# articles

feed_id: http://krebsonsecurity.com/?p=32876
title: DHS Giving Firms Free Penetration Tests
uri: DHS-Giving-Firms-Free-Penetration-Tests
url: http://krebsonsecurity.com/2015/12/dhs-giving-firms-free-penetration-tests/
content:
<p dir="ltr">The <strong>U.S. Department of Homeland Security</strong> (DHS) has been quietly launching stealthy cyber attacks against a range of private U.S. companies &#8212; mostly banks and energy firms. These digital intrusion attempts, commissioned in advance by the private sector targets themselves, are part of a little-known program at DHS designed to help &#8220;critical infrastructure&#8221; companies shore up their computer and network defenses against real-world adversaries. And it&#8217;s all free of charge (well, on the U.S. taxpayer&#8217;s dime).</p>
<div id="attachment_33139" style="width: 590px" class="wp-caption aligncenter"><a href="media/4e445263.cyberhygienemap.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/cyberhygienemap.png"><img class="size-medium wp-image-33139" src="media/8fd929dd.cyberhygienemap-580x388.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/cyberhygienemap-580x388.png" alt="Organizations participating in DHS's &quot;Cyber Hygiene&quot; vulnerability scans. Source: DHS" width="580" height="388" /></a><p class="wp-caption-text">Organizations participating in DHS&#8217;s &#8220;Cyber Hygiene&#8221; vulnerability scans. Source: DHS</p></div>
<p>KrebsOnSecurity first learned about DHS&#8217;s <strong>National Cybersecurity Assessment and Technical Services</strong> (NCATS) program after hearing from a risk manager at a small financial institution in the eastern United States. The manager was comparing the free services offered by NCATS with private sector offerings and was seeking my opinion. I asked around to a number of otherwise clueful sources who had no idea this DHS program even existed.</p>
<p dir="ltr">DHS declined requests for an interview about NCATS, but the agency <a href="media/70f94351.Agency-Acceptance-Letter-CH-Service-SLTT_PS.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/Agency-Acceptance-Letter-CH-Service-SLTT_PS.pdf" target="_blank">has published some information</a> about the program. According to DHS, the NCATS program offers full-scope penetration testing capabilities in the form of two separate programs: a &#8220;Risk and Vulnerability Assessment,&#8221; (RVA) and a &#8220;Cyber Hygiene&#8221; evaluation. Both are designed to help the partner organization better understand how external systems and infrastructure appear to potential attackers.</p>
<p>“The Department of Homeland Security (DHS) works closely with public and private sector partners to strengthen the security and resilience of their systems against evolving threats in cyberspace,&#8221; <strong>DHS spokesperson</strong> <strong>Sy Lee</strong> wrote in an email response to an interview request. &#8220;The National Cybersecurity Assessments and Technical Services (NCATS) team focuses on proactively engaging with federal, state, local, tribal, territorial and private sector stakeholders to assist them in improving their cybersecurity posture, limit exposure to risks and threats, and reduce rates of exploitation. As part of this effort, the NCATS team offers cybersecurity services such as red team and penetration testing and vulnerability scanning at no cost.”</p>
<p dir="ltr">The RVA program reportedly includes scans the target&#8217;s operating systems, databases, and Web applications for known vulnerabilities, and then tests to see if any of the weaknesses found can be used to successfully compromise the target&#8217;s systems. In addition, RVA program participants receive scans for rogue wireless devices, and their employees are tested with &#8220;social engineering&#8221; attempts to see how employees respond to targeted phishing attacks.</p>
<p dir="ltr">The Cyber Hygiene program &#8212; which is currently mandatory for agencies in the federal civilian executive branch but optional for private sector and state, local and tribal stakeholders &#8212; includes both internal and external vulnerability and Web application scanning.</p>
<p dir="ltr">The reports show detailed information about the organization&#8217;s vulnerabilities, including suggested steps to mitigate the flaws.  DHS uses the aggregate information from each client and creates a yearly non-attributable report. The FY14 End of Year report created with data from the Cyber Hygiene and RVA program is <a href="media/c477507f.DHS-NCATS-FY14-Annual-Report.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/DHS-NCATS-FY14-Annual-Report.pdf" target="_blank">here</a> (PDF).</p>
<p dir="ltr">Among the findings in that report, which drew information from more than 100 engagements last year:</p>
<p>-Manual testing was required to identify 67 percent of the RVA vulnerability findings (as opposed to off-the-shelf, automated vulnerability scans);</p>
<p>-More than 50 percent of the total 344 vulnerabilities found during the scans last year earned a severity rating of &#8220;high&#8221; (4o percent) or &#8220;critical&#8221; (13 percent).</p>
<p>-RVA phishing emails resulted in a click rate of 25 percent.</p>
<div id="attachment_33132" style="width: 590px" class="wp-caption aligncenter"><a href="media/45cb7c80.ncats14vulns.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/ncats14vulns.png"><img class="size-medium wp-image-33132" src="media/e49e87af.ncats14vulns-580x234.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/ncats14vulns-580x234.png" alt="Data from NCATS FY 2014 Report." width="580" height="234" /></a><p class="wp-caption-text">Data from NCATS FY 2014 Report.</p></div>
<p dir="ltr"> <span style="text-decoration: underline;">ANALYSIS</span></p>
<p dir="ltr">I was curious to know how many private sector companies had taken DHS up on its rather generous offers, since these services can be quite expensive if conducted by private companies. In response to questions from this author, DHS said that in Fiscal Year 2015 NCATS provided support to 53 private sector partners.  According to data provided by DHS, the majority of the program’s private sector participation come from the financial services and energy sectors &#8212; typically at regional or smaller institutions.</p>
<p dir="ltr">DHS has taken its lumps over the years for not doing enough to gets its own cybersecurity house in order, let alone helping industry fix its problems. In light of its past cybersecurity foibles, the NCATS program on the surface would seem like a concrete step toward blunting those criticisms.</p>
<p dir="ltr">I wondered how someone in the penetration testing industry would feel about the government throwing its free services into the ring. <strong>Dave Aitel</strong> is chief technology officer at <strong>Immunity Inc.</strong>, a Miami Beach, Fla. based security firm that offers many of the same services NCATS bundles in its product.<span id="more-32876"></span></p>
<p><a href="media/197ba130.cyberhygiene.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/cyberhygiene.png"><img class="alignright size-full wp-image-33138" src="media/197ba130.cyberhygiene.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/cyberhygiene.png" alt="cyberhygiene" width="250" height="338" /></a></p>
<p dir="ltr">Aitel said one of the major benefits for DHS in offering NCATS is that it can use the program learn about real-world vulnerabilities in critical infrastructure companies.</p>
<p dir="ltr">&#8220;DHS is a big player in the &#8216;regulation&#8217; policy area, and the last thing we need is an uninformed DHS that has little technical expertise in the areas that penetration testing covers,&#8221; Aitel said. &#8220;The more DHS understands about the realities of information security on the ground &#8211; the more it treats American companies as their customers &#8211; the better and less impactful their policy recommendations will be. We always say that Offense is the professor of Defense, and in this case, without having gone on the offense DHS would be helpless to suggest remedies to critical infrastructure companies.&#8221;</p>
<p dir="ltr">Of course, the downsides are that sometimes you get what you pay for, and the NCATS offering raises some interesting questions, Aitel said.</p>
<p dir="ltr">&#8220;Even if the DHS team doing the work is great, part of the value of an expensive penetration test is that companies feel obligated to follow the recommendations and improve their security,&#8221; he said. &#8220;Does the data found by a DHS testing team affect a company’s SEC liabilities in any way? What if the Government gets access to customer data during a penetration test &#8211; what legal ramifications does that have? This is a common event and pre-CISPA it may carry significant liability.&#8221;</p>
<p dir="ltr">As far as the potential legal ramifications of any mistakes DHS may or may not make in its assessments, the <a href="media/70f94351.Agency-Acceptance-Letter-CH-Service-SLTT_PS.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/Agency-Acceptance-Letter-CH-Service-SLTT_PS.pdf" target="_blank">acceptance letter</a> (PDF) that all NCATS customers must sign says DHS provides no warranties of any kind related to the free services. The <a href="media/70f94351.Agency-Acceptance-Letter-CH-Service-SLTT_PS.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/11/Agency-Acceptance-Letter-CH-Service-SLTT_PS.pdf" target="_blank">rules of engagement letter</a> from DHS further lays out ground rules and specifics of the NCATS testing services.</p>
<p dir="ltr">Aitel, a former research scientist at the <strong>National Security Agency</strong> (NSA), raised another issue: Any vulnerabilities found anywhere within the government &#8212; for example, in a piece of third party software &#8212; are supposed to go to the NSA for triage, and sometimes the NSA is later able to use those vulnerabilities in clandestine cyber offensive operations.</p>
<p dir="ltr">But what about previously unknown vulnerabilities found by DHS examiners?</p>
<p dir="ltr">&#8220;This may be less of an issue when DHS uses a third party team, but if they use a DHS team, and they find a bug in <strong>Microsoft IIS</strong> (Web server), that’s not going to the customer &#8211; that’s going to the NSA,&#8221; Aitel said.</p>
<p dir="ltr">And then there are potential legal issues with the government <a href="https://www.whitehouse.gov/omb/circulars_a076_a76_incl_tech_correction/" target="_blank">competing with private industry</a>.</p>
<p dir="ltr"><strong>Alan Paller</strong>, director of research at the <strong>SANS Institute</strong>, a Bethesda, Md. based security training group, isn&#8217;t so much concerned about the government competing with the private sector for security audits. But he said DHS is giving away something big with its free assessments: An excuse for the leadership at scanned organizations for not doing anything after the assessment and using the results as a way to actually spend less on security.</p>
<p dir="ltr">&#8220;The NCATS program could be an excellent service that does a lot of good but it isn’t,&#8221; Paller said. &#8220;The problem is that it measures only a very limited subset of of the vulnerability space but comes with a gold plated get out of jail free card: &#8216;The US government came and checked us.&#8217; They say they are doing it only for organizations that cannot afford commercial assessments, but they often go to organizations that have deep enough pockets.&#8221;</p>
<p dir="ltr">According to Paller, despite what the NCATS documents say, the testers do not do active penetration tasks against the network. Rather, he said, they are constrained by their rules of engagement.</p>
<p dir="ltr">&#8220;Mostly they do architectural assessments and traffic analysis,&#8221; he said. &#8220;They get a big packet capture and they baseline and profile and do some protocol analysis (wireless).&#8221;</p>
<p dir="ltr">Paller said the sort of network architecture review offered by DHS&#8217;s scans can only tell you so much, and that the folks doing it do not have deep experience with one of the more arcane aspects of critical infrastructure systems: Industrial control systems of the sort that might be present in an energy firm that turns to NCATS for its cybersecurity assessment.</p>
<p dir="ltr">&#8220;In general the architectural reviews are done by younger folks with little real world experience,&#8221; Paller said. &#8220;The big problem is that the customer is not fully briefed on the limitations of what is being done in their assessment and testing.&#8221;</p>
<p dir="ltr">Does your organization have experience with NCATs assessments? Are you part of a <a href="http://www.dhs.gov/what-critical-infrastructure" target="_blank">critical infrastructure</a> company that might use these services? Would you? Sound off in the comments below.</p>


feed_id: http://krebsonsecurity.com/?p=33391
title: Malware-Driven Card Breach at Hyatt Hotels
uri: Malware-Driven-Card-Breach-at-Hyatt-Hotels
url: http://krebsonsecurity.com/2015/12/malware-driven-card-breach-at-hyatt-hotels/
content:
<p><strong>Hyatt Hotels Corporation</strong> said today it recently discovered malicious software designed to steal credit card data on computers that operate the payment processing systems for Hyatt-managed locations.</p>
<p><img class="alignright size-full wp-image-33392" src="media/a55f8920.hyatt.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/12/hyatt.png" alt="hyatt" width="237" height="231" />Hyatt&#8217;s <a href="http://newsroom.hyatt.com/news-releases?item=123450" target="_blank">notice to customers</a> has very few details about the investigation, such as how long the breach lasted or how many consumers may have had their card data stolen as a result. Hyatt did say that it has taken steps to strengthen its systems, and that &#8220;customers can feel confident using payment cards at Hyatt hotels worldwide.&#8221;</p>
<p>As of September 30, 2015, Chicago-based Hyatt&#8217;s worldwide portfolio included 627 properties in 52 countries.</p>
<p>Hyatt joins a crowded list of other hotel chains similarly breached in the past year, including <a href="http://krebsonsecurity.com/2015/11/hilton-acknowledges-credit-card-breach/" target="_blank">Hilton</a>, <a href="http://krebsonsecurity.com/2015/11/starwood-hotels-warns-of-credit-card-breach/" target="_blank">Starwood</a>, <a href="http://krebsonsecurity.com/2015/03/credit-card-breach-at-mandarian-oriental/" target="_blank">Mandarin Oriental</a>, <a href="http://krebsonsecurity.com/2015/04/white-lodging-confirms-second-breach/" target="_blank">White Lodging</a> and the <a href="http://krebsonsecurity.com/2015/10/trump-hotel-collection-confirms-card-breach/" target="_blank">Trump Collection</a>.</p>


feed_id: http://krebsonsecurity.com/?p=33360
title: Expect Phishers to Up Their Game in 2016
uri: Expect-Phishers-to-Up-Their-Game-in-2016
url: http://krebsonsecurity.com/2015/12/expect-phishers-to-up-their-game-in-2016/
content:
<p>Expect phishers and other password thieves to up their game in 2016: Both <strong>Google</strong> and <strong>Yahoo!</strong> are taking steps to kill off the password as we know it.</p>
<p><img class="alignright size-medium wp-image-15419" src="media/67d1a1f1.passcrack-285x189.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2012/06/passcrack-285x189.jpg" alt="passcrack" width="285" height="189" srcset="http://krebsonsecurity.com/wp-content/uploads/2012/06/passcrack-285x189.jpg 285w, http://krebsonsecurity.com/wp-content/uploads/2012/06/passcrack.jpg 425w" sizes="(max-width: 285px) 100vw, 285px" />New authentication methods now offered by Yahoo! and to a beta group of Google users let customers log in just by supplying their email address, and then responding to a notification sent to their mobile device.</p>
<p>According to <a href="http://techcrunch.com/2015/12/22/google-begins-testing-password-free-logins/#.roh86c2:xuvl" target="_blank">TechCrunch</a>, Google is giving select <strong>Gmail</strong> users a password-free means of signing in. It uses a &#8220;push&#8221; notification sent to your phone that then opens an app where you approve the log-in.</p>
<p>The article says the service Google is experimenting with will let users sign in without entering a password, but that people can continue to use their typed password if they choose. It also says Google may still ask for your password as an additional security measure if it notices anything unusual about a login attempt.</p>
<p>The new authentication feature being tested by some Gmail users comes on the heels of a similar service Yahoo! debuted in October 2015. That offering, called &#8220;<strong>on-demand passwords</strong>,&#8221; will text users a random four-character code (the ones I saw were all uppercase letters) that needs to be entered into a browser or mobile device.</p>
<p><img class="aligncenter size-medium wp-image-33368" src="media/72a4685e.yahoogetstarted-580x186.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/12/yahoogetstarted-580x186.png" alt="yahoogetstarted" width="580" height="186" srcset="http://krebsonsecurity.com/wp-content/uploads/2015/12/yahoogetstarted-580x186.png 580w, http://krebsonsecurity.com/wp-content/uploads/2015/12/yahoogetstarted-768x246.png 768w, http://krebsonsecurity.com/wp-content/uploads/2015/12/yahoogetstarted.png 775w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>This is not Yahoo!&#8217;s first stab at two-factor authentication. Another security feature it has offered for years &#8212; called &#8220;two-step verification&#8221; &#8212; sends a security code to your phone when you log in from new devices, but only <em>after</em> you supply your password. Yahoo! users who wish to take advantage of the passwords-free, on-demand password feature will need to disable two-step verification for on-demand passwords to work.</p>
<p><span id="more-33360"></span></p>
<p><img class="aligncenter size-full wp-image-33367" src="media/a008afa4.disabletwostep.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/12/disabletwostep.png" alt="disabletwostep" width="327" height="204" /></p>
<p>Yahoo! also warns that some non-Yahoo apps like <strong>Apple</strong> mail and <strong>Outlook</strong> won&#8217;t work. For those programs to access your Yahoo! mail with on-demand passwords enabled, you&#8217;ll need to set up app-specific passwords. Yahoo! provides instructions on how to do that <a href="https://login.yahoo.com/account/security?" target="_blank">here</a>.</p>
<p>The system that Google is reportedly beta testing sounds easier to use, and more like true two-factor authentication. It doesn&#8217;t require the user to enter any code, and he just has to click a button on an app that tells the login to proceed.</p>
<p>All of this had me wondering: Should we expect <strong>Microsoft</strong> to roll out a similar password-free login process for <strong>Hotmail</strong> or <strong>Outlook </strong>users? It doesn&#8217;t seem likely: A spokesperson for the company referred me to <a href="https://technet.microsoft.com/en-us/library/dn985839(v=vs.85).aspx" target="_blank">Microsoft&#8217;s Passport system</a>, which also uses a password-free authentication system. However, Passport&#8217;s key two-factor features are only available to <strong>Windows 10</strong> users.</p>
<p>To come full circle on the lead of this story, I think it&#8217;s likely we&#8217;ll see an increase in more targeted, personalized phishing attacks if Google and Yahoo!&#8217;s two-factor solutions gain wide adoption. Perhaps Google anticipated this in April 2015, when it starting offering its <a href="https://googleblog.blogspot.com/2015/04/protect-your-google-account-with.html" target="_blank">Password Alert feature</a> &#8212; a Google Chrome browser add-on that will display a warning if you type your Google password into a site that isn’t a Google sign-in page. Google says this protects users from phishing attacks and also encourages people to use different passwords for different sites, a security best practice.</p>
<p>Plenty of other online services now offer two-step authentication. <a href="https://twofactorauth.org/" target="_blank">Twofactorauth.org</a> has a fairly comprehensive breakdown of those that do and don&#8217;t. Consider dropping by there to see if you&#8217;re taking full advantage of all of the security offered for your various online accounts.</p>


feed_id: http://krebsonsecurity.com/?p=33346
title: Oracle, LifeLock Settle FTC Deception Charges
uri: Oracle-LifeLock-Settle-FTC-Deception-Charges
url: http://krebsonsecurity.com/2015/12/oracle-lifelock-settle-ftc-deception-charges/
content:
<p>The U<strong>.S. Federal Trade Commission</strong> this past week announced it reached settlements with software giant <strong>Oracle</strong> and identity protection firm <strong>LifeLock</strong> over separate charges of allegedly deceiving users and customers about security. LifeLock agreed to pay $100 million for violating a 2010 promise to cease deceptive advertising practices. Oracle&#8217;s legal troubles with the FTC stem from its failure to fully remove older, less secure versions of Java when consumers installed the latest <strong>Java</strong> software.</p>
<p><img class="alignright size-medium wp-image-19243" src="media/5c15b877.javamess-285x226.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/03/javamess-285x226.jpg" alt="javamess" width="285" height="226" />The FTC sued Oracle over years of failing to remove older, more vulnerable versions of Java SE when consumers updated their systems to the newest Java software.  Java is installed on more than 850 million computers, but only recently (in Aug. 2014) did the company change its updater software to reliably remove older versions of Java during the installation process.</p>
<p>According to the FTC’s <a href="media/c920f8d0.151221oraclecmpt.pdf" data-original-source="https://www.ftc.gov/system/files/documents/cases/151221oraclecmpt.pdf">complaint</a>, since acquiring Java in 2010, Oracle was aware of significant security issues affecting older versions of Java SE. The FTC charges that Oracle was aware of the insufficiency of its update process.</p>
<p>&#8220;Internal documents stated that the &#8216;Java update mechanism is not aggressive enough or simply not working,&#8217; and that a large number of hacking incidents were targeting prior versions of Java SE’s software still installed on consumers’ computers,&#8221; the FTC said &#8220;The security issues allowed hackers’ to craft malware that could allow access to consumers’ usernames and passwords for financial accounts, and allow hackers to acquire other sensitive personal information through phishing attacks.&#8221;<span id="more-33346"></span></p>
<p>Few sites require Java to display content anymore, and most regular users can likely do without the program given the incessant security holes introduced by the program and its record of being abused by malicious software to infect millions of systems. See <a href="http://krebsonsecurity.com/2014/07/java-update-patch-it-or-pitch-it/" target="_blank">this post</a> for a more detailed breakdown of why I&#8217;ve so often encouraged readers to junk Java, and advice for users who absolutely still need to have Java installed. If you&#8217;re not sure whether you have Java installed, check out <a href="http://java.com/en/download/uninstallapplet.jsp" target="_blank">this page</a> that Oracle has put up to help users detect and remove installations of Java.</p>
<p><span style="text-decoration: underline;">LIFELOCK</span></p>
<p>The FTC&#8217;s <a href="https://www.ftc.gov/news-events/press-releases/2015/12/lifelock-pay-100-million-consumers-settle-ftc-charges-it-violated" target="_blank">$100 million settlement</a> with LifeLock represents a record for monetary awards obtained by the agency It stems from alleged violations of a previous deceptive advertising settlement the company reached with the FTC back in 2010.</p>
<div id="attachment_33354" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-33354" src="media/5cfe0e8e.lifelockad2-580x499.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/12/lifelockad2-580x499.png" alt="An ad for LifeLock services." width="580" height="499" srcset="http://krebsonsecurity.com/wp-content/uploads/2015/12/lifelockad2-580x499.png 580w, http://krebsonsecurity.com/wp-content/uploads/2015/12/lifelockad2.png 582w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">An ad for LifeLock services.</p></div>
<p>According to the FTC, LifeLock failed to establish and maintain a comprehensive information security program to protect users’ sensitive personal information &#8212; including their social security, credit card and bank account numbers. The FTC also alleged LifeLock falsely advertised that it protected consumers’ sensitive data with the same high-level safeguards used by financial institutions, and that it would send alerts “as soon as” it received any indication that a consumer may be a victim of identity theft.</p>
<p>The court documents related to the latest LifeLock settlement are still sealed, so it&#8217;s unclear how exactly LifeLock allegedly failed to protect customers&#8217; sensitive personal data. Interestingly, the lone dissenter in the LifeLock case was FTC Commissioner <strong>Maureen K. Ohlhausen</strong>, who <a href="media/efa8e6ba.151217lifelockmko.pdf" data-original-source="https://www.ftc.gov/system/files/documents/public_statements/896043/151217lifelockmko.pdf" target="_blank">said</a> she disagreed with the ruling because the commission hadn&#8217;t produced evidence that LifeLock somehow failed to secure its customer data, and noted that the company has complied with payment card industry security standards for accepting and handling credit card data.</p>
<p>For its part, LifeLock says in <a href="https://www.lifelock.com/pr/2015/12/17/lifelock-statement-on-final-ftc-class-action-settlement/" target="_blank">a statement</a> that &#8220;there is no evidence that LifeLock has ever had any of its customers data stolen, and the FTC did not allege otherwise.&#8221;</p>
<p><a href="http://bizsecurity.about.com/od/informationsecurity/i/Virginia-Attorney-General-Ken-Cuccinellis-Insight-Into-The-Lifelock-Lawsuit.htm" target="_blank">This October 2015 story</a> from <strong>About.com </strong>includes interesting perspective from <strong>Virginia Attorney Ken Cuccinelli</strong>, whose investigation into LifeLock&#8217;s business practices culminated in a class-action lawsuit pitting the FTC and 34 other state attorneys general against the company. According to that interview, Cuccinelli&#8217;s beef with LifeLock seems to have centered around allegations of false advertising about the level and quality of LifeLock&#8217;s identity protection service, as opposed to any specific data security issues at LifeLock.</p>
<p>&#8220;The problem, according to Cuccinelli, was not so much that LifeLock offered a flawed service, but that they were misrepresenting the level of security that they in fact provided,&#8221; wrote <strong>William Deutsch</strong>. &#8220;For years, LifeLock had been claiming to be an airtight guarantee against all forms of identity theft. LifeLock&#8217;s service is most effective against new account fraud, which is why members can expect an alert when someone tries to open up a new account in their name. But according to the Federal Trade Commission, the service wasn&#8217;t as effective in securing customers against the abuse of existing accounts, nor did it offer much protection against medical and employment related fraud.&#8221;</p>
<p>I have consistently urged readers to understand the limitations of credit monitoring services, which countless companies offer consumers each year in response to data breaches that expose customer personal and payment data. As I&#8217;ve noted time and again, credit monitoring services are unlikely to block thieves from opening new lines of credit in your name; the most you can hope for is that these services will alert you when the thieves succeed in getting new credit using your good name.</p>
<p>Credit monitoring services are useful for ID theft victims who are seeking help in removing fraudulent inquiries from their credit report. But if you want true protection against new account fraud committed in your name, place a security freeze on your credit file with the major credit bureaus. <a href="http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">This article</a> explains more about what&#8217;s involved in a security freeze and how to protect you and your family.</p>


