>• If you receive a vishing call, document the phone number of the caller as well as the domain that the actor tried to send you to and relay this information to law enforcement.</p>
<p>• Limit the amount of personal information you post on social networking sites. The internet is a public resource; only post information you are comfortable with anyone seeing.</p>
<p>• Evaluate your settings: sites may change their options periodically, so review your security and privacy settings regularly to make sure that your choices are still appropriate.</p>


feed_id: https://krebsonsecurity.com/?p=53698
title: Bomb Threat, DDoS Purveyor Gets Eight Years
uri: Bomb-Threat-DDoS-Purveyor-Gets-Eight-Years
url: https://krebsonsecurity.com/2020/12/bomb-threat-ddos-purveyor-gets-eight-years/
content:
<p>A 22-year-old North Carolina man has been sentenced to nearly eight years in prison for conducting bomb threats against thousands of schools in the U.S. and United Kingdom, running a service that launched distributed denial-of-service (DDoS) attacks, and for possessing sexually explicit images of minors.</p>
<p><strong>Timothy Dalton Vaughn</strong> from Winston-Salem, N.C. was a key member of the <strong>Apophis Squad</strong>, a gang of young ne’er-do-wells who made bomb threats to more than 2,400 schools and launched DDoS attacks against countless Web sites — including KrebsOnSecurity on multiple occasions.</p>
<p>The Justice Department says Vaughn and his gang ran a DDoS-for-hire service that they used to shake down victims.</p>
<p>&#8220;In early 2018, Vaughn demanded 1.5 bitcoin (then worth approximately $20,000) from a Long Beach company, to prevent denial-of-service attacks on its website,&#8221; reads a statement from <strong>Nicola Hanna</strong>, U.S. attorney for the Central District of California. &#8220;When the company refused to pay, he launched a DDoS attack that disabled the company’s website.&#8221;</p>
<div id="attachment_45027" style="width: 580px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-45027" loading="lazy" class=" wp-image-45027" src="media/267d1780.apophis-tweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/apophis-tweet.png" alt="" width="570" height="460" /><p id="caption-attachment-45027" class="wp-caption-text">One of many tweets from the attention-starved Apophis Squad, which launched multiple DDoS attacks against KrebsOnSecurity over the past few months.</p></div>
<p>Dalton, whose online aliases included “WantedbyFeds” and “Hacker_R_US,” pleaded guilty last year to one count of conspiracy to convey threats to injure, convey false information concerning use of explosive device, and intentionally damage a computer; one count of computer hacking; and one count of possession of child pornography.</p>
<p>Federal judge <strong>Otis D. Wright II</strong> sentenced Vaughn to 95 months for possessing 200 sexually explicit images and videos depicting children, including at least one toddler, the Justice Department said. Vaughn was sentenced to 60 months in federal prison for the remaining charge. The sentences will be served concurrently. <span id="more-53698"></span></p>
<p>As <a href="https://krebsonsecurity.com/2019/02/bomb-threat-hoaxer-exposed-by-hacked-gaming-site/" target="_blank" rel="noopener noreferrer">KrebsOnSecurity noted in 2019</a>, Vaughn&#8217;s identity was revealed by following the trail of clues from a gaming website he used that later got hacked.</p>
<p>Vaughn used multiple aliases on Twitter and elsewhere to crow about his attacks, including “<strong>HDGZero</strong>,” “<strong>WantedByFeds</strong>,” and “<strong>Xavier Farbel</strong>.” Among the Apophis Squad’s targets was encrypted mail service Protonmail, which reached out to this author in 2018 for clues about the identities of the Apophis Squad members after noticing we were both being targeted by them and receiving demands for money in exchange for calling off the attacks.</p>
<p>Protonmail later <a href="https://krebsonsecurity.com/2018/09/leader-of-ddos-for-hire-gang-pleads-guilty-to-bomb-threats/" target="_blank" rel="noopener noreferrer">publicly thanked KrebsOnSecurity</a> for helping to bring about the arrest of Apophis Squad leader <strong>George Duke-Cohan</strong> — a.k.a. “opt1cz,” “7R1D3n7,” and “Pl3xl3t,” — a 19-year-old from the United Kingdom who was convicted in December 2018 and <a href="https://krebsonsecurity.com/2018/12/bomb-threat-hoaxer-ddos-boss-gets-3-years/" target="_blank" rel="noopener noreferrer">sentenced to three years in prison</a>. But the real-life identity of HDGZero remained a mystery to both of us, as there was little publicly available information at the time connecting that moniker to anyone.</p>
<div id="attachment_45028" style="width: 605px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-45028" loading="lazy" class=" wp-image-45028" src="media/dab13071.as-booter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/as-booter.png" alt="" width="595" height="524" /><p id="caption-attachment-45028" class="wp-caption-text">The DDoS-for-hire service run by Apophis Squad listed their members.</p></div>
<p>That is, until early January 2019, when news broke that hackers had broken into the servers of computer game maker BlankMediaGames and made off with account details of some 7.6 million people who had signed up to play “Town of Salem,” a browser-based role playing game. That stolen information has since been posted and resold in underground forums.</p>
<p>A review of the leaked BlankMediaGames user database shows that in late 2018, someone who selected the username “hdgzero” signed up to play Town of Salem, registering with the email address xavierfarbel@gmail.com. The data also showed this person registered at the site using a Sprint mobile device with an Internet address that traced back to the Carolinas.</p>


feed_id: https://krebsonsecurity.com/?p=53685
title: Account Hijacking Site OGUsers Hacked, Again
uri: Account-Hijacking-Site-OGUsers-Hacked-Again
url: https://krebsonsecurity.com/2020/12/account-hijacking-site-ogusers-hacked-again/
content:
<p>For at least the third time in its existence,<strong> OGUsers</strong> &#8212; a forum overrun with people looking to buy, sell and trade access to compromised social media accounts &#8212; has been hacked.</p>
<div id="attachment_53695" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/178587b0.oguoffer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/oguoffer.png"><img aria-describedby="caption-attachment-53695" loading="lazy" class="wp-image-53695" src="media/178587b0.oguoffer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/oguoffer.png" alt="" width="596" height="422" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/11/oguoffer.png 1040w, https://krebsonsecurity.com/wp-content/uploads/2020/11/oguoffer-768x544.png 768w" sizes="(max-width: 596px) 100vw, 596px" /></a><p id="caption-attachment-53695" class="wp-caption-text">An offer by the apparent hackers of OGUsers, offering to remove account information from the eventual database leak in exchange for payment.</p></div>
<p>Roughly a week ago, the OGUsers homepage was defaced with a message stating the forum&#8217;s user database had been compromised. The hack was acknowledged by the forum&#8217;s current administrator, who assured members that their passwords were protected with a password obfuscation technology that was extremely difficult to crack.</p>
<p>But unlike in previous breaches at OGUsers, the perpetrators of this latest incident have not yet released the forum database. In the meantime, someone has been taunting forum members, saying they can have their profiles and private messages removed from an impending database leak by paying between $50 and $100.</p>
<p>OGUsers was hacked at least twice previously, <a href="https://krebsonsecurity.com/2019/05/account-hijacking-forum-ogusers-hacked/" target="_blank" rel="noopener noreferrer">in May 2019</a> and again in March 2020. In the wake of both incidents, the compromised OGUsers databases were made available for public download.<span id="more-53685"></span></p>
<p>The leaked databases have been useful in reconstructing who&#8217;s behind several high-profile incidents involving compromised social media accounts and virtual currency heists that leveraged <a href="https://krebsonsecurity.com/?s=sim+swapping&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">SIM swapping</a>, a crime that centers around convincing mobile phone company employees to transfer ownership of the target’s phone number to a device the attackers control.</p>
<p>For example, when <a href="https://krebsonsecurity.com/?s=twitter+hack&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">several high-profile Twitter accounts were hacked in July 2020</a> and used to promote bitcoin scams, the profile and private message data from previous OGUser forum compromises proved invaluable in piecing together the &#8220;who&#8221; behind that scam.</p>
<p>The hacker handles featured in the defacement message left on OGUsers &#8212; &#8220;<strong>Chinese</strong>&#8221; and &#8220;<strong>Disco</strong>&#8221; &#8212; correspond to two nicknames used by banned OGUser members who have been trying to generate interest for their own forum that seeks to emulate OGUsers.</p>
<p>Disco, a.k.a &#8220;<strong>Discoli</strong>&#8221; a.k.a. &#8220;Disco Dog,&#8221; is a young man from the United Kingdom who has marketed an automated bot program and service advertised as a way for customers to &#8220;cash out&#8221; illicit access to OneVanilla Visa prepaid card accounts using PayPal. The same individual also earlier this year founded a corporation in the U.K. called <a href="https://find-and-update.company-information.service.gov.uk/company/12490733" target="_blank" rel="noopener noreferrer">Disco Payments</a>.</p>
<p>Reached via Twitter, Discoli said he and his friends hacked OGUsers via an outdated plugin used by the site. But he claims they have no plans to sell the stolen user data, and said the company was registered as a joke.</p>
<p>&#8220;I had a sort of feud with the administrator in the past but this one was more for fun,&#8221; Discoli said. &#8220;Not too interested in doing damage by releasing database or anything like that.&#8221;</p>