feed_id: http://krebsonsecurity.com/?p=33169
title: Password Thieves Target E-Giftcard Firm Gyft
uri: Password-Thieves-Target-E-Giftcard-Firm-Gyft
url: http://krebsonsecurity.com/2015/12/password-thieves-target-e-giftcard-firm-gyft/
content:
<p>Digital gift card retailer <strong>Gyft</strong> has forced a password reset for some of its users. The move comes in response to the theft of usernames and passwords from a subset of Gyft customers.</p>
<p><img class="alignright wp-image-33309" src="media/c73c5526.gyft.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/12/gyft.png" alt="gyft" width="267" height="330" />Mountain View, Calif. based Gyft lets customers buy and use gift cards entirely from their mobile devices. Acting on a tip from a trusted source in the cybercrime underground who reported that a cache of account data on Gyft customers was on offer for the right bidder, KrebsOnSecurity contacted Gyft to share intelligence and to request comment.</p>
<p>Gyft declined to comment on the record for this story. But company officials insist their platforms were never breached &#8212; pointing instead to an unnamed third party.</p>
<p>Gyft did confirm attackers were able to acquire usernames and passwords for a subset of Gyft customers, and that it had forced a password reset for those accounts.</p>
<p>The company has not disclosed publicly how many customers it has, but insiders said the percentage of users affected was in the &#8220;high single digits.&#8221; Two Gyft executives told KrebsOnSecurity they first learned of the issue about three weeks ago, and that all of the affected accounts were being monitored for suspicious activity.</p>
<p>Gyft was <a href="https://www.firstdata.com/en_us/about-first-data/media/press-releases/09_29_15.html" target="_blank">acquired</a> in July 2014 by payment giant <strong>First Data, </strong>a company that has traditionally specialized in processing credit cards and managing ATMs.<span id="more-33169"></span></p>
<p>The attack on Gyft is likely to be of particular interest to enthusiasts of the virtual currency <strong>Bitcoin</strong>. Founded in 2012, Gyft has long been a favorite of bitcoin account holders because it&#8217;s consistently been one of the easiest ways to exchange bitcoins for digital gift cards that can be used at everyday businesses.</p>
<p>Cyber crooks very often recycle stolen credentials by trying the username/email address and password pairs at dozens of other retailers online, knowing that a good percentage of consumers will reuse the same credentials at multiple sites. If you re-used your Gyft username and password at other sites (tsk-tsk!) it&#8217;s time to change those passwords.</p>
<p>Companies can beef up customer account security by requiring users to sign up for two-step or multi-factor authentication, a process wherein the customer must provide a special one-time code sent to a mobile device in addition to a username and password. Enabling two-step authentication helps blunt the threat from stolen customer credentials because the thieves also would need to have access to the user&#8217;s mobile device in order to hijack the account.</p>
<p>A cursory examination of Gyft&#8217;s user platform suggests the company does not yet offer two-step authentication for its online site, nor does it require users to supply a mobile number. However, at a Bitcoin conference in Africa this year, Gyft founder <strong>Vinny Lingham</strong> <a href="http://memeburn.com/2015/04/memeburn-goes-behind-gyfts-big-bitcoin-ecosystem-plan/" target="_blank">reportedly</a> told the audience the company was considering adding the security feature.</p>


feed_id: http://krebsonsecurity.com/?p=33315
title: Banks: Card Breach at Landry’s Restaurants
uri: Banks-Card-Breach-at-Landry-s-Restaurants
url: http://krebsonsecurity.com/2015/12/banks-card-breach-at-landrys-restaurants/
content:
<p>Fraud analysts in the banking industry tell KrebsOnSecurity that the latest hospitality firm to suffer a credit card breach is likely <strong>Landry&#8217;s Inc.</strong>, a company that manages a nationwide stable of well-known restaurants &#8212; including <strong>Bubba Gump</strong>, <strong>Claim Jumper</strong>, <strong>McCormick &amp; Schmick&#8217;s</strong>, and <strong>Morton&#8217;s. </strong></p>
<p><strong>Update, 2:57 p.m. ET: </strong>Landry&#8217;s has acknowledged an investigation. Their press release is available <a href="media/d13d4a1d.press_20151217.pdf" data-original-source="http://www.landrysinc.com/pdf/pressReleases/2015/press_20151217.pdf" target="_blank">here</a> (PDF).</p>
<p><img class="aligncenter size-medium wp-image-33319" src="media/188000ca.landrys-580x363.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/12/landrys-580x363.png" alt="landrys" width="580" height="363" srcset="http://krebsonsecurity.com/wp-content/uploads/2015/12/landrys-580x363.png 580w, http://krebsonsecurity.com/wp-content/uploads/2015/12/landrys.png 631w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p><em>Original story:</em></p>
<p>Houston-based Landry&#8217;s Inc. owns and operates <a href="http://www.landrysinc.com/concepts/default.asp" target="_blank">more than 500 properties</a>, such as <strong>Landry&#8217;s Seafood</strong>, <strong>Chart House</strong> and <strong>Rainforest Cafe</strong>. Last week, I began hearing from banking industry sources who said fraud patterns on cards they&#8217;d issued to customers strongly suggested a breach at the restaurateur. Industry sources told this author that the problem appears to have started in May 2015 and may still be impacting some Landry&#8217;s locations.</p>
<p>It remains unclear how many of Landry&#8217;s 500 properties may be affected. The company says it is investigating reports of unauthorized charges on certain payment cards after the cards were used legitimately at some of its restaurants. An <a href="media/d13d4a1d.press_20151217.pdf" data-original-source="http://www.landrysinc.com/pdf/pressReleases/2015/press_20151217.pdf" target="_blank">online FAQ</a> about the incident posted to Landry&#8217;s site says the company does not yet know the extent of the breach.</p>
<p>Restaurants are a prime target for credit card thieves, mainly because they traditionally have not placed a huge emphasis on securing their payment systems. The attackers typically exploit security vulnerabilities or weaknesses in point-of-sale devices to install malicious software that steals credit and debit card data.</p>
<p>Thieves can encode the stolen data onto new plastic and use the counterfeit cards at big box retailers like Best Buy and Target. Indeed, multiple sources in the banking industry say they are now seeing fraudulent purchases at big box stores on cards that all were used at apparently compromised Landry&#8217;s locations.</p>


feed_id: http://krebsonsecurity.com/?p=33285
title: Skimmers Found at Some Calif., Colo. Safeways
uri: Skimmers-Found-at-Some-Calif-Colo-Safeways
url: http://krebsonsecurity.com/2015/12/skimmers-found-at-some-calif-colo-safeways/
content:
<p>Sources at multiple financial institutions say they are tracking a pattern of fraud indicating that thieves have somehow compromised the credit card terminals at checkout lanes within multiple Safeway stores in California and Colorado. Safeway confirmed it is investigating skimming incidents at several stores.</p>
<p><img class="aligncenter size-medium wp-image-33296" src="media/8b466448.safeway-580x404.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/12/safeway-580x404.png" alt="safeway" width="580" height="404" srcset="http://krebsonsecurity.com/wp-content/uploads/2015/12/safeway-580x404.png 580w, http://krebsonsecurity.com/wp-content/uploads/2015/12/safeway.png 599w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>Banking sources say they&#8217;ve been trying to figure out why so many customers in the Denver and Englewood areas of Colorado were seeing their debit cards drained of cash at ATMs after shopping at Safeways there. The sources compared notes and found that all of the affected customers had purchased goods from one of several specific lanes in different compromised stores (the transaction data includes a &#8220;terminal ID&#8221; which can be useful in determining which checkout lanes were compromised.</p>
<p>Safeway spokesperson <strong>Brian Dowling</strong> said the fraud was limited to a handful of stores, and that the company has processes and procedures in place to protect customers from fraudulent activity.</p>
<p>&#8220;We have an excellent track record in this area,&#8221; Dowling said. &#8220;In fact, we inspect our store’s pin pads regularly and from time to time find a skimmer, but findings have been limited and small in scale. We immediately contact law enforcement and take steps to minimize customer impact.&#8221;<span id="more-33285"></span></p>
<p>Dowling said the problem of checkout skimmers is hardly limited to Safeway, and he hinted that perhaps other retailers have been hit by this same group.</p>
<p>&#8220;This is not unique to our company, and we understand some other retailers may have been more significantly impacted,&#8221; Dowling said, declining to elaborate.</p>
<p>Safeway would not name the affected locations, but bank industry sources say the fraud was traced back to Colorado locations in Arvada, Conifer, Denver, Englewood and Lakewood. In California, banks there strongly suspect Safeway locations in Castro Valley and Menlo Park may also have been hit. Those sources say ATM fraud has been linked to customers using their debit cards at those locations since early September 2015.</p>
<p>In order to steal card data and personal identification numbers (PINs) from Safeway customers, the thieves would have had to open up the card processing terminals at each checkout lane. Once inside, the thieves can install a device that sits between the keypad and the electronics underneath to capture and store PINs, as well as a separate apparatus that siphons account data when customers swipe their cards at the register.</p>
<p>Either that, or the skimmer crooks would have to secretly swap out existing card terminals at checkout lanes with pre-compromised terminals of the exact same design. In any case, skimming incidents involving checkout lanes in retail locations generally involve someone on the inside at the affected retailer.</p>
<p>In late 2012, bookseller <strong>Barnes &amp; Noble</strong> disclosed that it had found modified point-of-sale devices at 60 locations nationwide. The year prior, <strong>Michaels Stores</strong> said it had <a title="Breach at Michaels Stores Extends Nationwide" href="http://krebsonsecurity.com/2011/05/breach-at-michaels-stores-extends-nationwide/" target="_blank">replaced more than 7,200 credit card terminals</a> from store registers nationwide, after discovering that thieves had somehow modified or replaced card machines to include technology capable of siphoning customer payment card data and PINs.</p>
<p>Sadly, I don&#8217;t have any skimmer photos to share from this story, but I have written about the growing sophistication of these point-of-sale skimming devices. <a href="http://krebsonsecurity.com/2013/02/pro-grade-point-of-sale-skimmer/" target="_blank">Here&#8217;s a look at one compromised card reader</a>, and the handiwork that went into the thieves&#8217; craft. Descriptions and images from other skimming devices can be found in my series <a href="http://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers</a>.</p>
<p>The mass-issuance of chip-based credit and debit cards by U.S. banks to consumers should eventually help minimize these types of scams, but probably not for some time yet. Most cards will continue to have all of the cardholder data stored in plain text on the magnetic strip of these chip-based cards for several years to come. As long as merchants continue to let customers swipe instead of &#8220;dip,&#8221; we&#8217;ll continue to see skimmers just about everywhere swiping is still allowed.</p>
<p>Remember that you are not liable for fraudulent card charges, but that it&#8217;s still your responsibility to alert their card issuer quickly to any unauthorized charges. So keep a close eye on your bank statements. Also, this attack is another reminder of why it makes more sense to shop with a credit vs. a debit card: Having your checking account emptied of cash while your bank sorts out the situation can be a huge hassle and create secondary problems (bounced checks, for instance).</p>
<p><strong>Update:</strong> According to reporting from the <a href="http://www.denverpost.com/business/ci_29261642/report-several-colorado-safeway-stores-involved-skimming-breach" target="_blank">Denver Post</a>, the Safeway incident affected three stores in Colorado. All of the affected lanes were self-checkout lanes, the publication reported.</p>


feed_id: http://krebsonsecurity.com/?p=33269
title: 13 Million MacKeeper Users Exposed
uri: 13-Million-MacKeeper-Users-Exposed
url: http://krebsonsecurity.com/2015/12/13-million-mackeeper-users-exposed/
content:
<p>The makers of <strong>MacKeeper</strong> &#8212; a <a href="http://www.macworld.com/article/2861435/software-utilities/how-to-uninstall-mackeeper-from-your-mac.html" target="_blank">much-maligned</a> software utility many consider to be little more than <a href="https://en.wikipedia.org/wiki/MacKeeper" target="_blank">scareware</a> that targets Mac users &#8212; have acknowledged a breach that exposed the usernames, passwords and other information on more than 13 million customers and, er&#8230;users. Perhaps more interestingly, the guy who found and reported the breach doesn&#8217;t even own a Mac, and discovered the data trove merely by browsing <a href="https://www.shodan.io/" target="_blank">Shodan </a>&#8212; a specialized search engine that looks for and indexes virtually anything that gets connected to the Internet.</p>
<p><img class="alignright wp-image-33271" src="media/e4d49102.mackeeper.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/12/mackeeper.png" alt="mackeeper" width="325" height="236" />IT helpdesk guy by day and security researcher by night, 31-year-old <strong>Chris Vickery</strong> said he unearthed the 21 gb trove of MacKeeper user data after spending a few bored moments searching for database servers that require no authentication and are open to external connections.</p>
<p>Vickery told Shodan to find all known instances of database servers listening for incoming connections on port 27017. &#8220;Ports&#8221; are like doorways that govern access into and out of specific areas of a server, and each port number generally maps to one or a handful of known Web applications and services. Port 27017 happens to be associated with <a href="https://en.wikipedia.org/wiki/MongoDB" target="_blank">MongoDB</a>, a popular database management system.</p>
<p>In short order, Vickery&#8217;s request turned up four different Internet addresses, all of which he later learned belonged to <a href="http://kromtech.com/" target="_blank">Kromtech</a>, the company that makes MacKeeper.</p>
<p>&#8220;There are a lot of interesting, educating and intriguing things that you can find on Shodan,&#8221; Vickery said. &#8220;But there&#8217;s a lot of stuff that should definitely not be out there, and when I come across those I try to notify the owner of the affected database.&#8221;</p>
<p>Vickery said he reached out the company, which responded quickly by shuttering public access to its user database, and publicly thanking him for reporting it.</p>
<p>&#8220;Some 13 million customer records leaked from is aware of a potential vulnerability in access to our data storage system and we are grateful to the security researcher Chris Vickery who identified this issue without disclosing any technical details for public use,&#8221; the company said <a href="https://mackeeper.com/blog/post/173-mackeeper-security-advisory" target="_blank">in a statement</a> published to its site totday. &#8220;We fixed this error within hours of the discovery. Analysis of our data storage system shows only one individual gained access performed by the security researcher himself. We have been in communication with Chris and he has not shared or used the data inappropriately.&#8221;</p>
<p>Kromtech said all customer credit card and payment information is processed by a 3rd party merchant and was never at risk.<span id="more-33269"></span></p>
<p>&#8220;Billing information is not transmitted or stored on any of our servers. We do not collect any sensitive personal information of our customers,&#8221; the statement continues. &#8220;The only customer information we retain are name, products ordered, license information, public ip address and their user credentials such as product specific usernames, password hashes for the customer&#8217;s web admin account where they can manage subscriptions, support, and product licenses.&#8221;</p>
<p>Vickery said Kromtech told him its database had been inadvertently exposed as a result of a server misconfiguration that was introduced just last week. But Vickery said he doubts that&#8217;s the case, because some of the Shodan records he found that pointed back to Kromtech&#8217;s database were dated mid-November 2015.</p>
<p><span class="pullquote pqleft">&#8220;The funny thing is, I don’t even own a Mac, and I had never heard of MacKeeper until last night,&#8221; Vickery said.</span> &#8220;I didn’t know it was some sort of scamming scareware or software that pushes itself on people. The irony here is pretty thick.&#8221;</p>
<p>Vickery said he was able to connect to the database that Shodan turned up for him just by cutting and pasting the information into <a href="http://www.mongovue.com/" target="_blank">a commercial tool</a> built to browse Mongo databases. Asked whether he&#8217;s worried that some clueless organization or overzealous prosecutor might come after him for computer hacking, Vickery said he&#8217;s not concerned (for background, see the controversy over bone-headed cases brought against researchers under the <a href="https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act" target="_blank">Computer Fraud and Abuse Act</a>).</p>
<p>&#8220;It&#8217;s a concern, but I&#8217;ve made peace with that and you can&#8217;t live your life in fear,&#8221; he said. &#8220;I feel pretty confident that if you configure a server for public access &#8212; without authentication &#8212; and it gets publicly accessed, that&#8217;s not a crime.&#8221;</p>
<p>I admire Vickery&#8217;s courage and straightforward approach, and his story is a good reminder about the importance of organizations using all of the resources available to them to find instances of public access to sensitive or proprietary data that shouldn&#8217;t be public.  Consider taking the time to learn how to use Shodan (it&#8217;s actually fairly intuitive, but some data may only be available to paying subscribers); use it to see if your organization has unnecessarily exposed databases, networking devices, security cameras and other &#8220;Internet of Things&#8221; devices.</p>
<p>Finally, if you&#8217;re a MacKeeper customer and you re-used your MacKeeper user password at other sites, it&#8217;s now time change that password at the other sites &#8212; and <em>not</em> just to your new MacKeeper password! For more password do&#8217;s and don&#8217;ts, check out <a href="http://krebsonsecurity.com/password-dos-and-donts/" target="_blank">this primer</a>.</p>