<p>As I noted the first time OGUsers got hacked, it’s difficult not to admit feeling a bit of <a href="https://en.wikipedia.org/wiki/Schadenfreude" target="_blank" rel="noopener noreferrer">schadenfreude</a> in the continued exposure of a community that has largely specialized in hacking others. Or perhaps in the case of OGUsers, the sentiment may more aptly be described as &#8220;schadenfraud.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=53716
title: IRS to Make ID Protection PIN Open to All
uri: IRS-to-Make-ID-Protection-PIN-Open-to-All
url: https://krebsonsecurity.com/2020/12/irs-to-make-id-protection-pin-open-to-all/
content:
<p>The <strong>U.S. Internal Revenue Service</strong> (IRS) said this week that beginning in 2021 it will allow all taxpayers to apply for an identity protection personal identification number (IP PIN), a single-use code designed to block identity thieves from falsely claiming a tax refund in your name. Currently, IP PINs are issued only to those who fill out an ID theft affidavit, or to taxpayers who&#8217;ve experienced tax refund fraud in previous years.</p>
<p><img loading="lazy" class="aligncenter  wp-image-42398" src="media/69b57c63.taxthiefa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/taxthiefa.png" alt="" width="594" height="218" /></p>
<p>Tax refund fraud is <a href="https://krebsonsecurity.com/?s=tax+refund+fraud&amp;x=0&amp;y=0">a perennial problem</a> involving the use of identity information and often stolen or misdirected W-2 forms to electronically file an unauthorized tax return for the purposes of claiming a refund in the name of a taxpayer.</p>
<p>Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. <em>Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS.  </em></p>
<p>Many of the reasons why refund fraud remains a problem have to do with timing, and some of them are described in more detail <a href="https://taxpayeradvocate.irs.gov/news/nta-blog-irs-fraud-detection-process-is-challenging-for-taxpayers-to-navigate-part-1" target="_blank" rel="noopener noreferrer">here</a>. But the short answer is the IRS is under tremendous pressure to issue refunds quickly and to minimize &#8220;false positives&#8221; (flagging legitimate claims as fraud) &#8212; even when it may not yet have all of the information needed to accurately distinguish phony filings from legitimate ones. <span id="more-53716"></span></p>
<p>One way the IRS has sought to stem the flow of bogus tax refund applications is to issue the IP PIN, which is a six-digit number assigned to eligible taxpayers to help prevent the use of their Social Security number on a fraudulent income tax return. Each PIN is good only for the tax year for which it was issued.</p>
<p>But up until now, the IRS has restricted who can apply for an IP PIN, although it has over the past few years issued them proactively to some taxpayers as part of a multi-state experiment to determine if doing so more widely might reduce the overall incidence of refund fraud.</p>
<p>The IRS <a href="https://www.irs.gov/newsroom/national-tax-security-awareness-week-day-3-irs-expands-identity-protection-pin-opt-in-program-to-taxpayers-nationwide" target="_blank" rel="noopener noreferrer">says</a> it will make its Get IP PIN tool available to all taxpayers in mid-January. Until then, if you haven&#8217;t already done so <a href="https://krebsonsecurity.com/2020/08/why-where-you-should-you-plant-your-flag/" target="_blank" rel="noopener noreferrer">you should plant your flag</a> at the IRS by stepping through the agency&#8217;s &#8220;secure access authentication&#8221; process.</p>
<p><a href="https://sa.www4.irs.gov/ola/" target="_blank" rel="noopener noreferrer">Creating an account</a> requires supplying a great deal of personal data; the information that will be requested is <a href="https://www.irs.gov/individuals/secure-access-how-to-register-for-certain-online-self-help-tools" target="_blank" rel="noopener noreferrer">listed here</a>.</p>
<p>The signup process requires one to validate ownership of a mobile phone number in one&#8217;s name, and it will reject any voice-over-IP-based numbers services such as those tied to Skype or Google Voice. If the process fails at this point, the site should offer to send an activation code via postal mail to your address on file.</p>


feed_id: https://krebsonsecurity.com/?p=53728
title: Patch Tuesday, Good Riddance 2020 Edition
uri: Patch-Tuesday-Good-Riddance-2020-Edition
url: https://krebsonsecurity.com/2020/12/patch-tuesday-good-riddance-2020-edition/
content:
<p><strong>Microsoft</strong> today issued its final batch of security updates for <strong>Windows</strong> PCs in 2020, ending the year with a relatively light patch load. Nine of the 58 security vulnerabilities addressed this month earned Microsoft&#8217;s most-dire &#8220;critical&#8221; label, meaning they can be abused by malware or miscreants to seize remote control over PCs without any help from users.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="579" height="425" /></p>
<p>Mercifully, it does not appear that any of the flaws fixed this month are being actively exploited, nor have any them been detailed publicly prior to today.</p>
<p>The critical bits reside in updates for <strong>Microsoft Exchange Server</strong>, <strong>Sharepoint Server</strong>, and <strong>Windows 10</strong> and <strong>Server 2016</strong> systems. Additionally, Microsoft <a href="https://msrc.microsoft.com/update-guide/vulnerability/ADV200013" target="_blank" rel="noopener noreferrer">released an advisory</a> on how to minimize the risk from a DNS spoofing weakness in Windows Server 2008 through 2019.</p>
<p>Some of the sub-critical &#8220;important&#8221; flaws addressed this month also probably deserve prompt patching in enterprise environments, including a trio of updates tackling security issues with <strong>Microsoft Office</strong>.</p>
<p>&#8220;Given the speed with which attackers often weaponize Microsoft Office vulnerabilities, these should be prioritized in patching,&#8221; said <strong>Allan Liska</strong>, senior security architect at <strong>Recorded Future</strong>. &#8220;The vulnerabilities, if exploited, would allow an attacker to execute arbitrary code on a victim’s machine. These vulnerabilities affect Microsoft Excel 2013 through 2019, Microsoft 365 32 and 64 bit versions, Microsoft Office 2019 32 and 64 bit versions, and Microsoft Excel for Mac 2019.&#8221;</p>
<p>We also learned this week that Redmond quietly addressed a scary <a href="https://thehackernews.com/2020/12/zero-click-wormable-rce-vulnerability.html" target="_blank" rel="noopener noreferrer">&#8220;zero-click&#8221; vulnerability</a> in its <strong>Microsoft Teams</strong> platform that would have let anyone execute code of their choosing just by sending the target a specially-crafted chat message to a Teams users. The bug was cross-platform, meaning it could also have been used to deliver malicious code to people using Teams on non-Windows devices.<span id="more-53728"></span></p>
<p>Researcher <strong>Oskars Vegeris</strong> <a href="https://github.com/oskarsve/ms-teams-rce/blob/main/README.md" target="_blank" rel="noopener noreferrer">said in a proof-of-concept post to Github</a> that he reported the flaw to Microsoft at the end of August, but that Microsoft didn&#8217;t assign the bug a Common Vulnerabilities and Exposure (CVE) rating because it has a policy of not doing so for bugs that can be fixed from Microsoft&#8217;s end without user interaction.</p>
<p>According to Vegeris, Microsoft addressed the Teams flaw at the end of October. But he said the bug they fixed was the first of five zero or one-click remote code execution flaws he has found and reported in Teams. Reached via LinkedIn, Vegeris declined to say whether Microsoft has yet addressed the remaining Teams issues.</p>
<p>Separately, <strong>Adobe</strong> <a href="https://blogs.adobe.com/psirt/?p=1947" target="_blank" rel="noopener noreferrer">issued security updates</a> for its <strong>Prelude</strong>, <strong>Experience Manager</strong> and <strong>Lightroom software</strong>. There were no security updates for Adobe Flash Player, which is fitting considering Adobe is sunsetting the program at the end of the year. Microsoft is taking steps to remove Flash from its Windows browsers, and Google and Firefox already block Flash by default.</p>
<p>It’s a good idea for Windows users to get in the habit of updating at least once a month, but for regular users (read: not enterprises) it’s usually safe to wait a few days until after the patches are released, so that Microsoft has time to iron out any chinks in the new armor.</p>
<p>But before you update, <em>please</em> make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates have been known to erase or corrupt files.</p>
<p>So do yourself a favor and backup before installing any patches. Windows 10 even has some <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">see this guide</a>.</p>
<p>As always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips.</p>


feed_id: https://krebsonsecurity.com/?p=53731
title: Payment Processing Giant TSYS: Ransomware Incident “Immaterial” to Company
uri: Payment-Processing-Giant-TSYS-Ransomware-Incident-Immaterial-to
url:
https://krebsonsecurity.com/2020/12/payment-processing-giant-tsys-ransomware-incident-immaterial-to-company/

content:
<p>Payment card processing giant <strong>TSYS</strong> suffered a ransomware attack earlier this month. Since then reams of data stolen from the company have been posted online, with the attackers promising to publish more in the coming days. But the company says the malware did not jeopardize card data, and that the incident was limited to administrative areas of its business.</p>
<p><img loading="lazy" class="aligncenter wp-image-53747" src="media/d0877195.tsys.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/12/tsys.png" alt="" width="593" height="390" /></p>
<p>Headquartered in Columbus, Ga., <a href="https://www.tsys.com" target="_blank" rel="noopener noreferrer">Total System Services Inc.</a> (TSYS) is the third-largest third-party payment processor for financial institutions in North America, and a major processor in Europe.</p>
<p>TSYS provides payment processing services, merchant services and other payment solutions, including prepaid debit cards and payroll cards. In 2019, TSYS was acquired by financial services firm <a href="https://krebsonsecurity.com/?s=global+payments&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">Global Payments Inc.</a> [<a href="https://www.marketwatch.com/investing/stock/gpn" target="_blank" rel="noopener noreferrer">NYSE:GPN</a>].</p>