feed_id: http://krebsonsecurity.com/?p=32957
title: Don’t Be a Victim of Tax Refund Fraud in ’16
uri: Don-t-Be-a-Victim-of-Tax-Refund-Fraud-in-16
url: http://krebsonsecurity.com/2015/12/dont-be-a-victim-of-tax-refund-fraud-in-16/
content:
<p>With little more than a month to go before the start of the 2016 tax filing season, the IRS and the states are hunkering down for an expected slugfest with identity thieves who make a living requesting fraudulent tax refunds on behalf of victims. Here&#8217;s what you need to know going into January to protect you and your family.</p>
<p><img class="alignright wp-image-25751" src="media/964c2000.taxfraud-285x285.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-285x285.jpg" alt="The Growing Tax Fraud Menace" width="260" height="260" srcset="http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-150x150.jpg 150w, http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-285x285.jpg 285w, http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-600x600.jpg 600w, http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud.jpg 693w" sizes="(max-width: 260px) 100vw, 260px" />The good news is that the states and Uncle Sam have got a whole new bag of technological tricks up their sleeves this coming tax season. The bad news is ID thieves are already testing those defenses, and will be working against a financially strapped federal agency that&#8217;s been forced to cede much of its ability to investigate and prosecute such crimes.</p>
<p>Tax refund fraud affects hundreds of thousands, if not millions, of U.S. citizens annually. Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS.</p>
<p>By all accounts, the IRS has improved at blocking phony refund requests. The agency estimates it prevented $24.2 billion in fraudulent identity theft refunds in 2013. Trouble is, it paid out some $5.8 billion in fraudulent refunds that year that it later determined were bogus, and experts say that is only the fraud the agency knows about, and the true number is likely much higher annually.</p>
<p>Perhaps in response to the IRS&#8217;s increasing ability to separate phony returns from legitimate ones, crooks last year <a href="http://krebsonsecurity.com/2015/02/the-rise-in-state-tax-refund-fraud/" target="_blank">massively focused on filing bogus refund requests with the 50 U.S states</a>. To head off a recurrence of that trend in the 2016 filing season, the states and the IRS have <a href="https://www.irs.gov/uac/Newsroom/IRS,-States-and-Industry-Partners-Provide-Update-on-Collaborative-Fight-Against-Tax-Related-Identity-Theft" target="_blank">hammered out an agreement</a> to examine more than 20 new data elements collected by online providers like <strong>TurboTax</strong> and <strong>H&amp;R Block</strong>.</p>
<p>Those new data elements include checking for the repetitive use of the same Internet address to rapidly file multiple returns, and reviewing computer device information (browser user agent string, cookies e.g.) tied to the return&#8217;s origin. Another check involves measuring the time it takes to file a return; fraudsters involved in tax refund fraud tend to breeze through returns in just a few minutes because they are generally copying and pasting information into the tax forms, or relying on an automated program to do it for them.</p>
<p>The hope is that the these new checks will let investigators more accurately flag suspicious refund requests processed by tax preparation firms, which also have agreed to beef up <a href="http://krebsonsecurity.com/2015/03/intuit-failed-at-know-your-customer-basics/" target="_blank">lax security</a> around customer accounts. Under the agreement, online providers will enforce:</p>
<ul>
<li>new password standards to include a minimum of eight characters, with upper, lowercase, alphanumerical and special characters;</li>
<li>a lock-out feature that blocks users with too many unsuccessful login attempts;</li>
<li>the addition of three security questions;</li>
<li>some sort of out-of-band verification for email addresses &#8212; sending an email or text to the customer with a personal identification number (PIN).</li>
</ul>
<p><strong>Julie Magee</strong>, Alabama&#8217;s chief tax administrator, said the state/IRS task force opted not to disclose all 20 of the data elements they will be collecting from tax prep firms.</p>
<p>&#8220;The thieves are going to figure these out on their own, and they&#8217;re already testing our defenses,&#8221; Magee told KrebsOnSecurity. &#8220;We don&#8217;t want to do anything to make that easier for them.&#8221;</p>
<p><span style="text-decoration: underline;">ANALYSIS</span></p>
<p>Whether or not we see an increase in tax refund fraud next year, one thing seems certain: the IRS will prosecute far fewer of the crooks involved. Congress has persistently underfunded the IRS, and budget cuts have pushed prosecutions of identity thieves to a new low. According to the IRS&#8217;s 2015 Annual Report, IRS identity theft criminal investigations are down almost 50 percent since 2013.</p>
<p><img class="aligncenter size-medium wp-image-33236" src="media/e24614af.irs-idtheftprosecutions13-15-580x164.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/12/irs-idtheftprosecutions13-15-580x164.png" alt="irs-idtheftprosecutions13-15" width="580" height="164" srcset="http://krebsonsecurity.com/wp-content/uploads/2015/12/irs-idtheftprosecutions13-15-580x164.png 580w, http://krebsonsecurity.com/wp-content/uploads/2015/12/irs-idtheftprosecutions13-15-768x218.png 768w, http://krebsonsecurity.com/wp-content/uploads/2015/12/irs-idtheftprosecutions13-15-940x266.png 940w, http://krebsonsecurity.com/wp-content/uploads/2015/12/irs-idtheftprosecutions13-15.png 1270w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>Tax fraudsters were so aggressive last year that they figured out how to steal consumer identities directly from the agency itself. In August 2015, the IRS disclosed that crooks abused the &#8220;Get Transcript&#8221; feature on its Web site to steal Social Security numbers and information from previous years’ tax filings on more than 334,000 Americans.</p>
<p>The IRS has responded to the problem of tax ID theft partly by offering <a href="http://www.irs.gov/Individuals/Get-An-Identity-Protection-PIN" target="_blank">Identity Protection PINs</a> (IP PINs) to affected taxpayers that must be supplied on the following year’s tax application before the IRS will accept the return. However, consumers still have to request an IP PIN by <a href="https://www.irs.gov/Individuals/Get-An-Identity-Protection-PIN" target="_blank">applying for one at the agency&#8217;s site</a>, or by mailing in <a href="media/d356facd.f14039.pdf" data-original-source="https://www.irs.gov/pub/irs-pdf/f14039.pdf" target="_blank">form 14039</a> (PDF).</p>
<p>Incredibly, the process that thieves abused to steal tax transcripts from 334,000 taxpayers this year from the IRS&#8217;s site also works to fraudulently obtain a consumer&#8217;s IP PIN. In fact, the following redacted screen shot from a notorious cybercrime forum shows a seasoned tax fraudster teaching would-be scammers how to use the IRS&#8217;s site to obtain a victim&#8217;s IP PIN.</p>
<p><img class="aligncenter size-medium wp-image-33199" src="media/c5747d79.ippin-580x162.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/12/ippin-580x162.png" alt="ippin" width="580" height="162" srcset="http://krebsonsecurity.com/wp-content/uploads/2015/12/ippin-580x162.png 580w, http://krebsonsecurity.com/wp-content/uploads/2015/12/ippin.png 620w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p><span id="more-32957"></span>Both the Get Transcript and the process to retrieve an IP PIN from the IRS&#8217;s site are vulnerable because they rely on the applicant supplying static information that is trivial for thieves to obtain, including the taxpayer&#8217;s name, date of birth, Social Security number and filing status. After that data is successfully supplied, the IRS uses a service from credit bureau <strong>Equifax</strong> that asks four so-called “knowledge-based authentication” (KBA) questions.</p>
<p>These KBA questions — which involve multiple choice, “out of wallet” questions such as previous address, loan amounts and dates — can be successfully enumerated with random guessing, but much of the data is readily available via free online social networking and consumer tracking services like Spokeo.</p>
<p>If any readers here doubt how easy it is to buy personal data on just about anyone, check out <a title="http://krebsonsecurity.com/2014/12/toward-a-breach-canary-for-data-brokers/" href="http://krebsonsecurity.com/2014/12/toward-a-breach-canary-for-data-brokers/" target="_blank">the story I wrote in December 2014</a>, wherein I was able to find the name, address, Social Security number, previous address and phone number on all current members of the <strong>U.S. Senate Commerce Committee</strong>. This information is no longer secret (nor are the answers to KBA-based questions), and we are all made vulnerable to identity theft as long as institutions continue to rely on static information as authenticators.</p>
<p>My guess is that a huge chunk of 334,000 victimized via the IRS&#8217;s site this year probably will not request the IP PIN and will in fact have fraudulent tax returns filed with their info &#8212; whether they request the <span class="il">IP</span> <span class="il">PIN</span> and it is stolen or not. The IRS should just issue the IP PINs to affected taxpayers, instead of asking victims to do it themselves.</p>
<p>Incidentally, the <a href="https://twitter.com/IRSnews/status/671413617410076673?s=03" target="_blank">IRS&#8217;s Twitter account is still promoting the online Get Transcript capability</a>, even though it no longer offers the service online. For now, the only way to obtain a transcript is via snail mail.</p>
<div id="attachment_33259" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-33259" src="media/cca53a0a.irstweet-gettranscript-580x510.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/12/irstweet-gettranscript-580x510.png" alt="IRS's Twitter account urging followers to use a service that hasn't been available for months." width="580" height="510" srcset="http://krebsonsecurity.com/wp-content/uploads/2015/12/irstweet-gettranscript-580x510.png 580w, http://krebsonsecurity.com/wp-content/uploads/2015/12/irstweet-gettranscript.png 753w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">IRS&#8217;s Twitter account urging followers to use a service that hasn&#8217;t been available since May 2015.</p></div>
<p><span style="text-decoration: underline;">DON&#8217;T BE THE NEXT VICTIM<br />
</span></p>
<p>In notifying 334,000 taxpayers affected by its Get Transcript debacle, the IRS predictably offered victims free credit monitoring services from <strong>Equifax</strong>. The IRS makes no mention of a more effective way to block ID thieves: Placing a &#8220;security freeze&#8221; on one&#8217;s credit files with the major credit bureaus. See <a href="http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">this tutorial</a> about why freezes are more effective than credit monitoring in blocking ID thieves from assuming your identity to open up new lines of credit.</p>
<p>While it&#8217;s true that having a security freeze on your credit file won&#8217;t stop thieves from committing tax refund fraud in your name, it would stop them from fraudulently obtaining your IP PIN. Also, anyone who has a freeze in place will need to temporarily lift that freeze to take advantage of any credit monitoring services (in this case, the consumer would need to briefly thaw a freeze at Equifax).</p>
<p><strong>-File before the fraudsters do it for you</strong> &#8211; Your primary defense against becoming the next victim is to file your taxes at the state and federal level as quickly as possible after the 2016 Tax Filing Season begins &#8212; which is usually the second or third week in January. Remember, it doesn&#8217;t matter whether or not the IRS owes you money: Thieves can still try to impersonate you and claim that they do, leaving you to sort out the mess with the IRS later.</p>
<p><strong>-Get on a schedule to request a free copy of your credit report.</strong> By law, consumers are entitled to a free copy of their report from each of the major bureaus once a year. Put it on your calendar to request a copy of your file every three to four months, each time from a different credit bureau. Dispute any unauthorized or suspicious activity. This is where credit monitoring services are useful: Part of their service is to help you sort this out with the credit bureaus, so if you&#8217;re signed up for credit monitoring make them do the hard work for you.</p>
<p>&#8211;<strong>Monitor, then freeze.</strong> Take advantage of any free credit monitoring available to you, and then freeze your credit file with the four major bureaus. <a href="http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">Instructions for doing that are here</a>.</p>
<p><strong>-File form 14039 and request an IP PIN from the government.</strong> This form requires consumers to state they believe they&#8217;re likely to be victims of identity fraud. Even if thieves haven&#8217;t tried to file your taxes for you yet, virtually all Americans have been touched by incidents that could lead to ID theft &#8212; even if we just look at breaches announced in the past year alone.</p>
<p><span style="text-decoration: underline;">FIGHT BACK </span></p>
<p>Thieves involved in tax return fraud may be laughing all the way to the bank, but that doesn&#8217;t mean we have to suck it up and take it: Exercise your rights to obtain a copy of the phony return, and you may just help put crooks in jail.</p>
<p>If you become of the victim of tax fraud and are motivated to learn who helped to defraud you and Uncle Sam, you can <a href="media/5fbce8cf.f4506.pdf" data-original-source="https://www.irs.gov/pub/irs-pdf/f4506.pdf" target="_blank">file form 4506</a> (plus a $50 fee) to get a copy of the return. That information can be shared with your local police, who may be able to use to track down people who help launder the proceeds from tax refund fraud.</p>
<p>Earlier this year, I wrote about <strong>Isha Sesay</strong>, a Pennsylvania woman who <a href="http://krebsonsecurity.com/2015/06/states-seek-better-mousetrap-to-stop-tax-refund-fraud/" target="_blank">was arrested for receiving phony IRS refunds</a> on behalf of at least two tax fraud victims. Among Sesay&#8217;s victims was resident <a href="http://krebsonsecurity.com/?s=michael+kasper&amp;x=0&amp;y=0" target="_blank">Mike Kasper</a>, whose request for the filing led to Sesay&#8217;s arrest. Kasper&#8217;s hard work helped expose the <a href="http://krebsonsecurity.com/2015/08/irs-330k-taxpayers-hit-by-get-transcript-scam/" target="_blank">IRS’s pervasive authentication weaknesses</a> and later <a href="http://www.hsgac.senate.gov/hearings/the-irs-data-breach-steps-to-protect-americans-personal-information" target="_blank">testified to Congress</a> about his ordeal. Sesay is currently <a href="media/535daba8.2015_10_23_520510.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/12/2015_10_23_520510.pdf" target="_blank">scheduled to plead guilty</a> (PDF) to the charges on Dec. 18.</p>
<p>Turns out, Kasper&#8217;s sleuthing was key to Sesay&#8217;s prosecution. When he found out he&#8217;d been victimized, Kasper requested the copy of returns that fraudsters filed in his name, but he did so <em>before</em> filing form 14039 to request an IP PIN.  Had he done it in the opposite order, the IRS would have redacted all of Ms. Sesay personal and financial information.</p>
<div id="attachment_33261" style="width: 569px" class="wp-caption aligncenter"><img class="size-full wp-image-33261" src="media/e59d18b9.michaelkasper.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/12/michaelkasper.png" alt="Poughkeepsie, NY victim Michael Kasper testifying before the Senate Homeland Security Committee in June 2015." width="559" height="315" /><p class="wp-caption-text">Poughkeepsie, NY victim Michael Kasper testifying before the Senate Homeland Security Committee in June 2015.</p></div>
<p>In <a href="http://www.hsgac.senate.gov/hearings/the-irs-data-breach-steps-to-protect-americans-personal-information" target="_blank">testimony</a> before the Senate this year, IRS Commissioner <strong>John Koskinen</strong> explained the reasoning behind that decision: A fraudulent return could include the personal information of other people. The end result is that it is better to file <a href="media/5fbce8cf.f4506.pdf" data-original-source="https://www.irs.gov/pub/irs-pdf/f4506.pdf" target="_blank">form <span class="il">4506</span></a> and pay $50 to request a photocopy of the fraudulent return before you file form 14039 to formally report the fraud.</p>
<div>
<p>&#8220;There is a section 6103 of the US code that imposes <a href="https://www.law.cornell.edu/uscode/text/26/6103" target="_blank">stiff criminal penalties</a> for sharing tax return information  and the IRS&#8217;s tortured view of reality interprets this law, which is intended to protect personal information, so that once you report fraud and they know some information on the return might not be yours, they believe it is against the law for them to ever share that information with you,&#8221; Kasper said.</p>
<p>&#8220;As a result, when they recently created the process above for victims to get a copy of the fraudulent tax returns filed in their name, the IRS decided they need to redact any personal info that could possibly belong to a criminal,&#8221; Kasper continued. &#8220;They do everything they can to protect the privacy of the criminal who already violated your privacy. You actually lose all of your rights once you report the crime so it&#8217;s better to wait.&#8221;</p>
</div>


feed_id: http://krebsonsecurity.com/?p=33217
title: The Role of Phony Returns in Gift Card Fraud
uri: The-Role-of-Phony-Returns-in-Gift-Card-Fraud
url: http://krebsonsecurity.com/2015/12/the-role-of-phony-returns-in-gift-card-fraud/
content:
<p>On any given day, there are thousands of gift cards from top retailers for sale online that can be had for a fraction of their face value. Some of these are exactly what they appear to be: legitimate gift cards sold through third-party sites that specialize in reselling used or unwanted cards. But many of the more steeply discounted gift cards for sale online are in fact the product of merchandise return fraud, meaning consumers who purchase them unwittingly help thieves rob the stores that issued the cards.</p>
<p><img class="alignright wp-image-33221" src="media/b0311ee3.giftcards.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/12/giftcards.png" alt="giftcards" width="291" height="192" />This type of scam mainly impacts brick-and-mortar retailers that issue gift cards when consumers return merchandise at a store without presenting a receipt. Last week I heard from KrebsOnSecurity reader Lisa who recently went online to purchase a bunch of steeply discounted gift cards issued by pet supply chain <strong>Petco</strong>.</p>
<p>Lisa owns two Rottweilers that both eat a good chunk of their weight each month in dog food, so Lisa said she felt like she&#8217;d really hit on a bargain when she found a $165 Petco gift card for sale at a popular online gift card retailer for $120 (a nearly 30 percent discount on the value).</p>
<p>&#8220;When I went to Petco to get my monthly supply of dog food and snacks for my Rotties, I used my merchandise card and the manager shared with me that folks are stealing merchandise from one Petco store and returning the items to another without a receipt and then selling the cards to places like <strong>raise.com</strong> and <strong>cardpool.com</strong> at a discounted price,&#8221; Lisa recounted.</p>
<p>Petco&#8217;s official <a href="http://www.returnsandrefunds.com/Petsmart/Returns" target="_blank">policy</a> is that for returns more than 60 days after the purchase &#8212; or if the receipt is unavailable &#8212; the value of the goods returned will be refunded to a merchandise card. Lisa said she bought the Petco card from raise.com, but she said the company never disclosed that the card was a merchandise return card &#8212; a fact that was printed on the front of the card she received.</p>
<p>&#8220;I feel really bad now because my purchase of these cards may have contributed to unlawful activities,&#8221; Lisa said. &#8220;Even though I saved $40+, Petco actually lost money as a result.&#8221;</p>
<p>Neither Raise nor Petco responded to requests for comment. But a look at the available Petco cards for sale via one gift card tracking site &#8212; <strong>giftcardgranny.com</strong> &#8212; shows Petco cards routinely sell for at least 25 percent off their value.</p>
<p>In any case, this fraud scheme is hardly specific to Petco. Cards from <strong>Petsmart</strong>, a competitor that also offers merchandise return cards, generally <a href="http://www.giftcardgranny.com/buy-gift-cards/pet-smart/" target="_blank">sell at 20 percent off their value</a>. Clothier <a href="http://www.giftcardgranny.com/buy-gift-cards/h-and-m/" target="_blank">H&amp;M&#8217;s cards</a> average about 30 percent off.</p>
<p>Contrast these discounts with those for gift cards from restaurants, fuel stations and other businesses that generally don&#8217;t have to deal with customer returns and you&#8217;ll notice two interesting patterns: For starters, the face value of the cards from merchants that don&#8217;t take customer returns are far more likely to be even amounts, such as $50, $25 and $40. The percentage off the face value also tends to be much lower &#8212; between 3 and 15 percent. For example, see the discount percentage and value of cards from <a href="http://www.giftcardgranny.com/buy-gift-cards/starbucks/" target="_blank">Starbucks</a> and <a href="http://www.giftcardgranny.com/buy-gift-cards/chevron/" target="_blank">Chevron</a>.</p>
<p>&#8220;Twenty-five percent off is really high, and there aren&#8217;t many that offer that high of a discount,&#8221; said <strong>Damon McCoy</strong>, an assistant professor of computer science at New York University and an expert on fraud involving stored value cards. &#8220;Normally, it is around 5 percent to 15 percent.&#8221;<span id="more-33217"></span></p>
<p>According to a study conducted jointly by KingRogers International and <a href="http://www.theretailequation.com/Retailers/IndustryReports.aspx" target="_blank">The Retail Equation</a>, approximately nine percent of all returns in the United States are fraudulent. The National Retail Foundation estimates that the problem will cost U.S. retailers nearly $11 billion this year.</p>
<p>Investigators say the crimes very often are tied to identity theft rings and drug addicts. Last month, authorities in Michigan <a href="http://www.usatoday.com/story/news/nation-now/2015/10/06/home-depot-thief-gift-cards/73441386/" target="_blank">convicted a 46-year-old father of four</a> for running a large-scale fencing operation that used teams of prostitutes, heroin users, parolees and panhandlers to steal high-priced items from local Home Depot stores and then return the goods to a different Home Depot location in exchange for store debit cards.</p>
<p>Of course, another huge source card of gift card fraud are cards purchased with stolen credit cards. Thieves will buy &#8220;dumps&#8221; &#8212; card data stolen from brick-and-mortar businesses &#8212; and encode that data onto anything with a magnetic strip and try to buy high-dollar gift cards from a range of retailers. The carded gift cards very often wind up for sale online at steep 20-30 percent discounts.</p>
<p>Earlier this year I saw part of this process in action at a Giant grocery store in Maryland. The man in front of me in line looked and smelled homeless. The only items he was trying to buy were several $200 gift cards that Giant had on sale for various retailers. When the first card he swiped was declined, the man fished two more cards out of his wallet. Each was similarly declined, but the man just shrugged and walked out of the store. I asked the cashier if this sort of thing happened often, and he just shook his head and said, &#8220;Man, you have no idea.&#8221;</p>
<p>Lisa admits she remains conflicted over whether she would buy another steeply discounted card to help feed her dogs. But she said retailers could help stem this type of fraud by tying merchandise return cards to the identity of the person who returned the merchandise in the first place. Most stores that issue merchandise return cards now require the person returning the goods to show a valid state driver&#8217;s license, but the cards are not tied to that customer, nor do stores check ID when consumers use merchandise return cards at the store to purchase goods.</p>