<p>On December 8, the cybercriminal gang responsible for deploying the <strong>Conti</strong> ransomware strain (also known as &#8220;<a href="https://krebsonsecurity.com/?s=ryuk&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">Ryuk</a>&#8220;) published more than 10 gigabytes of data that it claimed to have removed from TSYS&#8217;s networks.</p>
<p>Conti is one of several cybercriminal groups that maintains a blog which publishes data stolen from victims in a bid to force the negotiation of ransom payments. The gang claims the data published so far represents just 15 percent of the information it offloaded from TSYS before detonating its ransomware inside the company.</p>
<p>In a written response to requests for comment, TSYS said the attack did not affect systems that handle payment card processing.</p>
<p>&#8220;We experienced a ransomware attack involving systems that support certain corporate back office functions of a legacy <span class="il">TSYS</span> merchant business,&#8221; TSYS said. &#8220;We immediately contained the suspicious activity and the business is operating normally.&#8221;<span id="more-53731"></span></p>
<p>According to Conti, the &#8220;legacy&#8221; TSYS business unit hit was <a href="https://en.wikipedia.org/wiki/Cayan" target="_blank" rel="noopener noreferrer">Cayan</a>, an entity acquired by TSYS in 2018 that enables payments in physical stores and mobile locations, as well as e-commerce.</p>
<p>Conti claims prepaid card data was compromised, but TSYS says this is not the case.</p>
<p>&#8220;Transaction processing is conducted on separate systems, has continued without interruption and no card data was impacted,&#8221; the statement continued. &#8220;We regret any inconvenience this issue may have caused. This matter is immaterial to the company.&#8221;</p>
<p>TSYS declined to say whether it paid any ransom. But according to <strong>Fabian Wosar</strong>, chief technology officer at computer security firm <a href="https://www.emsisoft.com" target="_blank" rel="noopener noreferrer">Emsisoft</a>, Conti typically only publishes data from victims that refuse to negotiate a ransom payment.</p>
<p>Some ransomware groups have shifted to demanding two separate ransom payments; one to secure a digital key that unlocks access to servers and computers held hostage by the ransomware, and a second in return for a promise not to publish or sell any stolen data. However, Conti so far has not adopted the latter tactic, Wosar said.</p>
<p>&#8220;Conti almost always does steal data, but we haven&#8217;t seen them negotiating for leaks and keys separately,&#8221; he explained. &#8220;For the negotiations we have seen it has always been one price for everything (keys, deletion of data, no leaks etc.).&#8221;</p>
<p>According to a report released last month by the <strong>Financial Services Information Sharing and Analysis Center</strong> (FS-ISAC), an industry consortium aimed at fighting cyber threats, the banking industry remains a primary target of ransomware groups. FS-ISAC said at least eight financial institutions were hit with ransomware attacks in the previous four months. The report notes that by a wide margin, Ryuk continues to be the most prolific ransomware threat targeting financial services firms.</p>


feed_id: https://krebsonsecurity.com/?p=53771
title: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise
uri: U-S-Treasury-Commerce-Depts-Hacked-Through-SolarWinds-Compromise
url:
https://krebsonsecurity.com/2020/12/u-s-treasury-commerce-depts-hacked-through-solarwinds-compromise/

content:
<p>Communications at the <strong>U.S. Treasury</strong> and <strong>Commerce Departments</strong> were reportedly compromised by a supply chain attack on <strong>SolarWinds</strong>, a security vendor that helps the federal government and a range of Fortune 500 companies monitor the health of their IT networks. Given the breadth of the company&#8217;s customer base, experts say the incident may be just the first of many such disclosures.</p>
<div id="attachment_53774" style="width: 607px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53774" loading="lazy" class=" wp-image-53774" src="media/2f3e0bc7.solarwindscustomers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/12/solarwindscustomers.png" alt="" width="597" height="679" /><p id="caption-attachment-53774" class="wp-caption-text">Some of SolarWinds&#8217; customers. Source: solarwinds.com</p></div>
<p>According to <a href="https://www.reuters.com/article/BigStory12/idUSKBN28N0PG" target="_blank" rel="noopener noreferrer">a Reuters story</a>, hackers believed to be working for Russia have been monitoring internal email traffic at the U.S. Treasury and Commerce departments. Reuters reports the attackers were able to surreptitiously tamper with updates released by SolarWinds for its <a href="https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Core-How-Orion-Works-sw1625.htm" target="_blank" rel="noopener noreferrer">Orion platform</a>, a suite of network management tools.</p>