feed_id: http://krebsonsecurity.com/?p=33202
title: Adobe, Microsoft Each Plug 70+ Security Holes
uri: Adobe-Microsoft-Each-Plug-70-Security-Holes
url: http://krebsonsecurity.com/2015/12/adobe-microsoft-each-plug-70-security-holes/
content:
<p><strong>Adobe</strong> and <strong>Microsoft</strong> today independently issued software updates to plug critical security holes in their software. Adobe released a patch that fixes a whopping 78 security vulnerabilities in its <strong>Flash Player</strong> software. Microsoft pushed a dozen patch bundles to address at least 71 flaws in various versions of the <strong>Windows</strong> operating system and associated software.</p>
<p><a href="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png"><img class="alignright size-full wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="229" height="240" /></a>Three-quarters of the patches Microsoft issued earned the company&#8217;s most dire &#8220;critical&#8221; rating, meaning malware or attackers could use the flaws fixed in these patches to fully compromise vulnerable systems with zero help from users. What&#8217;s more, two of the vulnerabilities are actively being exploited, including a bug in Windows and <strong>Microsoft Office</strong>.</p>
<p>As per usual, a patch for <strong>Internet Explorer</strong> addresses a huge chunk (30) of the individual security flaws tackled in this month&#8217;s update cycle. Microsoft also released a critical patch to correct 15 weaknesses in <strong>Microsoft Edge</strong>, the browser meant to supplant IE.</p>
<p>According to security firm <strong>Shavlik</strong>, supported versions of IE will be changing quite a bit in January. After <span data-term="goog_114580385">January 12, 2016</span>, only the latest IE version available on each operating system will be supported. This means if you are not running the latest version of IE available for the version of Windows you are on, you will no longer be getting security updates. More information about this change is available <a href="https://blogs.msdn.microsoft.com/ie/2014/08/07/stay-up-to-date-with-internet-explorer/" target="_blank">here</a>.<span id="more-33202"></span></p>
<p>The <strong>SANS Internet Storm Center</strong> is <a href="https://isc.sans.edu/forums/diary/December+2015+Microsoft+Patch+Tuesday/20461/" target="_blank">reporting</a> that some Windows users who have Outlook installed are experiencing some difficulties using the program after applying this month&#8217;s updates. If you use Outlook, it may be wise to put off installing this patch for a few days until Microsoft addresses the issue.</p>
<p>Another <a href="https://technet.microsoft.com/en-us/library/security/ms15-127.aspx" target="_blank">vulnerability</a> &#8212; fixed by a patch for domain name system (DNS) servers that run on Windows Servers &#8212; could prove extremely dangerous for organizations that rely on Windows Server for DNS services. According to SANS, Microsoft rates the exploitability as &#8220;2&#8221;, but doesn&#8217;t provide much details as to the nature of the vulnerability other than the fact that it can be triggered by remote DNS requests, which is bad news if you are using a Microsoft DNS server exposed to the public internet.</p>
<p>Adobe&#8217;s <a href="https://helpx.adobe.com/security/products/flash-player/apsb15-32.html" target="_blank">Flash update</a> brings Flash to version <em>20.0.0.228</em> for Internet Explorer and Chrome on Windows and Mac systems, and <em>20.0.0.235</em> for Windows and Mac versions of Firefox and Safari.</p>
<p>As I noted in <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">a previous post</a>, most users can jump off the incessant Flash-patching merry-go-round by simply removing the program — or hobbling it until and unless it is needed for some purpose or site.</p>
<p>Disabling Flash in Chrome is simple enough, and can be easily reversed: On a Windows, Mac, Linux or Chrome OS installation of Chrome, type “chrome:plugins” into the address bar, and on the Plug-ins page look for the “Flash” listing: To disable Flash, click the disable link (to re-enable it, click “enable”). Windows users can remove Flash from the Add/Remove Programs panel, or use Adobe’s uninstaller for Flash Player.</p>
<p>If you’re concerned about removing Flash altogether, consider a dual-browser approach. That is, unplugging Flash from the browser you use for everyday surfing, and leaving it plugged in to a second browser that you only use for sites that require Flash. Another alternative to removing Flash is <a href="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" target="_blank">Click-To-Play</a>, which lets you control what Flash (and Java) content gets to load when you visit a Web page.</p>
<p>If you decide to proceed with Flash and update, the most recent versions of Flash should be available from the <a href="https://get.adobe.com/flashplayer/" target="_blank">Flash home page.</a> Windows users who browse the Web with anything other than Internet Explorer may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>


feed_id: http://krebsonsecurity.com/?p=33437
title: Flash Player Patch Fixes 0-Day, 18 Other Flaws
uri: Flash-Player-Patch-Fixes-0-Day-18-Other-Flaws
url: http://krebsonsecurity.com/2015/12/flash-player-patch-fixes-0-day-18-other-flaws/
content:
<p><strong>Adobe</strong> has shipped a new version of its <strong>Flash Player</strong> browser plugin to close at least 19 security holes in the program, including one that is already being exploited in active attacks.</p>
<p><img class="alignright wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="188" height="160" />The new Flash version, <em>v. 20.0.0.267</em> for most <strong>Mac</strong> and <strong>Windows</strong> users, includes a fix for a vulnerability (CVE-2015-8651) that Adobe <a href="https://helpx.adobe.com/security/products/flash-player/apsb16-01.html" target="_blank">says</a> is being used in &#8220;limited, targeted attacks.&#8221; If you have Flash installed, please update it.</p>
<p>Better yet, get rid of Flash altogether, or at least disable it until and unless you need it. Doing without Flash just makes good security sense, and it isn&#8217;t as difficult as you might think: See my post, <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">A Month Without Adobe Flash Player</a>, for tips on how to minimize the risks of having Flash installed.</p>
<p>The most recent versions of Flash should be available from the <a href="https://get.adobe.com/flashplayer/" target="_blank">Flash home page.</a> Windows users who browse the Web with anything other than Internet Explorer may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.). <a title="https://helpx.adobe.com/flash-player/kb/find-version-flash-player.html" href="https://helpx.adobe.com/flash-player/kb/find-version-flash-player.html" target="_blank">This link</a> should tell you whether your system has Flash and if so which version of Flash is installed in your browser.</p>
<div id="comments"></div>


feed_id: http://krebsonsecurity.com/?p=33400
title: 2016 Reality: Lazy Authentication Still the Norm
uri: 2016-Reality-Lazy-Authentication-Still-the-Norm
url: http://krebsonsecurity.com/2015/12/2016-reality-lazy-authentication-still-the-norm/
content:
<p>My <strong>PayPal</strong> account was hacked on Christmas Eve. The perpetrator tried to further stir up trouble by sending my PayPal funds to a hacker gang tied to the jihadist militant group <strong>ISIS</strong>. Although the intruder failed to siphon any funds, the successful takeover of the account speaks volumes about why most organizations &#8212; including many financial institutions &#8212; remain woefully behind the times in authenticating their customers and staying ahead of identity thieves.</p>
<div id="attachment_33421" style="width: 576px" class="wp-caption aligncenter"><img class="size-full wp-image-33421" src="media/c4591f02.junaid.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/12/junaid.png" alt="Junaid Hussain's Twitter profile photo." width="566" height="606" /><p class="wp-caption-text">Junaid Hussain&#8217;s Twitter profile photo.</p></div>
<p>On Christmas Eve morning, I received an email from PayPal stating that an email address had been added to my account. I immediately logged into my account from a pristine computer, changed the password, switched my email address back to to the primary contact address, and deleted the rogue email account.</p>
<p>I then called PayPal and asked how the perpetrator had gotten in, and was there anything else they could do to prevent this from happening again? The customer service person at PayPal said the attacker had simply logged in with my username and password, and that I had done everything I could in response to the attack. The representative assured me they would monitor the account for suspicious activity, and that I should rest easy.</p>
<p>Twenty minutes later I was outside exercising in the unseasonably warm weather when I stopped briefly to check email again: Sure enough, the very same rogue email address had been added back to my account. But by the time I got back home to a computer, my email address had been removed and my password had been changed. So much for PayPal&#8217;s supposed &#8220;monitoring;&#8221; the company couldn&#8217;t even spot the same fraudulent email address when it was added a second time.</p>
<p>PayPal locked the account shortly after the assailant allegedly tried to send my money to the email account of the late <a href="http://motherboard.vice.com/read/junaid-hussain-isis-hacker-drone" target="_blank">Junaid Hussain</a>, a 17-year-old member of the hacktivist group <a href="https://en.wikipedia.org/wiki/TeaMp0isoN" target="_blank">Team Poison</a>. Hussain &#8212; who used the nickname &#8220;TriCk&#8221; and is believed to have been a prominent ISIS propagandist online &#8212; was <a href="http://www.cnn.com/2015/08/26/politics/isis-recruiter-targeted-in-airstrike/" target="_blank">reportedly</a> killed in a U.S.-led drone strike earlier this year in Raqqa, Syria. No doubt, the attempted transfer was a bid to further complicate matters for me by associating my account with known terrorists.</p>
<p>In my second call to PayPal, I insisted on speaking with a supervisor. That person was able to tell me that, as I suspected, my (very long and complex) password was never really compromised. The attacker had merely called in to PayPal&#8217;s customer support, pretended to be me and was able to reset my password by providing nothing more than the last four digits of my Social Security number and the last four numbers of an old credit card account.</p>
<p>Let&#8217;s leave aside for a moment the reality that all of this static information about Brian Krebs has been posted online by <a href="http://krebsonsecurity.com/2015/10/hacker-who-sent-me-heroin-faces-charges-in-u-s/" target="_blank">various</a> <a href="media/b8990a9e.resc-thanks.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/06/resc-thanks.png" target="_blank">miscreants</a> over the years (and probably remains online): Any company that authenticates customers with nothing more than static identifiers &#8212; address, SSN, DOB, phone number, credit card number, etc. &#8212; is vulnerable to these takeover attempts.</p>
<p>This almost certainly includes all of the companies that supply utilities to your residence, your bank or credit union, and a host of other companies. They&#8217;re vulnerable because those static identifiers about you are no longer secret and are available for sale in the underground.</p>
<p>I asked the PayPal supervisor why the company couldn&#8217;t simply verify my identity by sending a text message to my phone, or a special signal to a PayPal mobile app? After all, PayPal has had the same mobile number of mine on file for years (the attacker also deleted that number from my profile as well). The supervisor explained that the company didn&#8217;t have any mobile authentication technologies, and that in order to regain access to the funds in my account <em>I had to send the company a photocopied or scanned copy of my driver&#8217;s license.</em></p>
<p>Nevermind that it was PayPal&#8217;s lack of any modern authentication methods that led to this mess. Also, let&#8217;s forget for the moment that there are a half-dozen services online that let customers <a href="http://krebsonsecurity.com/2010/12/reintroducing-scanlab-a-k-a-scamlab/" target="_blank">create fake but realistic looking scans of all types of documents</a>, including utility bills, passports, driver&#8217;s licenses, bank statements, etc. This is the ultimate and most sophisticated customer authentication system that PayPal has: Send us a copy of your driver&#8217;s license.<span id="more-33400"></span></p>
<p>When I pressed the PayPal representative about whether he had any other ways to validate my identity short of sending a copy of my license, he offered to do so &#8220;using public records.&#8221; Now, I understand that what he actually meant was that PayPal would work with a major credit bureau to ask me a series of so-called &#8220;out of wallet&#8221; or &#8220;<a href="http://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/" target="_blank">knowledge-based authentication</a>&#8221; (KBA) questions &#8212; essentially yet more requests for static information that can be gleaned from a variety of sources online. But that didn&#8217;t stop me from playfully asking the representative why a security challenge should rely on answers from public records? He responded that someone probably would have to go down to a courthouse somewhere to do that, which made me laugh out loud and wish him a Merry Christmas.</p>
<p>For better or worse, this isn&#8217;t the first time I&#8217;ve had to deal with weaknesses in PayPal&#8217;s anti-fraud systems. Last year, my account was the recipient of a large number of fraudulent donations made through hacked PayPal accounts that all were funded by credit cards instead of bank balances. The problem with fraudulent credit card donations via PayPal is that PayPal assesses the inevitable $20 Visa or MasterCard chargeback fee against the unwitting recipient of the fraudulent donation, effectively taking $20 out of the recipient&#8217;s account for each phony donation!</p>
<p>I called my contact at PayPal who&#8217;d helped work out a stopgap solution to the phony credit card payments, and that person said PayPal would lock my account so that no further account changes would be allowed. I&#8217;m grateful that they were able to do this (so far) but it probably goes without saying that most PayPal users will not have that line of contact or influence at the company.</p>
<div id="attachment_33419" style="width: 276px" class="wp-caption alignright"><img class="size-full wp-image-33419" src="media/689bf11a.paypaltoken.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/12/paypaltoken.png" alt="PayPal's security token isn't much use if the company lets thieves reset your password over the phone using your Social Security number." width="266" height="152" /><p class="wp-caption-text">PayPal&#8217;s security token isn&#8217;t much use if the company lets thieves reset your password over the phone using your Social Security number.</p></div>
<p>PayPal does offer additional security protections &#8212; including a <a href="https://www.paypal.com/webapps/mpp/security/security-protections" target="_blank">PayPal Security Key fob</a> that periodically generates a new one-time password which needs to be entered at login in addition to a username and password. I&#8217;ve used this solution since shortly after the company began offering it almost a decade ago, but a fat lot of good it does if PayPal is going to continue letting users reset their passwords by regurgitating static data that is <a href="http://krebsonsecurity.com/2014/12/toward-a-breach-canary-for-data-brokers/" target="_blank">trivial to purchase from the cybercrime underground.</a></p>
<p>Many companies will offer customers more account security options, but only if asked. Most often, when companies are asked for non-standard security precautions it is because the account holder has stated that he or she was previously the target of cyber stalking or concerted harassment or threats online. I can recall doing this with most of the utilities we use &#8212; including our ISP &#8212; after having ne&#8217;er-do-wells try to shut off our power, phone and water service by calling in with those static identifiers. None of those companies offered more advanced authentication options &#8212; such as <a href="http://krebsonsecurity.com/2015/12/expect-phishers-to-up-their-game-in-2016/" target="_blank">mobile device authentication</a> &#8212; but most would let me place a flag on my account that no changes were to be made unless I showed up at the utility&#8217;s offices in person and presented a photo ID and my username and password.</p>
<p>Although this is effectively the same solution that PayPal offered <em>after</em> it froze my account and available funds, having to visit an office and present my ID to close or make changes to my account is significantly less onerous and aggravating than trying to work that out after the fact while having no electricity, water or Internet.</p>
<p>Longer term, PayPal should review which of its users have already provided mobile phone information, and then seek to validate those contact numbers. Once that process is done, PayPal can start upgrading its authentication systems &#8212; and hopefully become less reliant on static (read: already-compromised) identifiers to validate customers. This would help cut down on account takeovers and reduce the threat of costly, fraudulent credit card donations via hacked accounts.</p>
<p>Until then, PayPal will continue to expose its users unnecessarily to security and privacy threats (bear in mind that a crook who gains access to your PayPal account can see all of your transactions and financial data from associated bank accounts).</p>
<p>Many KrebsOnSecurity readers have been quite generous in supporting my efforts this year, and to those folks (and to anyone else who&#8217;s read this far) I offer a hearty and heartfelt THANK YOU!</p>


feed_id: http://krebsonsecurity.com/?p=33446
title: Happy 6th Birthday, KrebsOnSecurity!
uri: Happy-6th-Birthday-KrebsOnSecurity
url: http://krebsonsecurity.com/2015/12/happy-6th-birthday-krebsonsecurity/
content:
<p>You know you&#8217;re getting old when you can&#8217;t remember your own birthday (a reader tipped me off). Today is the sixth anniversary of this site&#8217;s launch! KrebsOnSecurity turns 6! I&#8217;m pretty sure that&#8217;s like middle age in Internet years.</p>
<p><img class="alignright wp-image-33452" src="media/47bf03ec.sixfingers.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/12/sixfingers.jpg" alt="sixfingers" width="247" height="220" />Absolutely none of this would be possible without you, Dear Reader. You have supported, encouraged and inspired me in too many ways to count these past years. The community that&#8217;s sprung up around here has been a joy to watch, and essential to the site&#8217;s success. Thank you!</p>
<p>I tried for at least one post per weekday in 2015, and came close, publishing some 206 entries this year (not counting this one). The frequency of new posts suffered a bit from September to November, when I was on the road nearly 24/7 for a series of back-to-back speaking gigs. Fun fact: Since its inception, this site has featured some 1,200 stories that generated more than 62,000 reader comments.<span id="more-33446"></span></p>
<p>Here&#8217;s wishing you all a very happy, healthy, wealthy and safe New Year.  Below are some of the KrebsOnSecurity posts that readers found most popular in 2015 (minus the <a href="http://krebsonsecurity.com/?s=ashley+madison&amp;x=0&amp;y=0" target="_blank">Ashley Madison</a> and <a href="http://krebsonsecurity.com/?s=lizard+squad&amp;x=0&amp;y=0" target="_blank">Lizard Squad</a> stuff), along with one or two of my personal favorites in no particular order.</p>
<p>&#8211;<a href="http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">How I Learned to Stop Worrying and Embrace the Security Freeze</a> &#8212; Credit monitoring services offered in the wake of umpteen breaches this year won&#8217;t stop ID thieves from stealing your good name.</p>
<p>&#8211;<a href="http://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass-barcode-a-lot/" target="_blank">What&#8217;s in a Boarding Pass Barcode?</a> &#8211; Sometimes the stories intended to be written in a &#8220;hey-did-you-know&#8221; format turn into national news. Who knew?</p>
<p>&#8211;<a href="http://krebsonsecurity.com/2015/11/how-carders-can-use-ebay-as-a-virtual-atm/" target="_blank">How Carders Can Use eBay as a Virtual ATM</a> &#8211; &#8220;Triangulation fraud&#8221; is big business.</p>
<p>&#8211;<a href="http://krebsonsecurity.com/2015/03/sign-up-at-irs-gov-before-crooks-do-it-for-you/" target="_blank">Sign Up at the IRS Before Crooks Do It For You</a> &#8211; This story about how ID thieves used the IRS&#8217;s own site to steal taxpayer data was published three months before the IRS acknowledged that some 330,000 taxpayers had been impacted.</p>
<p>&#8211;<a href="http://krebsonsecurity.com/2015/03/intuit-failed-at-know-your-customer-basics/" target="_blank">Intuit Failed at Know-Your-Customer Basics</a> &#8211; Much of the tax refund fraud problem can be traced back to poor or non-existent authentication at online tax preparation firms, like <a href="http://krebsonsecurity.com/2015/02/turbotaxs-anti-fraud-efforts-under-scrutiny/" target="_blank">TurboTax</a>.</p>
<p>&#8211;<a href="http://krebsonsecurity.com/2015/10/hacker-who-sent-me-heroin-faces-charges-in-u-s/" target="_blank">Hacker Who Sent Me Heroin Faces Charges in the U.S.</a> &#8211; A stranger-than-fiction story about a cybercrime kingpin who tried to frame me for drug possession and failed spectacularly.</p>
<p>&#8211;<a href="http://krebsonsecurity.com/?s=cancun&amp;x=0&amp;y=0" target="_blank">Bluetooth ATM Skimming Series in Mexico</a> &#8211; I traveled to Cancun in September to chronicle the work of an ATM skimming gang that was bribing ATM technicians to get access to the insides of the cash machines.</p>
<p>&#8211;<a href="http://krebsonsecurity.com/2015/11/gas-theft-gangs-fuel-pump-skimming-scams/" target="_blank">Gas Theft Gangs Fuel Pump Skimming Scams</a> &#8211; It&#8217;s truly remarkable how much effort crooks will put into extracting value from stolen credit and debit cards.</p>
<p>&#8211;<a href="http://krebsonsecurity.com/2015/09/inside-target-corp-days-after-2013-breach/" target="_blank">Inside Target Corp., Days After 2013 Breach</a> &#8211; I got to look at a confidential, internal penetration test that Target commissioned just days after learning it had lost 40 million credit cards. It wasn&#8217;t pretty.</p>
<p>&#8211;<a href="http://krebsonsecurity.com/2015/04/a-day-in-the-life-of-a-stolen-healthcare-record/" target="_blank">A Day in the Life of a Stolen Healthcare Record</a> &#8211; Healthcare organizations have some serious and difficult security challenges ahead of them. I think that explains the reader interest in this story, coupled with the fact that there are so few stories out there about stolen medical info showing up for sale in the cybercrime underground.</p>