<p>In <a href="https://www.solarwinds.com/securityadvisory" target="_blank" rel="noopener noreferrer">a security advisory</a>, Austin, Texas based SolarWinds acknowledged its systems &#8220;experienced a highly sophisticated, manual supply chain attack on SolarWinds Orion Platform software builds for versions 2019.4 HF 5 through 2020.2.1, released between March 2020 and June 2020.&#8221;</p>
<p>In response to the intrusions at Treasury and Commerce, the Department of Homeland Security&#8217;s <strong>Cybersecurity and Infrastructure Security Agency</strong> (CISA) took the unusual step of issuing <a href="https://cyber.dhs.gov/ed/21-01/" target="_blank" rel="noopener noreferrer">an emergency directive</a> ordering all federal agencies to immediately disconnect the affected Orion products from their networks.</p>
<p>&#8220;Treat all hosts monitored by the SolarWinds Orion monitoring software as compromised by threat actors and assume that further persistence mechanisms have been deployed,&#8221; CISA advised.</p>
<p>According to <a href="https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/" target="_blank" rel="noopener noreferrer">a blog post</a> by <strong>Microsoft</strong>, the attackers were able to add malicious code to software updates provided by SolarWinds for Orion users. &#8220;This results in the attacker gaining a foothold in the network, which the attacker can use to gain elevated credentials,&#8221; Microsoft wrote.</p>
<p>From there, the attackers would be able to forge single sign-on tokens that impersonate any of the organization&#8217;s existing users and accounts, including highly privileged accounts on the network.</p>
<p>&#8220;Using highly privileged accounts acquired through the technique above or other means, attackers may add their own credentials to existing application service principals, enabling them to call APIs with the permission assigned to that application,&#8221; Microsoft explained.</p>
<p>Malicious code added to an Orion software update may have gone undetected by antivirus software and other security tools on host systems thanks in part to guidance from SolarWinds itself. In <a href="https://support.solarwinds.com/SuccessCenter/s/article/Files-and-directories-to-exclude-from-antivirus-scanning-for-Orion-Platform-products?language=en_US" target="_blank" rel="noopener noreferrer">this support advisory</a>, SolarWinds says its products may not work properly unless their file directories are exempted from antivirus scans and group policy object restrictions.<span id="more-53771"></span></p>
<p>The Reuters story quotes several anonymous sources saying the intrusions at the Commerce and Treasury departments could be just the tip of the iceberg. That seems like a fair bet.</p>
<p>SolarWinds <a href="https://www.solarwinds.com/company/customers" target="_blank" rel="noopener noreferrer">says</a> it has over 300,000 customers including:</p>
<p>-more than 425 of the U.S. Fortune 500<br />
-all ten of the top ten US telecommunications companies<br />
-all five branches of the U.S. military<br />
-all five of the top five U.S. accounting firms<br />
-the Pentagon<br />
-the State Department<br />
-the National Security Agency<br />
-the Department of Justice<br />
-The White House.</p>
<p>It&#8217;s unclear how many of the customers listed on SolarWinds&#8217; website are users of the affected Orion products. But Reuters reports the supply chain attack on SolarWinds is connected to a broad campaign that also involved <a href="https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html" target="_blank" rel="noopener noreferrer">the recently disclosed hack at FireEye</a>, wherein hackers gained access to a slew of proprietary tools the company uses to help customers find security weaknesses in their computers and networks.</p>
<p>The compromises at the U.S. federal agencies are thought to date back to earlier this summer, and are being blamed on hackers working for the Russian government. FireEye said its breach was the work of <a href="https://en.wikipedia.org/wiki/Cozy_Bear" target="_blank" rel="noopener noreferrer">APT 29</a>, a.k.a. &#8220;Cozy Bear,&#8221; a Russian hacker group believed to be associated with one or more intelligence agencies of Russia.</p>


feed_id: https://krebsonsecurity.com/?p=53791
title: SolarWinds Hack Could Affect 18K Customers
uri: SolarWinds-Hack-Could-Affect-18K-Customers
url: https://krebsonsecurity.com/2020/12/solarwinds-hack-could-affect-18k-customers/
content:
<p>The still-unfolding breach at network management software firm <strong>SolarWinds</strong> may have resulted in malicious code being pushed to nearly 18,000 customers, the company said in a legal filing on Monday. Meanwhile, <strong>Microsoft</strong> should soon have some idea which and how many SolarWinds customers were affected, as it recently took possession of a key domain name used by the intruders to control infected systems.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-53813" src="media/69d70039.swlogo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/12/swlogo.png" alt="" width="512" height="120" /></p>