feed_id: http://krebsonsecurity.com/?p=33350
title: Fraudsters Automate Russian Dating Scams
uri: Fraudsters-Automate-Russian-Dating-Scams
url: http://krebsonsecurity.com/2016/01/fraudsters-automate-russian-dating-scams/
content:
<p>Virtually every aspect of cybercrime has been made into a service or plug-and-play product. That includes dating scams &#8212; among the oldest and most common of online swindles. Recently, I had a chance to review a package of dating scam emails, instructions, pictures, videos and love letter templates that are sold to scammers in the underground, and was struck by how commoditized this type of fraud has become.</p>
<p>The dating scam package is assembled for and marketed to Russian-speaking hackers, with hundreds of email templates written in English and a variety of European languages. Many of the sample emails read a bit like <a href="https://en.wikipedia.org/wiki/Mad_Libs" target="_blank">Mad Libs</a> or <a href="https://en.wikipedia.org/wiki/Choose_Your_Own_Adventure" target="_blank">choose-your-own-adventure</a> texts, featuring decision templates that include advice for ultimately tricking the mark into wiring money to the scammer.</p>
<p>The romance scam package is designed for fraudsters who prey on lonely men via dating Web sites and small spam campaigns. The vendor of the fraud package advertises a guaranteed response rate of at least 1.2 percent, and states that customers who average 30 scam letters per day can expect to earn roughly $2,000 a week. The proprietor also claims that his method is more than 20% effective within three replies and over 60% effective after eight.</p>
<div id="attachment_33482" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-33482" src="media/b0ca0eb8.lovescam-580x385.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/lovescam-580x385.png" alt="One of hundreds of sample template files in the dating scam package." width="580" height="385" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/01/lovescam-580x385.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/01/lovescam-768x510.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/01/lovescam.png 795w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">One of hundreds of sample template files in the dating scam package.</p></div>
<p>The dating scam package advises customers to stick to a tried-and-true approach. For instance, scammers are urged to include an email from the mother of the girl in the first 10 emails between the scammer and a target. The scammer often pretends to be a young woman in an isolated or desolate region of Russia who is desperate for a new life, and the email from the girl&#8217;s supposed mother is intended to add legitimacy to the scheme.</p>
<p>Then there are dozens of pre-fabricated excuses for not talking on the phone, an activity reserved for the final stretch of the scam when the fraudster typically pretends to be stranded at the airport or somewhere else en route to the target&#8217;s home town.</p>
<p>&#8220;Working with dozens of possible outcomes, they carefully lay out every possible response, including dealing with broke guys who fell in love online,&#8221; said <strong>Alex Holden</strong>, the security expert who intercepted the romance scam package. &#8220;If the mark doesn&#8217;t have money, the package contains advice for getting him credit, telling the customer to restate his love and discuss credit options.&#8221;</p>
<div id="attachment_33498" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-33498" src="media/09f280a7.txt-580x261.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/txt-580x261.png" alt="A sample letter with multiple-choice options for creating unique love letter greetings." width="580" height="261" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/01/txt-580x261.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/01/txt-768x346.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/01/txt.png 784w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A sample letter with multiple-choice options for creating unique love letter greetings.</p></div>
<p>Interestingly, although Russia is considered by many to be among the most hostile countries toward homosexuals, the makers of this dating scam package also include advice and templates for targeting gay men.</p>
<p>Also included in the dating scam tutorial is a list of email addresses and pseudonyms favored by anti-scammer vigilantes who try to waste the scammers&#8217; time and otherwise prevent them from conning real victims. In addition, the package bundles several photos and videos of attractive Russian women, some of whom are holding up blank signs onto which the scammer can later Photoshop whatever message he wants.</p>
<p>Holden said that an enterprising fraudster with the right programming skills or the funds to hire a coder could easily automate the scam using bots that are programmed to respond to emails from the targets with content-specific replies.</p>
<p><span style="text-decoration: underline;">CALL CENTERS TO CLOSE THE DEAL</span></p>
<p>The romance scam package urges customers to send at least a dozen emails to establish a rapport and relationship before even mentioning the subject of traveling to meet the target. It is in this critical, final part of the scam that the fraudster is encouraged to take advantage of criminal call centers that staff women who can be hired to play the part of the damsel in distress.</p>
<div id="attachment_33483" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-33483" src="media/0f7bcfc6.callcenterenter-580x393.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/callcenterenter-580x393.png" alt="The login page for a criminal call center." width="580" height="393" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/01/callcenterenter-580x393.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/01/callcenterenter-768x521.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/01/callcenterenter.png 773w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The login page for a criminal call center.</p></div>
<p>&#8220;When you get down to the final stage, there has to be a crisis, some compelling reason why the target should you send the money,&#8221; said Holden, founder of <a href="http://holdsecurity.com/" target="_blank">Hold Security</a> [full disclosure: Yours Truly is an uncompensated adviser to Holden&#8217;s company]. &#8220;Usually this is something like the girl is stranded at the airport or needs money to get a travel visa. There has to be some kind of distress situation for this person to be duped into wiring money, which can be anywhere between $200 and $2,000 on average.&#8221;<span id="more-33350"></span></p>
<p>Crooked call centers like the one pictured in the screen shot above employ male and female con artists who speak a variety of languages. When the call center employees are not being hired to close the deal on a romance scam, very often they are used to assist in bank account takeovers, redirecting packages with shipping companies, or handling fraudulent new credit applications that require phone verification.</p>
<p>Another reason that call centers aren&#8217;t used earlier in romance scams: Hiring one is expensive. The call center pictured above charges $10 per call, payable only in Bitcoin.</p>
<p>&#8220;If you imagine the cost of doing by phone every part of the scam, it’s rather high, so they do most of the scam via email,&#8221; Holden said. &#8220;What we tend to see with these dating scams is the scammer will tell the call center operator to be sure to mention special nicknames and to remind him of specific things they talked about in their email correspondence.&#8221;</p>
<div id="attachment_33490" style="width: 590px" class="wp-caption aligncenter"><img class="wp-image-33490 size-medium" src="media/acd61495.sparta-ad-580x286.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/sparta-ad-580x286.png" alt="sparta-ad" width="580" height="286" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/01/sparta-ad-580x286.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/01/sparta-ad-768x378.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/01/sparta-ad-940x463.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/01/sparta-ad.png 1430w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">An ad for a criminal call center that specializes in online dating scams. This one, run by a cybecrook who uses the nickname &#8220;Sparta,&#8221; says &#8220;Only the best calls for you.&#8221;</p></div>
<p>Check back later this week for a more in-depth story about criminal call centers.</p>


feed_id: http://krebsonsecurity.com/?p=33510
title: Account Takeovers Fueling ‘Warranty Fraud’
uri: Account-Takeovers-Fueling-Warranty-Fraud
url: http://krebsonsecurity.com/2016/01/account-takeovers-fueling-warranty-fraud/
content:
<p>Cybercrime takes many forms, but one of the more insidious and perhaps less obvious manifestations is warranty fraud. This scheme involves con artists who assume the identity of a consumer, complain that a given product has ceased to operate as expected, and demand that the retailer replace the article in question. Such claims turn into a loss for targeted merchants when the scammer hacks an unwitting customer&#8217;s account and replaces the customer&#8217;s email address with his own address and demands that the retailer ship him a brand new device.</p>
<div id="attachment_33514" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-33514" src="media/3cf90935.fitbitleak-580x311.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/fitbitleak-580x311.png" alt="Leakforums is a big source of account takeover and waranty fraud for a variety of products." width="580" height="311" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/01/fitbitleak-580x311.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/01/fitbitleak-768x411.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/01/fitbitleak-940x503.png 940w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Leakforums is a big source of account takeover and waranty fraud for a variety of products.</p></div>
<p>Fitness tracking giant <strong>FitBit</strong> recently found itself the target of such fraud in the last few months of 2015, when the company noticed large caches of data from customer accounts being posted to Pastebin. To the untrained eye, such data might seem at first glance to indicate that FitBit had experienced a breach that exposed their user account data. Included in the data dumps posted to Pastebin were details about the make and model number of each user&#8217;s fitness tracker, as well as information about the last time the user had synced the device.</p>
<p>But a more nuanced look at the information posted to Pastebin and other public data dump sites indicates that FitBit is just the latest victim of customer account takeovers powered by breaches at other e-commerce providers.</p>
<div id="attachment_33516" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-33516" src="media/e6fffbdd.fitbitsales2-580x308.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/fitbitsales2-580x308.png" alt="Hacked FitBit user accounts sell for about $2 apiece." width="580" height="308" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/01/fitbitsales2-580x308.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/01/fitbitsales2-768x408.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/01/fitbitsales2-940x500.png 940w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Hacked FitBit user accounts sell for about $2 apiece.</p></div>
<p>I reached out to FitBit about this and the company&#8217;s security chief <strong>Marc Bown</strong> said the data appears to coming from a couple of sources: Customer computers that have been compromised by password-stealing malware, and customers who re-use the same credentials across a broad swath of sites online.</p>
<p>&#8220;They&#8217;re mainly interested in the premium devices,&#8221; Bown said, referring to the most expensive devices that FitBit sells &#8212; such as the Surge, which retails for about $250. &#8220;Those are the ones that we&#8217;re seeing are most targeted for warranty fraud.&#8221;<span id="more-33510"></span></p>
<p>Bown the fraudsters will log in to the customer&#8217;s account and change the email address and on the customer&#8217;s account. The scammers then call FitBit&#8217;s customer service folks, claim that their device has stopped working, and demand a replacement.</p>
<p>&#8220;Basically, they start a support case with customer service, but before they do that, they change the email address on the account they hacked to an address that they control, and at that point they are the customer,&#8221; Bown said. &#8220;For a lot of customers, this ends up creating a pretty negative experience.&#8221;</p>
<p>Bown said after several weeks of battling warranty fraud, the company has more or less solved the problem by educating their customer service employees and assigning risk scores to all warranty replacement requests.</p>
<p>&#8220;Account takeover is a thing for all online organizations,&#8221; Bown said. &#8220;If we see an account that was used in a suspicious way, or a large number of login requests for accounts coming from a small group of Internet addresses, we&#8217;ll lock the account and have the customer reconfirm specific information.&#8221;</p>
<p>E-commerce companies can increase the level of security for user accounts by requiring two-step or two-factor authentication, which usually involves sending a one-time code to the user&#8217;s mobile device that needs to be inputted in addition to the customer&#8217;s username and password. Bown said FitBit is considering adding this capability to user accounts.</p>
<p>&#8220;I&#8217;m not sure the type of user who is using the same password at every site is the great target for that,&#8221; Bown said. &#8220;But we should offer it, and it&#8217;s something we plan to offer in 2016 natively.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=33486
title: A Look Inside Cybercriminal Call Centers
uri: A-Look-Inside-Cybercriminal-Call-Centers
url: http://krebsonsecurity.com/2016/01/a-look-inside-cybercriminal-call-centers/
content:
<p>Crooks who make a living via identity theft schemes, dating scams and other con games often run into trouble when presented with a phone-based challenge that requires them to demonstrate mastery of a language they don&#8217;t speak fluently. Enter the criminal call center, which allows scammers to outsource those calls to multi-lingual men and women who can be hired to close the deal.</p>
<p>Some of these call centers are Web-based, allowing customers to upload information about their targets to a service that initiates the call to a bank, credit provider, shipping company or dating scam victim (for more on the role played by call centers in dating schemes, see last week&#8217;s story, <a href="http://krebsonsecurity.com/2016/01/fraudsters-automate-russian-dating-scams/" target="_blank">Fraudsters Automate Russian Dating Scams</a>). Other call centers require customers to supply information about the target and the needed service via Jabber instant message. This post focuses on Web-based call services.</p>
<p>In the call service pictured below, we can see one user ordering a $250 radio-controlled toy Ford Mustang as a gift for someone&#8217;s kid for the holidays. The customer of the call service specifies the <strong>American Express</strong> card account to be used for the transaction, and requests that the order be expedited to a <a href="http://krebsonsecurity.com/2015/09/with-stolen-cards-fraudsters-shop-to-drop/" target="_blank">reshipping mule</a> who will forward the goods to Russia. The status of the transaction indicates that this particular order was successfully placed on Jan. 7, 2016.</p>
<div id="attachment_33535" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/1ec6c1ab.brborder.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/brborder.png"><img class="wp-image-33535 size-medium" src="media/25829ae0.brborder-580x424.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/brborder-580x424.png" alt="A customer of this crooked call center is ordering a holiday gift for someone's kid." width="580" height="424" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/01/brborder-580x424.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/01/brborder-768x561.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/01/brborder-940x687.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/01/brborder.png 1240w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A customer of this crooked call center is ordering a holiday gift for someone&#8217;s kid.</p></div>
<p>One of the cybercrime underground&#8217;s oldest call center services &#8212; <strong>CallMeBaby</strong> &#8212; serves a variety of swindles but specializes in helping criminals cash out dating scams. It charges $10 for each call in English, and $12 for calls in German, French, Italian, Spanish, Portuguese and Polish. Here&#8217;s an ad for the four-year-old service, which features an illustration of a blonde woman chatting with President Obama:</p>
<div id="attachment_33533" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/d48e55d4.callme.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/callme.png"><img class="wp-image-33533 size-medium" src="media/88198282.callme-580x502.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/callme-580x502.png" alt="An underground ad for a call service run by a cybercrook who uses the nickname &quot;Sparta&quot;" width="580" height="502" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/01/callme-580x502.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/01/callme-768x664.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/01/callme-940x813.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/01/callme.png 1260w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">An underground ad for a call service run by a cybercrook who uses the nickname &#8220;Sparta.&#8221;</p></div>
<p>CallMeBaby advertises the availability of a male and female to impersonate anyone in the above-supported languages, and operates between the hours of 17:00 to 03:00 Moscow time (business hours in America).<span id="more-33486"></span></p>
<p>The CallMeBaby Web-based service, pictured below, includes a &#8220;urgent&#8221; button where paying customers in a special hurry can expedite calls for an extra fee. &#8220;Sparta,&#8221; the nickname of the cybercrook who runs the service, warns customers that if the call service has to make a second call to complete the transaction because of insufficient information provided by the customer, that customer will be charged twice.</p>
<div id="attachment_33504" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/c6c48f53.cmb.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/cmb.png"><img class="wp-image-33504 size-medium" src="media/f22cd65e.cmb-580x185.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/cmb-580x185.png" alt="Criminal call service CallMeBaby." width="580" height="185" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/01/cmb-580x185.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/01/cmb-768x245.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/01/cmb-940x300.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/01/cmb.png 1018w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Criminal call service CallMeBaby. The guy pictured between the two girls is NSA whistleblower Edward Snowden.</p></div>
<p>&#8220;If you call the bank it can take up to 40 minutes (during rush hour, getting bank statements sometimes takes a long time),&#8221; Sparta says in an ad for his service. &#8220;But we will do everything to make your call as quick as possible.&#8221;</p>
<p>Crooked call services, like other dodgy online businesses, rely on catchy advertisements and graphic designs to differentiate themselves from other services and to attract new customers. The sketch below &#8212; shown from concept to completed product &#8212; was commissioned by a call center operator and intercepted after being posted to a file-sharing site online. The image depicts a female call service employee successfully tricking an American Express customer service person into approving a fraudulent transaction.</p>
<div id="attachment_33505" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/8e6c7acc.callcentersketch.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/callcentersketch.png"><img class="wp-image-33505 size-medium" src="media/5f6e4fc4.callcentersketch-580x356.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/callcentersketch-580x356.png" alt="This image shows a commissions ad for a criminal call center service, from concept to final design. Credit: Hold Security. " width="580" height="356" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/01/callcentersketch-580x356.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/01/callcentersketch-768x471.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/01/callcentersketch.png 931w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">This image shows a commissioned ad for a criminal call center service, from concept to final design. Credit: Hold Security.</p></div>
<p>Criminal call centers would seem to be a terrific opportunity for <a href="https://en.wikipedia.org/wiki/Speaker_recognition" target="_blank">voice biometrics technology</a>, an anti-fraud solution which focuses on building unique voice fingerprints of known criminals and applying special anti-fraud screening to future calls from individuals who match those voice profiles.</p>


feed_id: http://krebsonsecurity.com/?p=33561
title: Adobe, Microsoft Push Reader, Windows Fixes
uri: Adobe-Microsoft-Push-Reader-Windows-Fixes
url: http://krebsonsecurity.com/2016/01/adobe-microsoft-push-reader-windows-fixes/
content:
<p><strong>Adobe</strong> and <strong>Microsoft</strong> each issued updates today to fix critical security problems with their software. Adobe&#8217;s patch tackles 17 flaws in its <strong>Acrobat</strong> and <strong>PDF Reader</strong> products. <strong>Microsoft</strong> released nine update bundles to plug at least 22 security holes in <strong>Windows</strong> and associated software.</p>
<p><img class="alignright wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="212" height="222" />Six of the nine patches Microsoft is pushing out today address flaws the software giant considers &#8220;critical,&#8221; meaning the vulnerabilities could be exploited by malware or miscreants to break into vulnerable computers remotely without any help from users. The critical updates tackle problems with <a href="https://technet.microsoft.com/en-us/library/security/MS16-001" target="_blank">Internet Explorer</a>, <a href="https://technet.microsoft.com/en-us/library/security/MS16-002" target="_blank">Microsoft Edge</a>, <a href="https://technet.microsoft.com/en-us/library/security/MS16-004" target="_blank">Office</a> and <a href="https://technet.microsoft.com/en-us/library/security/MS16-006" target="_blank">Silverlight</a>, among other components. Links to all of the updates are available <a href="https://technet.microsoft.com/en-us/security/bulletin/dn602597.aspx" target="_blank">here</a>.</p>
<p>As <a href="https://community.qualys.com/blogs/laws-of-vulnerabilities/2016/01/12/path-tuesday-january-2016" target="_blank">noted</a> by security firm <strong>Qualys</strong>, several versions of Internet Explorer will get their last security updates this month, including IE 11 on Windows 7 and 10; IE 8, 9 and 10; IE 10 on Server 2012; IE 9 on Vista Service Pack 2 and Server 2008; and IE7 and IE8. If you&#8217;re using one of these older versions of IE, consider switching &#8212; either to a newer, supported version of IE, or to something less tightly bound to the Windows operating system, such as <strong>Google Chrome</strong>.<span id="more-33561"></span></p>
<p>It appears that Microsoft pulled one of the updates (MS16-009) at the last minute, probably due to issues in testing the fix to make sure it won&#8217;t interfere with other programs. In any case, if you use Microsoft&#8217;s products, take a moment this week to make sure that you&#8217;re up to date with these and other available security patches from Redmond.</p>
<p><img class="alignleft wp-image-19098" src="media/762505af.adobeshattered-285x285.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/adobeshattered-285x285.png" alt="adobeshattered" width="215" height="215" srcset="http://krebsonsecurity.com/wp-content/uploads/2013/02/adobeshattered-150x150.png 150w, http://krebsonsecurity.com/wp-content/uploads/2013/02/adobeshattered-285x285.png 285w, http://krebsonsecurity.com/wp-content/uploads/2013/02/adobeshattered.png 457w" sizes="(max-width: 215px) 100vw, 215px" />Separately, Adobe has released <a href="https://helpx.adobe.com/security/products/acrobat/apsb16-02.html" target="_blank">critical updates</a> for Adobe Acrobat and Reader. Adobe said it was not aware of any active attacks against the vulnerabilities fixed in this month&#8217;s release. Adobe also is phasing out older versions of Acrobat and Reader: As the company notes in this <a href="https://blogs.adobe.com/documentcloud/adobe-acrobat-x-and-adobe-reader-x-end-of-support/" target="_blank">blog post</a>, Adobe Acrobat X and Adobe Reader X are no longer supported.</p>
<p>Adobe Reader comes bundled with a number of third-party software products, but many Windows users may not realize there are alternatives, including some good free ones. For a time I used <strong>Foxit Reader</strong>, but that program seems to have grown more bloated with each release. My current preference is <a href="http://www.sumatrapdfreader.org/free-pdf-reader.html" target="_blank">Sumatra PDF</a>; it is lightweight (about 40 times smaller than Adobe Reader) and quite fast.</p>


feed_id: http://krebsonsecurity.com/?p=33527
title: Ransomware a Threat to Cloud Services, Too
uri: Ransomware-a-Threat-to-Cloud-Services-Too
url: http://krebsonsecurity.com/2016/01/ransomware-a-threat-to-cloud-services-too/
content:
<p>Ransomware &#8212; malicious software that encrypts the victim&#8217;s files and holds them hostage unless and until the victim pays a ransom in Bitcoin &#8212; has emerged as a potent and increasingly common threat online. But many Internet users are unaware that ransomware also can just as easily seize control over files stored on cloud services.</p>
<p><img class="alignright wp-image-33590" src="media/bd595414.ransomhand.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/ransomhand.png" alt="ransomhand" width="309" height="239" /><strong>Toni Casala</strong> found this out the hard way. Casala&#8217;s firm &#8212; Children in Film &#8212; works as an advocate for young actors and their families. The company&#8217;s entire operations run off of application hosting services at a managed cloud solutions firm in California, from QuickBooks to Microsoft Office and Outlook. Employees use <strong>Citrix</strong> to connect to the cloud, and the hosting firm&#8217;s application maps the cloud drive as a local disk on the user&#8217;s hard drive.</p>
<p>&#8220;We were loving that situation,&#8221; Casala said. &#8220;We can keep the computers here at work empty, and the service is very inexpensive when you compare it the cost of having more IT people on staff. Also, when we need support, they are very responsive. We don&#8217;t get farmed out to some call center in India.&#8221;</p>
<p>They were loving it, that is, until just before New Year&#8217;s Eve, when an employee opened an email attachment that appeared to be an invoice. Thirty minutes later, nobody in Casala&#8217;s firm could access any of the company&#8217;s 4,000+ files stored on the cloud drive.</p>
<p>&#8220;Someone in my office was logged into Outlook and opened up invoice attachment and BAM!, within 30 minutes, every single file on our Q drive had &#8216;vvv&#8217; added as file extensions,&#8221; she said. Every single folder -had a file that said &#8220;help.decrypt,&#8221; essentially the attacker&#8217;s&#8217; instructions for how to pay the ransom.</p>
<p>The cloud provider that Casala&#8217;s company is using was keeping daily backups, but she said it still took them almost a week to fully restore all of the files that were held hostage. She said the hosting service told her that the malware also disrupted operations for other customers on the same server.</p>
<p>Casala said her company got lucky on several fronts. For starters, the infection happened right before her firm closed down operations for the New Year&#8217;s break, so the outage was less of a disruption than it might normally have been.</p>
<p>More importantly, the malware that scrambled their files &#8212; a strain of ransomware called <a href="https://blog.kaspersky.com/teslacrypt-strikes-again/10860/" target="_blank">TeslaCrypt</a>, contained a coding weakness that has allowed security and antivirus firms to help victims decrypt the files without paying the ransom. Users over at the computer help forum <a href="http://www.bleepingcomputer.com/forums/t/575875/new-teslacrypt-version-released-that-uses-the-exx-extension/" target="_blank">BleepingComputer</a> have created TeslaDecoder, which allows victims to decrypt files locked by TeslaCrypt.</p>
<p>Casala said the hosting firm had antivirus installed on the server, but that the ransomware slipped past those defenses. That&#8217;s because the crooks who are distributing ransomware engineer the malware to evade detection by antivirus software. For more on how cybercriminals achieve that, see <a href="http://krebsonsecurity.com/2014/05/antivirus-is-dead-long-live-antivirus/" target="_blank">Antivirus is Dead: Long Live Antivirus</a>.</p>
<p>The best defense against ransomware is a good set of data backups that are made each day &#8212; preferably to a device that is not always connected to the network. Unfortunately, this is often easier said than done, especially for small businesses. For many ransomware victims who do not have backups to rely upon, the choice of whether to pay comes down to the question of how badly the victim needs access to the ransomed files, and whether the files lost are worth more than the ransom demand (which is usually only a few hundred dollars in Bitcoin).<span id="more-33527"></span></p>
<p>Many readers may have a hard time believing that ransomware peddlers will actually return the encrypted files to their original state if the ransom is paid. But cyber criminals who run these schemes have a vested interest in making sure the transaction is a relatively seamless one: They understand that if word gets out that victims aren&#8217;t getting their files back after paying, fewer victims will pay. What&#8217;s more, the amount demanded in ransom is about hitting that sweet spot: Thieves know that if they demand too much from each victim, they&#8217;ll have fewer victims who end up paying.</p>
<p>That said, ransomware is computer code, and even malware coders make mistakes. Every so often, crooks will release a new version of ransomware that <a href="http://www.bleepingcomputer.com/news/security/shoddy-programming-causes-new-ransomware-to-destroy-your-data/" target="_blank">contains critical programming errors</a>, effectively rendering the victim&#8217;s files unrecoverable even if they do pay the ransom.</p>
<p>One big reason that ransomware scams are becoming more prevalent has to do with the proliferation of plug-and-play tools and services that make it simple to start your own cybercrime syndicate. Earlier this month, security firm <strong>Emsisoft</strong> published a fascinating look at a crimeware-as-a-service product being marketed in the underground called <a href="http://blog.emsisoft.com/2016/01/01/meet-ransom32-the-first-javascript-ransomware/?ref=ticker160111&amp;utm_source=newsletter&amp;utm_medium=newsletter&amp;utm_content=mainnews&amp;utm_campaign=ticker160111" target="_blank">Ransom32</a>, which allows anyone to start their own ransomware campaign just by providing a Bitcoin address to which victims will be asked to send the funds.</p>
<div id="attachment_33592" style="width: 464px" class="wp-caption aligncenter"><img class="size-full wp-image-33592" src="media/3d92acf2.ransom32.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/ransom32.png" alt="The crimeware as a service ransomware package, Ransome32. Image: Emisoft." width="454" height="729" /><p class="wp-caption-text">The crimeware as a service ransomware package, Ransome32. Image: Emsisoft.</p></div>
<p>&#8220;After you type in your Bitcoin address, you will get access to the rudimentary administration panel,&#8221; the company explained. &#8220;In the admin panel, you can get various statistics, like for example how many people already paid or how many systems were infected. You can also configure your “client”, which is their term for the actual malware. It is possible to change the amount of Bitcoins the malware will ask for, as well as configure parameters like fake message boxes the malware is supposed to show during install.&#8221;</p>
<p>According to Emsisoft, the Ransom32 crimeware service also includes a feature that offers to decrypt a single file to demonstrate that the malware author has the capability to reverse the encryption.</p>
<p>It seems to me that ransomware attacks have a great deal of room for growth. I would expect criminals who have the skills to construct and manage their own ransomware campaigns eventually to begin doing a better job targeting victims &#8212; that is, taking the extra time to get a better idea of how much the ransomed files are worth, and then adjusting the ransom demand accordingly.</p>
<p>If you or your company is hit with ransomware, resist the temptation to pay up, which just perpetuates these scams. Take a deep breath, head on over to <a href="http://www.bleepingcomputer.com/virus-removal/ransomware" target="_blank">BleepingComputer&#8217;s ransomware removal section</a>, which includes resources that may allow you to recover files without rewarding the crooks.</p>