<p>On Dec. 13, SolarWinds acknowledged that hackers had inserted malware into a service that provided software updates for its <strong>Orion</strong> platform, a suite of products used broadly by the U.S. federal government and Fortune 500 firms to monitor the health of their IT networks.</p>
<p>In <a href="media/12d98cde.57108215-4458-4dd8-a5bf-55bd5e34d451.pdf" data-original-source="https://d18rn0p25nwr6d.cloudfront.net/CIK-0001739942/57108215-4458-4dd8-a5bf-55bd5e34d451.pdf" target="_blank" rel="noopener noreferrer">a Dec. 14 filing</a> with the <strong>U.S. Securities and Exchange Commission</strong> (SEC), SolarWinds said roughly 33,000 of its more than 300,000 customers were Orion customers, and that fewer than 18,000 customers may have had an installation of the Orion product that contained the malicious code. SolarWinds said the intrusion also compromised its Microsoft Office 365 accounts.</p>
<p>The initial breach disclosure from SolarWinds came five days after cybersecurity incident response firm <strong>FireEye</strong> announced it had suffered an intrusion that resulted in the theft of some 300 proprietary software tools the company provides to clients to help secure their IT operations.</p>
<p>On Dec. 13, FireEye <a href="https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html" target="_blank" rel="noopener noreferrer">published a detailed writeup</a> on the malware infrastructure used in the SolarWinds compromise, presenting evidence that the Orion software was first compromised back in March 2020. FireEye didn&#8217;t explicitly say its own intrusion was the result of the SolarWinds hack, but the company confirmed as much to KrebsOnSecurity earlier today.</p>
<p>Also on Dec. 13, news broke that the SolarWinds hack resulted in attackers reading the email communications at the <strong>U.S. Treasury</strong> and <strong>Commerce</strong> departments.</p>
<p>On Dec. 14, Reuters <a href="https://www.reuters.com/article/us-global-cyber-usa-dhs-idUSKBN28O2LY" target="_blank" rel="noopener noreferrer">reported</a> the SolarWinds intrusion also had been used to infiltrate computer networks at the <strong>U.S. Department of Homeland Security</strong> (DHS). That disclosure came less than 24 hours after DHS&#8217;s <strong>Cybersecurity and Infrastructure Security Agency</strong> (CISA) took the unusual step of issuing <a href="https://cyber.dhs.gov/ed/21-01/" target="_blank" rel="noopener noreferrer">an emergency directive</a> ordering all federal agencies to immediately disconnect the affected Orion products from their networks.</p>
<h4>ANALYSIS</h4>
<p>Security experts have been speculating as to the extent of the damage from the SolarWinds hack, combing through details in the FireEye analysis and elsewhere for <a href="https://github.com/bambenek/research/tree/main/sunburst" target="_blank" rel="noopener noreferrer">clues about how many other organizations may have been hit</a>.</p>
<p>And it seems that Microsoft may now be in perhaps the best position to take stock of the carnage. That&#8217;s because sometime on Dec. 14, the software giant took control over a key domain name &#8212; <strong>avsvmcloud[.]com</strong> &#8212; that was used by the SolarWinds hackers to communicate with systems compromised by the backdoored Orion product updates.</p>

<a href='https://krebsonsecurity.com/2020/12/solarwinds-hack-could-affect-18k-customers/whois-avsv/'><img width="128" height="82" src="media/a9bce54e.whois-avsv.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/12/whois-avsv.png" class="attachment-thumbnail size-thumbnail" alt="" loading="lazy" /></a>
<a href='https://krebsonsecurity.com/2020/12/solarwinds-hack-could-affect-18k-customers/pdns-lookup-e/'><img width="124" height="96" src="media/f6a632ed.pdns-lookup-e.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/12/pdns-lookup-e.png" class="attachment-thumbnail size-thumbnail" alt="" loading="lazy" /></a>
<a href='https://krebsonsecurity.com/2020/12/solarwinds-hack-could-affect-18k-customers/pdns-e2/'><img width="108" height="96" src="media/ef570b6d.pdns-e2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/12/pdns-e2.png" class="attachment-thumbnail size-thumbnail" alt="" loading="lazy" /></a>

<p>Armed with that access, Microsoft should be able to tell which organizations have IT systems that are still trying to ping the malicious domain. However, because many Internet service providers and affected companies are already blocking systems from accessing that malicious control domain or have disconnected the vulnerable Orion services, Microsoft&#8217;s visibility may be somewhat limited.</p>
<p>Microsoft has a long history of working with federal investigators and the U.S. courts <a href="https://krebsonsecurity.com/?s=microsoft+takedown&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">to seize control over domains involved in global malware menaces</a>, particularly when those sites are being used primarily to attack Microsoft Windows customers.</p>
<p>Microsoft dodged direct questions about its visibility into the malware control domain, suggesting those queries would be better put to FireEye or <strong>GoDaddy</strong> (the current domain registrar for the malware control server). But in <a href="https://twitter.com/securityjones/status/1338885261460008960" target="_blank" rel="noopener noreferrer">a response on Twitter</a>, Microsoft spokesperson <strong>Jeff Jones</strong> seemed to confirm that control of the malicious domain had changed hands.<span id="more-53791"></span></p>
<p>Neither FireEye nor Godaddy has responded to questions about the malicious domain. FireEye declined to answer questions about exactly when it learned of its own intrusion via the Orion compromise, or approximately when attackers first started offloading sensitive tools from FireEye&#8217;s network. But the question is an interesting one because its answer may speak to the motivations and priorities of the hackers.</p>
<p>Based on the timeline known so far, the perpetrators of this elaborate hack would have had a fairly good idea back in March which of SolarWinds&#8217; 18,000 Orion customers were worth targeting, and perhaps even in what order.</p>
<p><strong>Alan Paller</strong>, director of research for the <strong>SANS Institute</strong>, a security education and training company based in Maryland, said the attackers likely chose to prioritize their targets based on some calculation of risk versus reward.</p>
<p>Paller said the bad guys probably sought to balance the perceived strategic value of compromising each target with the relative likelihood that exploiting them might result in the entire operation being found out and dismantled.</p>
<p>&#8220;The way this probably played out is the guy running the cybercrime team asked his people to build a spreadsheet where they ranked targets by the value of what they could get from each victim,&#8221; Paller said. &#8220;And then next to that they likely put a score for how good the malware hunters are at the targets, and said let&#8217;s first go after the highest priority ones that have a hunter score of less than a certain amount.&#8221;</p>
<p>The breach at SolarWinds could well turn into an existential event for the company, depending on how customers react and how SolarWinds is able to weather the lawsuits that will almost certainly ensue.</p>
<p>&#8220;The lawsuits are coming, and I hope they have a good general counsel,&#8221; said <strong>James Lewis</strong>, senior vice president at the <strong>Center for Strategic and International Studies</strong>. &#8220;Now that the government is telling people to turn off [the SolarWinds] software, the question is will anyone turn it back on?&#8221;</p>
<p>According to its SEC filing, total revenue from the Orion products across all customers &#8212; including those who may have had an installation of the Orion products that contained the malicious update &#8212; was approximately $343 million, or roughly 45 percent of the firm&#8217;s total revenue. SolarWinds&#8217; stock price has fallen 25 percent since news of the breach first broke.</p>
<p>Some of the legal and regulatory fallout may hinge on what SolarWinds knew or should have known about the incident, when, and how it responded. For example,<strong> Vinoth Kumar</strong>, a cybersecurity &#8220;bug hunter&#8221; who has earned cash bounties and recognition from multiple companies for reporting security flaws in their products and services, <a href="https://twitter.com/briankrebs/status/1338549067924770817" target="_blank" rel="noopener noreferrer">posted on Twitter</a> that he notified SolarWinds in November 2019 that the company&#8217;s software download website was protected by a simple password that was published in the clear on SolarWinds&#8217; code repository at Github.</p>
<p><a href="media/e6ce48b7.kumartweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/12/kumartweet.png"><img loading="lazy" class="aligncenter wp-image-53805" src="media/e6ce48b7.kumartweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/12/kumartweet.png" alt="" width="593" height="473" /></a></p>
<p><strong>Andrew Morris</strong>, founder of the security firm <strong>GreyNoise Intelligence</strong>, on <a href="https://twitter.com/Andrew___Morris/status/1338614208905302021" target="_blank" rel="noopener noreferrer">said that as of Tuesday evening</a> SolarWinds still hadn&#8217;t removed the compromised Orion software updates from its distribution server.</p>
<p><a href="media/2a52dca8.morristweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/12/morristweet.png"><img loading="lazy" class="aligncenter wp-image-53806" src="media/2a52dca8.morristweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/12/morristweet.png" alt="" width="594" height="446" /></a></p>
<p>Another open question is how or whether the incoming U.S. Congress and presidential administration will react to this apparently broad cybersecurity event. CSIS&#8217;s Lewis says he doubts lawmakers will be able to agree on any legislative response, but he said it&#8217;s likely the Biden administration will do something.</p>
<p>&#8220;It will be a good new focus for DHS, and the administration can issue an executive order that says federal agencies with regulatory authority need to manage these things better,&#8221; Lewis said. &#8220;But whoever did this couldn&#8217;t have picked a better time to cause a problem, because their timing almost guarantees a fumbled U.S. response.&#8221;</p>