feed_id: http://krebsonsecurity.com/?p=33600
title: Hyatt Card Breach Hit 250 Hotels in 50 Nations
uri: Hyatt-Card-Breach-Hit-250-Hotels-in-50-Nations
url: http://krebsonsecurity.com/2016/01/hyatt-card-breach-hit-250-hotels-in-50-nations/
content:
<p>If you stayed, ate or played at a <strong>Hyatt</strong> hotel between Aug. 13 and Dec. 8, 2015, there&#8217;s a good chance your credit or debit card data was stolen by unknown cyber thieves who infiltrated many of the hotel chain&#8217;s payment systems. Its its first disclosure about the scope of a breach <a href="http://krebsonsecurity.com/2015/12/malware-driven-card-breach-at-hyatt-hotels/">acknowledged last month</a>, Hyatt Hotels Corp. says the intrusion likely affected guests at 250 hotels in roughly 50 countries.</p>
<p><img class="alignright size-full wp-image-33392" src="media/a55f8920.hyatt.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/12/hyatt.png" alt="hyatt" width="237" height="231" />In <a href="http://newsroom.hyatt.com/news-releases?item=123453" target="_blank">a statement</a> released Thursday, Hyatt said the majority of the payment systems compromised by card-stealing malware were at restaurants within the hotels, and that a &#8220;small percentage of the at-risk cards were used at spas, golf shops, parking and a limited number of front desks.&#8221; The list of affected hotels is <a href="http://www.hyatt.com/protectingourcustomers" target="_blank">here</a>.</p>
<p>Chicago-based Hyatt joins a crowded list of other hotel chains similarly breached in the past year, including <a href="http://krebsonsecurity.com/2015/11/hilton-acknowledges-credit-card-breach/" target="_blank">Hilton</a>, <a href="http://krebsonsecurity.com/2015/11/starwood-hotels-warns-of-credit-card-breach/" target="_blank">Starwood</a>, <a href="http://krebsonsecurity.com/2015/03/credit-card-breach-at-mandarian-oriental/" target="_blank">Mandarin Oriental</a>, <a href="http://krebsonsecurity.com/2015/04/white-lodging-confirms-second-breach/" target="_blank">White Lodging</a> (twice) and the <a href="http://krebsonsecurity.com/2015/10/trump-hotel-collection-confirms-card-breach/" target="_blank">Trump Collection</a>.</p>
<p><span style="text-decoration: underline;">ANALYSIS/RANT</span></p>
<p>U.S. banks have been transitioning to offering chip-based credit and debit cards, and a greater number of retailers are installing checkout systems that can read customer card data off the chip. The chip encrypts the card data and makes it much more difficult and expensive for thieves to counterfeit cards.</p>
<p>However, most of these chip cards will still hold customer data in plain text on the card&#8217;s magnetic stripe, and U.S. merchants that continue to allow customers to swipe the stripe or who do not have chip card readers in place face shouldering all of the liability for any transactions later determined to be fraudulent.</p>
<p>The United States is the last of the G20 nations to enact this liability shift, and many countries that have transitioned to chip card technology have done so through government fiat. Those nations also almost uniformly have seen card counterfeiting fraud go way down while thieves shift their attention to targeting e-commerce providers.</p>
<p>Although cyber thieves still steal card data off the magnetic stripe from customers of banks in nations that long ago shifted to chip-cards, that card data is typically shipped to thieves here in the United States, who can counterfeit the cards and use them to steal merchandise from U.S.-based big box retailers.</p>
<p>What&#8217;s remarkable about the U.S. experiment with moving to chip cards is that the discussion about whether and when to move to more physical security (chips) in credit and debit cards has played out almost entirely apart from the move to impose expensive and increasingly labyrinthine compliance regulations (<a href="https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard" target="_blank">PCI</a>) on merchants that wish to process or accept card transactions.<br />
<span id="more-33600"></span></p>
<p>Instead of just mandating that banks and retailers shift in lockstep on a to handling chip cards, U.S. lawmakers and regulators have for years delegated (abdicated?) accountability for credit card security to a booming industry of auditors and assessors who&#8217;ve been trying to secure a technology (magnetic stripe-based cards) that is 60 years old and is about as secure as mailing your credit card number on a postcard.</p>
<p>For all the attention given to <a href="http://krebsonsecurity.com/all-about-skimmers/" target="_blank">sophisticated new ATM and card skimming devices</a>, for example, the technology included in skimmers to steal card data from the magnetic stripe need be no more sophisticated than the components of a 35-year-old <a href="https://en.wikipedia.org/wiki/Walkman" target="_blank">Sony Walkman</a>. I should note here that while the chip-based liability shift for retailers went into effect in October 2015, that same shift doesn&#8217;t extend to ATM machines until October 2016 and for unattended payment terminals (e.g. gas pumps) until October 2017.</p>
<p>As chip card adoption picks up here in the States and counterfeiting cards becomes more expensive for cyber thieves, we will start to hear about far fewer of these retail breaches. E-commerce providers will no doubt feel the brunt of this shift because the thieves don&#8217;t just go away when you make things harder on them &#8212; they  go where there are more plentiful victims and fewer up-front costs. And for cybercrooks, there is a great deal of low-hanging fruit in the e-commerce sector (and there are plenty new businesses coming online for the first time every day).</p>
<p>There is another big shift in fraud that&#8217;s coming but that is probably not getting enough attention from the banks, retailers and e-commerce providers: It&#8217;s a safe bet that we can also expect a giant spike in account takeovers and in new account fraud. Both forms of fraud are closely linked to static consumer identity data (SSN, DOB, etc.) that is widely available in the cybercrime underground. Banks and retailers alike have a lot of work ahead of them to improve the reliability and scalability of systems for authenticating and really knowing their customers.</p>
<p>Instead, many financial institutions have squandered a great deal of their resources trying to figure out which retailers are exposing their customers&#8217; cards. That&#8217;s because Visa, MasterCard and the other card associations won&#8217;t tell banks which retailers have been hit; they just send them incessant updates about specific card numbers that were suspected to have been compromised in a breach somewhere. It&#8217;s then up to the banks to work backwards from the breached cards and triangulate which merchants show up most frequently in a batch of given cards.</p>
<p>All of this probably explains why on any given week I&#8217;m contacted by anti-fraud personnel at various banks across the country, asking if I can help them divine the source of some card fraud pain they&#8217;re experiencing. As a journalist, this is a bit of a surreal situation, but I can&#8217;t complain much: It has allowed this author to break story after story about card breaches in the retail sector over the past two years.</p>


feed_id: http://krebsonsecurity.com/?p=33663
title: Oracle Pushes Java Fix: Patch It or Pitch It
uri: Oracle-Pushes-Java-Fix-Patch-It-or-Pitch-It
url: http://krebsonsecurity.com/2016/01/oracle-pushes-java-fix-patch-it-or-pitch-it/
content:
<p><strong>Oracle</strong> has shipped an update for its <strong>Java</strong> software that fixes at least eight critical security holes. If you have an affirmative use for Java, please update to the latest version; if you&#8217;re not sure why you have Java installed, it&#8217;s high time to remove the program once and for all.</p>
<p><img class="alignright size-medium wp-image-19243" src="media/5c15b877.javamess-285x226.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/03/javamess-285x226.jpg" alt="javamess" width="285" height="226" />According to Oracle&#8217;s <a href="https://blogs.oracle.com/security/entry/january_2016_critical_patch_update" target="_blank">release notes</a>, seven of the eight vulnerabilities may be remotely exploitable without authentication &#8212; meaning they could be exploited over a network by malware or miscreants without the need for a username and password. The version with the latest security fixes is <em>Java 8, Update 71</em>. Updates also should be available via the <a title="http://www.java.com/en/download/help/javaconsole.xml" href="http://www.java.com/en/download/help/javaconsole.xml" target="_blank" rel="noreferrer">Java Control Panel</a> or from <a title="http://www.java.com" href="http://www.java.com/" target="_blank" rel="noreferrer">Java.com</a>.</p>
<p>Windows users can check for the program in the Add/Remove Programs listing in Windows, or visit Java.com and click the “Do I have Java?” link on the homepage.<span id="more-33663"></span></p>
<p>If you really need and use Java for specific Web sites or applications, take a few minutes to update this software. Otherwise, seriously consider removing Java altogether. I have long urged end users to junk Java unless they have a specific use for it (this advice does not scale for businesses, which often have legacy and custom applications that rely on Java). This widely installed and powerful program is riddled with security holes, and is a top target of malware writers and miscreants.</p>
<p>If you have an specific use or need for Java, there is a way to have this program installed while minimizing the chance that crooks will exploit unknown or unpatched flaws in the program: unplug it from the browser unless and until you’re at a site that requires it (or at least take advantage of <a title="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" href="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" target="_blank">click-to-play</a>, which can block Web sites from displaying both Java and Flash content by default). The latest versions of Java let users <a title="http://www.java.com/en/download/help/disable_browser.xml" href="http://www.java.com/en/download/help/disable_browser.xml" target="_blank" rel="noreferrer">disable Java content in web browsers</a> through the <a title="http://www.java.com/en/download/help/javaconsole.xml" href="http://www.java.com/en/download/help/javaconsole.xml" target="_blank" rel="noreferrer">Java Control Panel</a>.</p>
<p>Alternatively, consider a dual-browser approach, unplugging Java from the browser you use for everyday surfing, and leaving it plugged in to a second browser that you only use for sites that require Java.</p>
<p>Many people confuse Java with <strong> JavaScript</strong>, a powerful scripting language that helps make sites interactive. Unfortunately, a huge percentage of Web-based attacks use JavaScript tricks to foist malicious software and exploits onto site visitors. For more about ways to manage JavaScript in the browser, check out my tutorial <a title="http://krebsonsecurity.com/tools-for-a-safer-pc/" href="http://krebsonsecurity.com/tools-for-a-safer-pc/" target="_blank">Tools for a Safer PC</a>.</p>


feed_id: http://krebsonsecurity.com/?p=33668
title: Skype Now Hides Your Internet Address
uri: Skype-Now-Hides-Your-Internet-Address
url: http://krebsonsecurity.com/2016/01/skype-now-hides-your-internet-address/
content:
<p>Ne&#8217;er-do-wells have long abused a feature in <strong>Skype</strong> to glean the Internet address of other users. Indeed, many shady online services that can be hired to launch attacks aimed at knocking users offline bundle so-called &#8220;Skype resolvers&#8221; that let customers find a target&#8217;s last known location online. At long last, <strong>Microsoft</strong> says its latest version of Skype will hide user Internet addresses by default.</p>
<p>&#8220;Starting with this update to Skype and moving forward, your IP address will be kept hidden from Skype users,&#8221; Microsoft&#8217;s Skype team wrote in <a href="http://blogs.skype.com/2016/01/21/to-our-gamers-ip-will-now-be-hidden-by-default-in-latest-update/" target="_blank">a blog post</a> about the latest version, <em>v. 7.0.18.109</em> for most users. &#8220;This measure will help prevent individuals from obtaining a Skype ID and resolving to an IP address.&#8221;</p>
<div id="attachment_19523" style="width: 610px" class="wp-caption aligncenter"><img class="size-large wp-image-19523" src="media/61d46158.anonyresolver-600x334.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/03/anonyresolver-600x334.png" alt="A Skype resolver service in action." width="600" height="334" srcset="http://krebsonsecurity.com/wp-content/uploads/2013/03/anonyresolver-600x334.png 600w, http://krebsonsecurity.com/wp-content/uploads/2013/03/anonyresolver.png 912w" sizes="(max-width: 600px) 100vw, 600px" /><p class="wp-caption-text">A Skype resolver service in action.</p></div>
<p>Typically, these Skype resolvers are offered in tandem with <a href="http://krebsonsecurity.com/?s=booter+services&amp;x=0&amp;y=0" target="_blank">“booter” or “stresser” services</a>, online attack tools-for-hire than can be rented to launch denial-of-service attacks (most often against online gamers). The idea being that if you want to knock someone offline but you don’t know their Internet address, you can simply search on Skype to see if they have an account, and then use the resolvers to locate their IP. Thus far, the resolvers have worked regardless of any privacy settings the target user may have selected within the Skype program’s configuration panel.<span id="more-33668"></span></p>
<p>Redmond purchased Skype in 2011, and since then has changed many features of the peer-to-peer (P2P), voice-over-IP and messaging service, which now comes bundled with <strong>Windows 10</strong>. But it hasn&#8217;t heretofore changed the core <a href="https://support.skype.com/en/faq/FA10983/what-are-p2p-communications" target="_blank">P2P component</a> of Skype, a feature that acts much like popular file-sharing applications in that it dynamically routes bandwith-intensive tasks that would otherwise need to be handled by centralized servers. However, this flexibility and scalability comes at a cost: The IP address of every user must be shared across the Skype network so that individual users can talk and connect directly to one another.</p>
<p>It remains unclear what tweaks Microsoft made to achieve this result, and whether this fix will remain effective. This isn&#8217;t the first time Microsoft has promised to put a stop to IP address leaks in Skype: In May 2013, Microsoft <a href="http://krebsonsecurity.com/2013/05/skype-beta-plugs-ip-resolver-privacy-leak/" target="_blank">released a beta version of Skype</a> that was designed to mitigate the issue, but booter service operators quickly figured out ways around the new protections.</p>


feed_id: http://krebsonsecurity.com/?p=33650
title: Guy Who Tried to Frame Me In Heroin Plot Pleads Guilty to Cybercrime Charges
uri: Guy-Who-Tried-to-Frame-Me-In-Heroin-Plot-Pleads-Guilty-to-Cybercrime-C
url:
http://krebsonsecurity.com/2016/01/guy-who-tried-to-frame-me-in-heroin-plot-pleads-guilty-to-cybercrime-charges/

content:
<p>A Ukrainian man who tried to frame me for heroin possession has pleaded guilty to multiple cybercrime charges in U.S. federal court, including credit card theft and hacking into more than 13,000 computers.</p>
<div id="attachment_26609" style="width: 207px" class="wp-caption alignright"><img class="size-full wp-image-26609" src="media/5fb288e3.s-vovnenko.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/06/s-vovnenko.png" alt="Sergei &quot;Fly&quot; Vovnenko, in an undated photo. In a letter to this author following his arrest, Vovnenko said he forgave me for &quot;doxing&quot; him -- printing his real name and image -- on my site." width="197" height="252" /><p class="wp-caption-text">Sergei &#8220;Fly&#8221; Vovnenko, in an undated photo. In a letter to this author following his arrest, Vovnenko said he forgave me for &#8220;doxing&#8221; him &#8212; printing his real name and image &#8212; on my site.</p></div>
<p><strong>Sergey Vovnenko</strong>, 29, entered a guilty plea in Newark, New Jersey to charges of aggravated identity theft and conspiracy to commit wire fraud. Prosecutors said Vovnenko operated a network of more than 13,000 hacked computers, using them to harvest credit card numbers and other sensitive information.</p>
<p>When I first became acquainted with Vovnenko in 2013, I knew him only by his many hacker names, including &#8220;Fly&#8221; and &#8220;Flycracker,&#8221; among others. At the time, Fly was the administrator of the fraud forum “thecc[dot]bz,” an exclusive and closely guarded Russian language board dedicated to financial fraud and identity theft.</p>
<p>After I secretly gained access to his forum, I learned he&#8217;d <a href="http://krebsonsecurity.com/2013/07/mail-from-the-velvet-cybercrime-underground/" target="_blank">hatched a plot</a> to have heroin sent to my home and to have one of his forum lackeys call the police when the drugs arrived.</p>
<p>I explained this whole ordeal <a href="http://krebsonsecurity.com/2015/10/hacker-who-sent-me-heroin-faces-charges-in-u-s/" target="_blank">in great detail last fall</a>, when Vovnenko initially was extradited from Italy to face charges here in the United States. In short, the antics didn&#8217;t end when I foiled his plot to get me arrested for drug possession, and those antics likely <a href="http://krebsonsecurity.com/2014/06/the-fly-has-been-swatted/" target="_blank">contributed to his arrest</a> and to this guilty plea.</p>
<p>The aggravated ID theft charge to which Vovnenko pleaded guilty carries a mandatory two-year sentence. The other charges he copped to will lengthen his sentence and include fines. His sentencing is currently slated for May 2, 2016. The indictment against Vovnenko is <a href="media/d7f58a1a.Vovnenko-Sergey-Indictment.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/10/Vovnenko-Sergey-Indictment.pdf" target="_blank">here</a> (PDF). A copy of his plea agreement is at <a href="media/feea2d61.vovnenkoplea.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/vovnenkoplea.pdf" target="_blank">this link</a> (PDF).</p>


feed_id: http://krebsonsecurity.com/?p=33467
title: The Lowdown on Freezing Your Kid’s Credit
uri: The-Lowdown-on-Freezing-Your-Kid-s-Credit
url: http://krebsonsecurity.com/2016/01/the-lowdown-on-freezing-your-kids-credit/
content:
<p>A <a href="http://www.12news.com/story/news/2015/12/29/you-can-freeze-your-childs-credit-starting-january-1/78011552/" target="_blank">story</a> in a national news source earlier this month about freezing your child&#8217;s credit file to preempt ID thieves prompted many readers to erroneously conclude that all states allow this as of 2016. The truth is that some states let parents create a file for their child and then freeze it, while many states have no laws on the matter. Here&#8217;s a short primer on the current situation, with the availability of credit freezes (a.k.a &#8220;security freeze&#8221;) for minors by state and by credit bureau.</p>
<div id="attachment_33643" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-33643" src="media/dbddb07c.states-abbr-580x298.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/states-abbr-580x298.png" alt="The lighter-colored states have some type of law permitting parents and/or guardians to place a freeze or flag on a dependent's credit file." width="580" height="298" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/01/states-abbr-580x298.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/01/states-abbr-768x394.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/01/states-abbr-940x482.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/01/states-abbr.png 1392w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The lighter-colored states have laws permitting parents and/or guardians to place a freeze or flag on a dependent&#8217;s credit file.</p></div>
<p>A child&#8217;s Social Security number can be used by identity thieves to apply for government benefits, open bank and credit card accounts, apply for a loan or utility service, or rent a place to live. Why would ID thieves wish to assume a child&#8217;s identity? Because that child is (likely) a clean slate, which translates to plenty of available credit down the road. In addition, minors generally aren&#8217;t in the habit of checking their credit reports or even the existence of one, and most parents don&#8217;t find out about the crime until the child approaches the age of 18 (or well after).</p>
<p>A 2012 report on child identity theft from the <b>Carnegie Mellon University CyLab</b> delves into the problem of identity thieves targeting children for unused Social Security numbers. The study looked at identity theft protection scans done on some 40,000 children, and found that roughly 10 percent of them were victims of ID theft.</p>
<p><a href="https://www.govtrack.us/congress/bills/114/hr1703" target="_blank">The Protect Children from Identity Theft Act</a>, introduced in the House of Representatives in March 2015, would give parents and guardians the ability to create a protected, frozen credit file for their children. However, <strong>GovTrack</strong> currently gives the bill a two percent chance of passage in this Congress.</p>
<p>So for now, there is no federal law for minors regarding credit freezes. This has left it up to the states to establish their own policies.</p>
<p>Credit bureau <strong>Equifax</strong> offers a free service that will allow parents to create a credit report for a minor and freeze it regardless of the state requirement. The minor also does not have to be a victim of identity theft. Equifax has more information on this offering <a href="https://help.equifax.com/app/answers/detail/a_id/75/~/security-freeze-fees-and-requirements" target="_blank">here</a>.</p>
<p>Experian told me that company policy is not to create a file for a minor upon request unless mandated by state law. &#8220;However, if a file exists for the minor we will provide a copy free to the parent or legal guardian and will freeze it,&#8221; said Experian spokesperson <strong>Susan Henson</strong>.</p>
<p>Henson added that depending on state law, there may be a fee ranging from $3 to $10 associated with the minor&#8217;s freeze. However, if the minor is a victim of identity theft and the applicant submits a copy of a valid police or incident report or complaint with a law enforcement agency or the Department of Motor Vehicles (DMV), the fee will be waived.</p>
<p><strong>Trans Union</strong> has <a href="https://www.transunion.com/credit-disputes/child-identity-theft-inquiry-form" target="_blank">a form on its site</a> that lets parents and guardians check for the presence of a credit file on their dependents. But it also only allows freezes in states that reserve that right for minors and their parents or guardians, and applicable fees may apply.</p>
<p><strong>Innovis</strong>, often referred to as the fourth major consumer credit bureau, allows parents or guardians to <a href="https://www.innovis.com/personal/lc_minorsProtected" target="_blank">place a freeze</a> on their dependent&#8217;s file regardless of state laws.<span id="more-33467"></span></p>
<p>According to <strong>Eva Casey Velasquez</strong>, president and CEO of the <a href="http://www.idtheftcenter.org" target="_blank">Identity Theft Resource Center</a>, there are currently 23 states that have regulations that provide some kind of protective mechanism for parents and guardians when it comes to children’s credit reports.</p>
<p>&#8220;Some allow you to create and freeze a report, others allow for some kind of &#8216;flag&#8217; on the Social Security number,&#8221; Velasquez said. &#8220;Kentucky has proposed legislation and it will go for a hearing, probably this month.&#8221;</p>
<p><a href="http://www.ncsl.org/research/financial-services-and-commerce/consumer-report-security-freeze-state-statutes.aspx" target="_blank">Here’s a list</a> of the states that have minor freeze laws on the books, and the status of pending state legislation from the <strong>National Conference of State Legislators</strong> (NCSL). That list currently includes <span class="s1">Arizona, </span><span class="s1">Connecticut, </span><span class="s1">Delaware, </span><span class="s1">Florida, </span><span class="s1">Georgia, </span><span class="s1">Illinois, </span><span class="s1">Indiana, </span><span class="s1">Iowa, </span><span class="s1">Louisiana, M</span><span class="s1">aine, </span><span class="s1">Maryland, Michigan</span><span class="s1">, </span><span class="s1">Montana, </span><span class="s1">Nebraska, </span><span class="s1">New York, </span><span class="s1">North Carolina, </span><span class="s1">Oregon, </span><span class="s1">South Carolina, </span><span class="s1">Tennessee, </span><span class="s1">Texas,</span><span class="s1"> </span><span class="s1">Utah, </span><span class="s1">Virginia and </span><span class="s1">Wisconsin. These states are reflected in the map above as the lighter-colored states.</span></p>
<p><span class="s1">Many of these states will only allow parents or guardians to request a freeze if the child is 16 or younger. Others allow 18 years of age or younger, and some &#8212; like New York &#8212; are debating legislation to increase the age from 16 to 18.</span></p>
<p>According to the <strong>U.S. Federal Trade Commission </strong>(FTC), several signs can tip you off that someone is misusing your child’s personal information to commit fraud. For example, you or your child might:</p>
<p>-be turned down for government benefits because the benefits are being paid to another account using your child’s Social Security number</p>
<p>-get a notice from the IRS saying the child didn’t pay income taxes, or that the child’s Social Security number was used on another tax return</p>
<p>-get collection calls or bills for products or services you didn’t receive</p>
<p>The FTC has published <a href="http://www.consumer.ftc.gov/articles/0040-child-identity-theft" target="_blank">a comprehensive set of resources</a> that parents and guardians can use to check for the presence of a credit file on their child or dependent, including a checklist of what to do next if a file is found.</p>
<p>Readers have asked whether signing kids up for identity monitoring services might be a better solution than a freeze. As I explain in <a href="http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">How I Learned to Stop Worrying and Embrace the Security Freeze</a>, identity monitoring services are great for helping to recover from identity theft, but they are not so effective at blocking thieves from creating new accounts. The most you can hope for in that regard is that the service will alert you when a new account is created.</p>
<p>Some fans of <a href="http://krebsonsecurity.com/?s=credit+freeze&amp;x=0&amp;y=0" target="_blank">my series</a> explaining why I recommend that all adults place a freeze on their credit files have commented that one reason they like the freeze is that they believe it stops the credit bureaus from making tons of money tracking their financial histories and selling that data to other companies. Let me make this abundantly clear: Freezing your credit will not stop the bureaus from splicing, dicing and selling your financial history to third parties; it just stops new credit accounts from being opened in your name.</p>
<p>Incidentally, it appears many more consumers are starting to get the message about the efficacy of and/or need for security freezes. <strong>Bob Sullivan</strong>, an independent investigative reporter and editor of <strong>BobSullivan.net</strong>, recently polled the major credit bureaus and found a considerable uptick in new applications for security freezes in 2015. According to data Sullivan obtained from <strong>Credit.com</strong>, between 2011 to 2014 freeze users ranged from 130,000 to 160,000 annually. During that same period, about 600,000 consumers requested initial fraud alerts be placed on their credit files, Experian said.</p>
<p>&#8220;But that might have changed in 2015,&#8221; Sullivan <a href="https://bobsullivan.net/gotchas/finally-consumers-are-using-the-one-tool-that-really-can-prevent-id-theft/" target="_blank">wrote</a>. &#8220;In February 2015 alone — the same month as the high-profile data leak at health insurer Anthem — nearly 160,000 consumers asked Experian for a credit freeze. Through October, the yearly total was 434,000, meaning about triple the consumers used freezes in 2015 than 2014.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=33617
title: Firm Sues Cyber Insurer Over $480K Loss
uri: Firm-Sues-Cyber-Insurer-Over-480K-Loss
url: http://krebsonsecurity.com/2016/01/firm-sues-cyber-insurer-over-480k-loss/
content:
<p>A Texas manufacturing firm is suing its cyber insurance provider for refusing to cover a $480,000 loss following an email scam that impersonated the firm&#8217;s chief executive.</p>
<p><img class="alignright size-full wp-image-30276" src="media/2cd86cff.athook.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/athook.png" alt="athook" width="194" height="375" />At issue is a cyber insurance policy issued to Houston-based <strong>Ameriforge Group Inc.</strong> (doing business as &#8220;<strong>AFGlobal Corp.</strong>&#8220;) by <strong>Federal Insurance Co.</strong>, a division of insurance giant <strong>Chubb Group</strong>. AFGlobal maintains that the policy it held provided coverage for both computer fraud and funds transfer fraud, but that the insurer nevertheless denied a claim filed in May 2014 after scammers impersonating AFGlobal&#8217;s CEO convinced the company&#8217;s accountant to wire $480,000 to a bank in China.</p>
<p>According to documents filed with the U.S. District Court in Harris County, Texas, the policy covered up to $3 million, with a $100,000 deductible. The documents indicate that from May 21, 2014 to May 27, 2014, AFGlobal&#8217;s director of accounting received a series of emails from someone claiming to be <strong>Gean Stalcup</strong>, the CEO of AFGlobal.</p>
<p>&#8220;Glen, I have assigned you to manage file T521,&#8221; the phony message to the accounting director <strong>Glen Wurm</strong> allegedly read. &#8220;This is a strictly confidential financial operation, to which takes priority over other tasks. Have you already been contacted by Steven Shapiro (attorney from KPMG)? This is very sensitive, so please only communicate with me through this email, in order for us not to infringe SEC regulations. Please do no speak with anyone by email or phone regarding this. Regards, Gean Stalcup.&#8221;</p>
<p>Roughly 30 minutes later, Mr. Wurm said he was contacted via phone and email by Mr. Shapiro stating that due diligence fees associated with the China acquisition in the amount of $480,000 were needed. AFGlobal claims a Mr. Shapiro followed up via email with wiring instructions.</p>
<p>After wiring the funds as requested &#8212; sending the funds to an account at the<strong> Agricultural Bank of China</strong> &#8212; Mr. Wurm said he received no further correspondence from the imposter until May 27, 2014, when the imposter acknowledged receipt of the $480,000 and asked Wurm to wire an additional $18 million. Wurm said he became suspicious after that request, and alerted the officers of the company to his suspicions.</p>
<p>According to the plaintiff, &#8220;the imposter seemed to know the normal procedures of the company and also that Gean Stalcup had a long-standing, very personal and familiar relationship with Mr. Wurm &#8212; sufficient enough that Mr. Wurm would not question a request from the CEO.&#8221;</p>
<p>The company said it attempted to recover the $480,000 wire from its bank, but that the money was already gone by the 27th, with the imposters zeroing out and closing the recipient account shortly after the transfer was completed on May 21.</p>
<p>In a letter sent by Chubb to the plaintiff, the insurance firm said it was denying the claim because the scam, known alternatively as &#8220;business email compromise&#8221; (BEC) and CEO fraud, did not involve the forgery of a financial instrument as required by the policy.<span id="more-33617"></span></p>
<p>&#8220;Federal disagrees with your contention that forgery coverage is implicated by this matter,&#8221; the insurer wrote in a Oct. 9, 2014 letter to AFGlobal. &#8220;Your August 12 letter asserts that &#8216;[t]he Forgery by a Third Party in this incident was of a financial instrument.&#8217; Federal is unaware of any authority to support your position that the email you reference qualifies as a Financial Instrument (as that term is defined by in the Policy).</p>
<p>According to Chubb, to be a financial instrument, the subject email must be a check, draft, or a similar written promise, order or direction to pay a sum certain in money that is made, drawn by or drawn upon an Organization or by anyone acting as an Organization&#8217;s agent, or that is purported to have been so made or drawn.</p>
<p>&#8220;Your August 12 letter appears to argue that &#8216;[t]he email constituted an order or direction to pay&#8217; because Mr. Shapiro&#8217;s May 21, 2014 email contained wire transfer instructions as to where the funds (apparently discussed in a separate phone conversation between &#8216;Mr. Shapiro&#8217; and Mr. Wurm) were to be sent,&#8221; the insurance firm told AFGlobal. &#8220;This argument ignores the fact that what defines a Financial Instrument under the Policy is not merely the existence of a written promise, order or direction to pay, but a written promise, order or direction to pay that is &#8216;similar&#8217; to a &#8216;check&#8217; or &#8216;draft.&#8217;</p>
<p>The insurer continued:</p>
<p>&#8220;In the context of a commercial crime policy, &#8216;checks&#8217; and &#8216;drafts&#8217; are widely understood to be types of negotiable instruments. They represent unconditional written orders or promises to pay a fixed amount of money on demand, or at a definite time, to a payee or bearer, and they can be transferred outside of the maker or drawer&#8217;s control. The email at issue in this matter &#8212; which is not negotiable &#8212; is in not way similar to these types of instruments.&#8221;</p>
<p>Chubb&#8217;s claim in this case and its definition of a financial instrument would seem to be dated enough that they also might discount transfers from e-checks or deposits scanned and sent over the phone &#8212; although the documents in this case do not touch on those instruments. Chubb&#8217;s definitions of what constitutes a financial instrument are laid out in <a href="media/259fac15.Ameriforge-DE1.2-Ex.A-Plaintiff.Original-Petition.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/Ameriforge-DE1.2-Ex.A-Plaintiff.Original-Petition.pdf" target="_blank">this document</a> (PDF).</p>
<p>The complaint lodged by AFGlobal is <a href="media/448126e0.Ameriforge-DE1-Plaintiff.Original-Petition.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/Ameriforge-DE1-Plaintiff.Original-Petition.pdf" target="_blank">here</a> (PDF).  The insurance company&#8217;s response is <a href="media/b4dcd81a.Ameriforge-DE1.5-Ex.D-Plaintiff.Original-Petition.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/Ameriforge-DE1.5-Ex.D-Plaintiff.Original-Petition.pdf" target="_blank">here</a>.</p>
<p><strong>Law360</strong> notes that this is actually the second time in the past year that <a href="http://www.law360.com/companies/chubb-corporation">Chubb Corp</a>. unit Federal Insurance was taken to court over coverage after its policyholder was fraudulently swindled out of money.</p>
<p>&#8220;Research technology company <strong>Medidata Solutions Inc.</strong> <a href="http://www.law360.com/articles/620028">sued</a> Federal in February for denying reimbursement of $4.8 million after a company employee, also contacted by a fake CEO and fake attorney, instructed him to also wire the money to a Chinese bank,&#8221; wrote <strong>Steven Trader</strong> for Law360. &#8220;Though Medidata <a href="http://www.law360.com/articles/705044/medidata-slams-chubb-unit-s-refusal-to-cover-4-8m-fraud">argued</a> that the imposter changed the email code to alter the sender’s address and include the CEO’s forged signature, thereby constituting a “fraudulent” change in data that triggered coverage, Federal fought back in New York federal court that its policy only covered hacking, not voluntary transfers of money.&#8221;</p>
<p>BEC or CEO Fraud schemes are an increasingly common and costly form of cybercrime. <a href="http://krebsonsecurity.com/2015/08/fbi-1-2b-lost-to-business-email-scams/" target="_blank">According to the FBI</a>,<em> thieves stole nearly $750 million in such scams from more than 7,000 victim companies in the U.S</em>. between October 2013 and August 2015.</p>
<p>CEO fraud usually begins with the thieves either phishing an executive and gaining access to that individual’s inbox, or emailing employees from a look-alike domain name that is one or two letters off from the target company’s true domain name. For example, if the target company’s domain was “example.com” the thieves might register “examp1e.com” (substituting the letter “L” for the numeral 1) or “example.co,” and send messages from that domain.</p>
<p>In these cases, the fraudsters will forge the sender’s email address displayed to the recipient, so that the email appears to be coming from example.com. In all cases, however, the “reply-to” address is the spoofed domain (e.g. examp1e.com), ensuring that any replies are sent to the fraudster.</p>
<p>On the surface, business email compromise scams may seem unsophisticated relative to moneymaking schemes that involve complex malicious software, such as Dyre and ZeuS. But in many ways, the BEC attack is more versatile and adept at sidestepping basic security strategies used by banks and their customers to minimize risks associated with account takeovers. In traditional phishing scams, the attackers interact with the victim’s bank directly, but in the BEC scam the crooks trick the victim into doing that for them.</p>
<p>The FBI urges businesses to adopt <a title="http://www.twofactorauth.org" href="http://www.twofactorauth.org/" target="_blank">two-step or two-factor authentication</a> for email, where available, and/or to establish other communication channels — such as telephone calls — to verify significant transactions. Businesses are also advised to exercise restraint when publishing information about employee activities on their Web sites or through social media.</p>


feed_id: http://krebsonsecurity.com/?p=33694
title: Wendy’s Probes Reports of Credit Card Breach
uri: Wendy-s-Probes-Reports-of-Credit-Card-Breach
url: http://krebsonsecurity.com/2016/01/wendys-probes-reports-of-credit-card-breach/
content:
<p><strong>Wendy&#8217;s</strong>, the nationwide chain of fast-food restaurants, says it is investigating claims of a possible credit card breach at some locations. The acknowledgment comes in response to questions from KrebsOnSecurity about banking industry sources who discovered a pattern of fraud on cards that were all recently used at various Wendy&#8217;s locations.</p>
<p class="p1"><span class="s1"><strong><img class="alignright wp-image-33698" src="media/dc6c101b.wen2.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/01/wen2.png" alt="wen2" width="290" height="210" />Bob Bertini</strong>, spokesperson for the Dublin, Ohio-based restauranteur, said the company began receiving reports earlier this month from its payment industry contacts about a potential breach and that Wendy&#8217;s has hired a security firm to investigate the claims.</span></p>
<p class="p1"><span class="s1">&#8220;We have received this month from our payment industry contacts reports of unusual activity involving payment cards at some of our restaurant locations,&#8221; Bertini said. &#8220;Reports indicate that fraudulent charges may have occurred elsewhere after the cards were legitimately used at some of our restaurants. We’ve hired a cybersecurity firm and launched a comprehensive and active investigation that’s underway to try to determine the facts.&#8221;</span></p>
<p class="p1"><span class="s1">Bertini said it was too soon to say whether the incident is contained, how long it may have persisted, or how many stores may be affected. </span><span id="more-33694"></span></p>
<p class="p1"><span class="s1">&#8220;W</span><span class="s1">e began investigating immediately, and the period of time we’re looking at the incidents is late last year,&#8221; he said. &#8220;We know it’s [affecting] some restaurants but it&#8217;s not appropriate just yet to speculate on anything in terms of scope.&#8221;</span></p>
<p class="p1">When KrebsOnSecurity initially began hearing from banking industry sources about a possible breach at Wendy&#8217;s, the reports were coming mainly from financial institutions in the midwest. However, this author has since heard similar reports from banks on the east coast on the United States.</p>
<p class="p1">The Wendy&#8217;s system includes approximately 6,500 franchise and company-operated restaurants in the United States and 28 countries and U.S. territories worldwide. Bertini said most of the U.S.-operated stores are franchises.</p>


feed_id: http://krebsonsecurity.com/?p=33884
title: IRS: 390K More Victims of IRS.Gov Weakness
uri: IRS-390K-More-Victims-of-IRS-Gov-Weakness
url: http://krebsonsecurity.com/2016/02/irs-390k-more-victims-of-irs-gov-weakness/
content:
<p>The <strong>U.S.</strong> <strong>Internal Revenue Service</strong> (IRS) today sharply revised previous estimates on the number of citizens that had their tax data stolen since 2014 thanks to a security weakness in the IRS&#8217;s own Web site. According to the IRS, at least 724,000 citizens had their personal and tax data stolen after crooks figured out how to abuse a (now defunct) IRS Web site feature called &#8220;Get Transcript&#8221; to steal victim&#8217;s prior tax data.</p>
<p><img class="alignright wp-image-25751" src="media/964c2000.taxfraud-285x285.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-285x285.jpg" alt="The Growing Tax Fraud Menace" width="253" height="253" srcset="http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-150x150.jpg 150w, http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-285x285.jpg 285w, http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-600x600.jpg 600w, http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud.jpg 693w" sizes="(max-width: 253px) 100vw, 253px" />The number is more than double the figures the IRS released in August 2015, when it said some <a href="http://krebsonsecurity.com/2015/08/irs-330k-taxpayers-hit-by-get-transcript-scam/" target="_blank">334,000 taxpayers</a> had their data stolen via authentication weaknesses in the agency&#8217;s Get Transcript feature.</p>
<p>Turns out, those August 2015 estimates were more than tripled from May 2015, when the IRS shut down its Get Transcript feature and announced it thought crooks had abused the Get Transcript feature to pull previous year&#8217;s tax data on just 110,000 citizens.</p>
<p>In a statement released today, the IRS said a more comprehensive, nine-month review of the Get Transcript feature since its inception in January 2014 identified the &#8220;potential access of approximately 390,000 additional taxpayer accounts during the period from January 2014 through May 2015.&#8221;</p>
<p>The IRS said an additional 295,000 taxpayer transcripts were targeted but access was not successful, and that mailings notifying these taxpayers will start February 29. The agency said it also is offering free credit monitoring through <strong>Equifax</strong> for affected consumers, and placing extra scrutiny on tax returns from citizens with affected SSNs.</p>
<p>The criminal Get Transcript requests fuel refund fraud, which involves crooks claiming a large refund in the name of someone else and intercepting the payment. Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS.</p>
<p>As <a href="http://krebsonsecurity.com/2015/03/sign-up-at-irs-gov-before-crooks-do-it-for-you/" target="_blank">I warned in March 2015</a>, the flawed Get Transcript function at issue required taxpayers who wished to obtain a copy of their most recent tax transcript had to provide the IRS&#8217;s site with the following information: The applicant’s name, date of birth, Social Security number and filing status. After that data was successfully supplied, the IRS used a service from credit bureau <strong>Equifax</strong> that asks four so-called “knowledge-based authentication” (KBA) questions. Anyone who succeeds in supplying the correct answers could see the applicant’s full tax transcript, including prior W2s, current W2s and more or less everything one would need to fraudulently file for a tax refund.</p>
<p>These KBA questions — which involve multiple choice, “out of wallet” questions such as previous address, loan amounts and dates — can be successfully enumerated with random guessing. <em>But in practice it is far easier, as we can see from the fact that thieves were successfully able to navigate the multiple questions more than half of the times they tried. </em>The IRS said it identified some 1.3 million attempts to abuse the Get Transcript service since its inception in January 2014; in 724,000 of those cases the thieves succeeded in answering the KBA questions correctly.</p>
<p>The IRS&#8217;s answer to tax refund victims &#8212; the Identity Protection (IP) PIN &#8212; is just as flawed as the now defunct Get Transcript system. These IP PINS, which the IRS has already mailed to some 2.7 million tax ID theft victims, must be supplied on the following year&#8217;s tax application before the IRS will accept the return.</p>
<p>The only problem with this approach is that the IRS allows IP PIN recipients to <a href="https://www.irs.gov/Individuals/Retrieve-Your-IP-PIN" target="_blank">retrieve their PIN</a> via the agency’s Web site, after supplying the answers to the same type of KBA questions from Equifax that opened the Get Transcript feature to exploitation by fraudsters.  These KBA questions focus on things such as previous address, loan amounts and dates and can be successfully enumerated with random guessing.  In many cases, the answers can be found by consulting free online services, such as Zillow and Facebook.</p>
<p>ID thieves understand this all to well, and even a relatively unsophisticated gang engaged in this activity can make millions via tax refund fraud. Last week, a federal grand jury in Oregon <a href="http://www.kdrv.com/news/local/Federal_Charges_Brought_in_Nationwide_Identity_Theft_and_IRS_Tax_Refund_Scheme.html" target="_blank">unsealed indictments against three men</a> accused of using the IRS&#8217;s Get Transcript feature to obtain 1,200 taxpayers transcripts. In total, the authorities allege the men filed over 2,900 false federal tax returns seeking over $25 million in fraudulent refunds.  The IRS says it rejected most of those claims, but that the gang managed to successfully obtain $4.7 million in illegal refunds.</p>
<p><span id="more-33884"></span></p>
<h4>HOW BAD WAS IT OVERALL IN 2015?</h4>
<p>The IRS hasn&#8217;t officially released numbers on how much tax refund fraud it saw overall in 2015, but in response to questions from KrebsOnSecurity it offered figures on how many fraudulent returns it detected and blocked last year.</p>
<p>&#8220;In calendar year 2015, the IRS rejected or suspended the processing of 4.8 million suspicious returns. The IRS stopped 1.4 million confirmed identity theft returns, totaling $8.7 billion,&#8221; the agency said in a statement. &#8220;Additionally, in calendar year 2015, the IRS stopped $3.1 billion worth of refunds in other types of fraud. That’s a total of $11.8 billion in confirmed fraudulent refunds protected.&#8221;</p>
<p>Again, these numbers do not reflect how many fraudulent refunds were paid out in calendar year 2015 due to ID theft, and as we can see with the numbers tied to the Get Transcript fiasco these numbers have a way of changing upward over time significantly. I mention that because something about these numbers doesn&#8217;t seem to square with figures previously released by the Government Accountability Office and the <strong>Federal Trade Commission</strong>.</p>
<p>Last month, the FTC said it saw an <a href="http://krebsonsecurity.com/2016/01/ftc-tax-fraud-behind-47-spike-in-id-theft/" target="_blank">almost 50 percent spike in ID theft claims in 2015</a>, a jump that was thanks largely to a huge uptick in consumer reports of tax refund fraud. Likewise, a report by the IRS last year indicates that between Jan. 1, 2015 and Sept. 30, 2015, the IRS saw more than 600,000 incidents of ID tax-related ID theft, up more than 50 percent over 2014, and 30 percent over 2013.</p>
<p>According to a January 2015 GAO <a href="media/8a0a3798.667965.pdf" data-original-source="http://www.gao.gov/assets/670/667965.pdf" target="_blank">report</a> (PDF), the IRS estimated it prevented $24.2 billion in fraudulent identity theft refunds in 2013. Unfortunately, the IRS also paid $5.8 billion that year for refund requests later determined to be fraud. The GAO noted that because of the difficulties in knowing the amount of undetected fraud, the actual amount could far exceed those estimates.</p>
<p>The best way to avoid becoming a victim of tax refund fraud is to file your taxes before the fraudsters can. See <a href="http://krebsonsecurity.com/2015/12/dont-be-a-victim-of-tax-refund-fraud-in-16/" target="_blank">Don’t Be A Victim of Tax Refund Fraud in ’16</a> for more tips on avoiding this ID theft headache.</p>


feed_id: http://krebsonsecurity.com/?p=33980
title: Breached Credit Union Comes Out of its Shell
uri: Breached-Credit-Union-Comes-Out-of-its-Shell
url: http://krebsonsecurity.com/2016/02/breached-credit-union-comes-out-of-its-shell/
content:
<p>Notifying people and companies about data breaches often can be a frustrating and thankless job. Despite my best efforts, sometimes a breach victim I&#8217;m alerting will come away convinced that I am not an investigative journalist but instead a scammer. This happened most recently this week, when I told a California credit union that its online banking site was compromised and apparently had been for nearly two months.</p>
<p>On Feb. 23, I contacted <strong>Coast Central Credit Union</strong>, a financial institution based in Eureka, Calif. that serves more than 60,000 customers. I explained who I was, how they&#8217;d likely been hacked, how they could verify the hack, and how they could fix the problem. Two days later when I noticed the site was still hacked, I contacted the credit union again, only to find they still didn&#8217;t believe me.</p>
<p>News of the compromise came to me via<strong> Alex Holden</strong>, a fellow lurker in the cybercrime underground and founder of <a href="http://www.holdsecurity.com" target="_blank">Hold Security </a>[full disclosure: While Holden&#8217;s site <a href="http://holdsecurity.com/about/advisory-board/" target="_blank">lists</a> me as an advisor to his company, I receive zero compensation for that role]. Holden told me that crooks had hacked the credit union&#8217;s site and retrofitted it with a &#8220;Web shell,&#8221; a simple backdoor program that allows an attacker to remotely control the Web site and server using nothing more than a Web browser.</p>
<div id="attachment_33989" style="width: 590px" class="wp-caption aligncenter"><a href="media/1ee52c6c.bankshell.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/02/bankshell.png"><img class="lightbox wp-image-33989 size-medium" src="media/5900ab12.bankshell-580x323.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/02/bankshell-580x323.png" alt="A view of the credit union's hacked Web site via the Web shell. " width="580" height="323" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/02/bankshell-580x323.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/02/bankshell-768x428.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/02/bankshell-940x523.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A screen shot of the credit union&#8217;s hacked Web site via the Web shell.</p></div>
<p>The credit union&#8217;s switchboard transferred me to a person in Coast Central&#8217;s tech department who gave his name only as &#8220;Vincent.&#8221; I told Vincent that the credit union&#8217;s site was very likely compromised, how he could verify it, etc. I also gave him my contact information, and urged him to escalate the issue. After all, I said, the intruders could use the Web shell program to upload malicious software that steals customer passwords directly from the credit union&#8217;s Web site. Vincent didn&#8217;t seem terribly alarmed about the news, and assured me that someone would be contacting me for more information.</p>
<p>This afternoon I happened to reload the login page for the Web shell on the credit union&#8217;s site and noticed it was still available. A call to the main number revealed that Vincent wasn&#8217;t in, but that Patrick in IT would take my call. For better or worse, Patrick was deeply skeptical that I was not impersonating the author of this site.</p>
<p>I commended him on his wariness and suggested several different ways he could independently verify my identity. When asked for a contact at the credit union that could speak to the media, Patrick said that person was him but declined to tell me his last name. He also refused to type in a Web address on his own employer&#8217;s Web site to verify the Web shell login page.</p>
<p>&#8220;I hope you <em>do</em> write about this,&#8221; Patrick said doubtfully, after I told him that I&#8217;d probably put something up on the site today about the hack. &#8220;That would be funny.&#8221;</p>
<div id="attachment_33999" style="width: 370px" class="wp-caption aligncenter"><img class="size-full wp-image-33999" src="media/a155411f.webshelllogin.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/02/webshelllogin.png" alt="The login page for the Web shell that was removed today from Coast Central Credit Union's Web site." width="360" height="78" /><p class="wp-caption-text">The login page for the Web shell that was removed today from Coast Central Credit Union&#8217;s Web site.</p></div>
<p>Exasperated, I told Patrick good luck and hung up. Thankfully, I did later hear from <strong>Ed Christians</strong>, vice president of information systems at Coast Central. Christians apologized for the runaround and said everyone in his department were regular readers of KrebsOnSecurity. &#8220;I was hoping I&#8217;d never get a call from you, but I guess I can cross that one off my list,&#8221; Christians said. &#8220;We&#8217;re going to get this thing taken down immediately.&#8221;</p>
<p>The credit union has since disabled the Web shell and is continuing to investigate the extent and source of the breach. There is some evidence to suggest the site may have been hacked via an outdated version of <strong>Akeeba Backup &#8212;</strong> a <a href="https://www.joomla.org/" target="_blank">Joomla</a> component that allows users to create and manage complete backups of a Joomla-based website. Screen shots of the files listed by the Web shell planted on Coast Central Credit Union indeed indicate the presence of Akeeba Backup on the financial institution&#8217;s Web server.</p>
<p>A Web search on one backdoor component that the intruders appear to have dropped on the credit union&#8217;s site on Dec. 29, 2015 &#8212; a file called &#8220;sfx.php&#8221; &#8212; turns up <a href="http://www.claudiokuenzler.com/blog/534/joomla-hacked-through-akeeba-backup-restore-joomlaupdate" target="_blank">this blog post</a> in which Swiss systems engineer <strong>Claudio Marcel Kuenzler</strong> described his investigation of a site that was hacked through the Akeeba Backup function. <span id="more-33980"></span></p>
<p>&#8220;The file was uploaded with a simple GET request by using <a href="https://www.akeebabackup.com/home/news/1605-security-update-sep-2014.html" target="_blank">a vulnerability</a> in the com_joomlaupdate (which is part of Akeeba Backup) component,&#8221; Kuenzler wrote, noting that there is a patch available for the vulnerability.</p>
<p>These Web shell components are extremely common, have been around for years, and are used by online miscreants for a variety of tasks &#8212; from selling ad traffic and spreading malware to promoting malicious and spammy Web sites.</p>
<p>It&#8217;s not clear yet whether the hackers who hit the credit union&#8217;s site did anything other than install the backdoor, but Kuenzler wrote that in his case the intruders indeed used their access to relay spam. The attackers could just have easily booby-trapped the credit union&#8217;s site to foist malicious software disguised as a security update when customers tried to log in at the site.</p>
<p><span class="pullquote pqleft">Holden said he&#8217;s discovered more than 13,000 sites that are currently infected with Web shells just like the one that hit Coast Central Credit Union</span>, and that the vast majority of them are Joomla and <strong>WordPress</strong> blogs that get compromised through outdated and insecure third-party plugins for these popular content management systems. Worse yet, all of the 13,000+ backdoored sites are being remotely controlled with the same username and password.</p>
<p>&#8220;It&#8217;s a bot,&#8221; he said of the self-replicating malware used to deploy the Web shell that infested the credit union&#8217;s site. &#8220;It goes and exploits vulnerable sites and installs a backdoor with the same credentials.&#8221;</p>
<p>Holden said his company has been reaching out to the affected site owners, but that it hasn&#8217;t had much luck getting responses. In any case, Holden said he doesn&#8217;t relish the idea of dealing with pushback and suspicion from tons of victims.</p>
<p>&#8220;To be fair, most vulnerable sites belong to individuals or small companies that do not have contacts, and a good portion of them are outside of US,&#8221; Holden said. &#8220;We try to find owners for some but very few reply.&#8221;</p>
<p>If you run a Web site, please make sure to keep your content management system up to date with the latest patches, and don&#8217;t put off patching or disabling outdated third-party plugins. And if anyone wants to verify who I am going forward, please feel free <a href="http://krebsonsecurity.com/about/" target="_blank">contact me through this site</a>, via <a href="http://krebsonsecurity.com/bk.asc" target="_blank">encrypted email</a>, or through Wickr (I&#8217;m &#8220;krebswickr&#8221;).</p>


feed_id: http://krebsonsecurity.com/?p=33969
title: Phishers Spoof CEO, Request W2 Forms
uri: Phishers-Spoof-CEO-Request-W2-Forms
url: http://krebsonsecurity.com/2016/02/phishers-spoof-ceo-request-w2-forms/
content:
<p>With tax filing season in the United States well underway, scammers who specialize in tax refund fraud have a new trick up their sleeves: Spoofing emails from a target organization&#8217;s CEO, asking human resources and accounting departments for employee W-2 information.</p>
<p><strong><img class="alignright size-full wp-image-30276" src="media/2cd86cff.athook.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/athook.png" alt="athook" width="194" height="375" />Stu Sjouwerman</strong>, chief executive at security awareness training company <strong>KnowBe4</strong>, told KrebsOnSecurity that earlier this week his firm&#8217;s controller received an email designed to look like it was sent by Sjouwerman requesting a copy of all employee W-2 forms for this year (full disclosure: KnowBe4 is an advertiser on this site). The email read:</p>
<p>&#8220;Alanna,</p>
<p>I want you to send me the list of W-2 copy of employees wage and tax statement for 2015, I need them in PDF file type, you can send it as an attachment. Kindly prepare the lists and email them to me asap.</p>
<p>Stu&#8221;x</p>
<p>Turns out, KnowBe4 just hired a new chief financial officer. The controller answered that she didn&#8217;t have access to that information, but that the new CFO could help. Sjourwerman said an analysis of the <a href="https://support.google.com/mail/answer/29436?hl=en" target="_blank">email headers</a> showed the phishers used someone&#8217;s GoDaddy email server and the return address was not associated with the company.</p>
<p>&#8220;Our CFO had just stepped through all of our awareness training and smelled something phishy,&#8221; Sjourwerman said. &#8220;The two of them walked up to me and asked if I had requested a PDF with all W-2&#8217;s. Obviously, I hadn&#8217;t, and congratulated them on a good catch. But imagine if we would have sent off those W-2&#8217;s! It would have opened up our employees to identity theft because the W-2&#8217;s have their full name, address, wages and Social Security number.&#8221;</p>
<p><img class="aligncenter size-medium wp-image-33974" src="media/0fda0856.knowbe4phish-580x286.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/02/knowbe4phish-580x286.png" alt="knowbe4phish" width="580" height="286" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/02/knowbe4phish-580x286.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/02/knowbe4phish-768x378.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/02/knowbe4phish-940x463.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/02/knowbe4phish.png 1166w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p><span id="more-33969"></span>Fraudsters who perpetrate tax refund fraud prize W-2 information because it contains virtually all of the data one would need to fraudulently file someone&#8217;s taxes and request a large refund in their name. Indeed, scam artists involved in refund fraud <a href="http://krebsonsecurity.com/2015/08/irs-330k-taxpayers-hit-by-get-transcript-scam/" target="_blank">stole W-2 information on more than 330,000 people last year</a> directly from the Web site of the Internal Revenue Service (IRS). Scammers last year also <a href="http://krebsonsecurity.com/2014/04/tax-fraud-gang-targeted-healthcare-firms/" target="_blank">massively phished online payroll management account credentials</a> used by corporate HR professionals.</p>
<p>According to <a href="http://krebsonsecurity.com/2016/01/ftc-tax-fraud-behind-47-spike-in-id-theft/" target="_blank">recent stats</a> from the Federal Trade Commission, tax refund fraud was responsible for a nearly 50 percent increase in consumer identity theft complaints last year. The best way to avoid becoming a victim of tax refund fraud is to file your taxes before the fraudsters can. See <a href="http://krebsonsecurity.com/2015/12/dont-be-a-victim-of-tax-refund-fraud-in-16/" target="_blank">Don&#8217;t Be A Victim of Tax Refund Fraud in &#8217;16</a> for more tips on avoiding this ID theft headache.</p>


feed_id: http://krebsonsecurity.com/?p=33938
title: The Lowdown on the Apple-FBI Showdown
uri: The-Lowdown-on-the-Apple-FBI-Showdown
url: http://krebsonsecurity.com/2016/02/the-lowdown-on-the-apple-fbi-showdown/
content:
<p>Many readers have asked for a primer summarizing the privacy and security issues at stake in the the dispute between <strong>Apple</strong> and the <strong>U.S. Justice Department</strong>, which last week convinced a judge in California to order Apple to unlock an iPhone used by one of assailants in the recent San Bernardino massacres. I don&#8217;t have much original reporting to contribute on this important debate, but I&#8217;m visiting it here because it&#8217;s a complex topic that deserves the broadest possible public scrutiny.</p>
<div id="attachment_33957" style="width: 267px" class="wp-caption alignright"><img class=" wp-image-33957" src="media/ecf5d437.hungryapple.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/02/hungryapple.png" alt="Image: Elin Korneliussen" width="257" height="268" /><p class="wp-caption-text">Image: Elin Korneliussen (@elincello)</p></div>
<p>A federal magistrate in California <a href="media/8cf751ca.SB-Shooter-Order-Compelling-Apple-Asst-iPhone.pdf" data-original-source="https://assets.documentcloud.org/documents/2714005/SB-Shooter-Order-Compelling-Apple-Asst-iPhone.pdf" target="_blank">approved an order</a> (PDF) granting the FBI permission to access to the data on the iPhone 5c belonging to the late terror suspect <strong>Syed</strong> <strong>Rizwan Farook</strong>, one of two individuals responsible for a <a href="https://en.wikipedia.org/wiki/2015_San_Bernardino_attack" target="_blank">mass shooting in San Bernadino on Dec. 2, 2015</a> in which 14 people were killed and many others were injured.</p>
<p><strong>Apple CEO Tim Cook</strong> <a href="https://www.apple.com/customer-letter/" target="_blank">released a letter</a> to customers last week saying the company will appeal the order, citing customer privacy and security concerns.</p>
<p>Most experts seem to agree that Apple is technically capable of complying with the court order. Indeed, as <strong>National Public Radio</strong> <a href="http://www.npr.org/2016/02/22/467602161/the-seeds-of-apples-standoff-with-doj-may-have-been-sown-in-brooklyn" target="_blank">notes in a segment this morning</a>, Apple has agreed to unlock phones in approximately 70 other cases involving requests from the government. However, something unexpected emerged in one of those cases &#8212; an iPhone tied to a Brooklyn, NY drug dealer who pleaded guilty to selling methamphetamine last year.<span id="more-33938"></span></p>
<p>NPR notes that Apple might have complied with that request as well, had something unusual not happened: <strong>Federal Magistrate Judge James Orenstein</strong> did not sign the order the government wanted, but instead went public and asked Apple if the company had any objections.</p>
<p>&#8220;The judge seemed particularly skeptical that the government relied in part on an <a href="http://www.npr.org/sections/alltechconsidered/2016/02/19/467299024/can-a-1789-law-apply-to-an-iphone">18th-century law called the All Writs Act</a>,&#8221; reports NPR&#8217;s <strong>Joel Rose</strong>. &#8220;Prosecutors say it gives them authority to compel private companies to help carry out search warrants.&#8221;</p>
<p>Nevertheless, Apple is resisting this latest order, citing the precedent that complying might set, Apple&#8217;s CEO claims.</p>
<p>&#8220;We have great respect for the professionals at the FBI, and we believe their intentions are good,&#8221; Cook wrote. &#8220;Up to this point, we have done everything that is both within our power and within the law to help them. But now the U.S. government has asked us for something we simply do not have, and something we consider too dangerous to create. They have asked us to build a backdoor to the iPhone.&#8221;</p>
<p>Cook continued: “The government suggests this tool could only be used once, on one phone. But that’s simply not true. Once created, the technique could be used over and over again, on any number of devices. In the physical world, it would be the equivalent of a master key, capable of opening hundreds of millions of locks — from restaurants and banks to stores and homes. No reasonable person would find that acceptable.”</p>
<p>In a letter <a href="https://lawfareblog.com/we-could-not-look-survivors-eye-if-we-did-not-follow-lead" target="_blank">posted to Lawfare.com</a> and the <a href="https://www.fbi.gov/news/pressrel/press-releases/fbi-director-comments-on-san-bernardino-matter?utm_campaign=email-Immediate&amp;utm_medium=email&amp;utm_source=national-press-releases&amp;utm_content=518056" target="_blank">FBI&#8217;s home page</a>, FBI Director <strong>James Comey</strong> acknowledged that new technology creates serious tensions between privacy and safety, but said this tension should be resolved by the U.S. courts &#8212; not by the FBI or by Apple.</p>
<p>&#8220;We simply want the chance, with a search warrant, to try to guess the terrorist’s passcode without the phone essentially self-destructing and without it taking a decade to guess correctly,&#8221; Comey said. &#8220;That’s it. We don’t want to break anyone’s encryption or set a master key loose on the land. I hope thoughtful people will take the time to understand that. Maybe the phone holds the clue to finding more terrorists. Maybe it doesn’t. But we can’t look the survivors in the eye, or ourselves in the mirror, if we don’t follow this lead.&#8221;</p>
<p>According to the government, Apple has the capability to bypass the password on some of its devices, and can even disable an iPhone&#8217;s optional auto-erase function that is set to delete all data on the phone after some number of tries (the default is 10).</p>
<p>The iPhone at issue was an iPhone 5C, but it was running Apple&#8217;s latest operating system, <a href="media/a3db3eab.iOS_Security_Guide.pdf" data-original-source="https://www.apple.com/business/docs/iOS_Security_Guide.pdf" target="_blank">iOS 9</a> (PDF), which prompts users to create six digit passcode for security. Since iOS 9 allows users to set a 4-digit, 6-digit or <em>alphanumeric PIN</em>, cracking the passcode on the assailant&#8217;s iPhone <a href="https://www.washingtonpost.com/news/wonk/wp/2016/02/17/how-long-it-takes-to-crack-an-iphone/" target="_blank">could take anywhere from a few hours to 5.5 years</a> if the FBI used tools to &#8220;brute-force&#8221; the code and wasn&#8217;t hampered by the operating system&#8217;s auto-erase feature. That&#8217;s because the operating system builds in a tiny time delay between each guess, rendering large scale brute-force attacks rather time-consuming and potentially costly ventures.</p>
<p>In an <a href="https://www.washingtonpost.com/posteverything/wp/2016/02/18/why-you-should-side-with-apple-not-the-fbi-in-the-san-bernardino-iphone-case/" target="_blank">op-ed</a> that ran in <em>The Washington Post </em>on Feb. 18, noted security expert and cryptographer <strong>Bruce Schneier</strong> notes that the authority the U.S. government seeks is probably available to the FBI if the agency wants to spring for the funding to develop the capability itself, and that the FBI sees this as a privacy vs. security debate, while the tech community sees it as a security vs. surveillance debate.</p>
<p>&#8220;There’s nothing preventing the FBI from writing that hacked software itself, aside from budget and manpower issues,&#8221; Schneier wrote. &#8220;There’s every reason to believe, in fact, that such hacked software has been written by intelligence organizations around the world.&#8221;</p>
<p>Schneier said what the FBI wants to do would make us less secure, even though it’s in the name of keeping us safe from harm.</p>
<p>&#8220;The danger is that the court’s demands will pave the way to the FBI forcing Apple and others to reduce the security levels of their smart phones and computers, as well as the security of cars, medical devices, homes, and everything else that will soon be computerized,&#8221; Schneier wrote. &#8220;The FBI may be targeting the iPhone of the San Bernardino shooter, but its actions imperil us all.&#8221;</p>
<p><strong>Nicholas Weaver</strong>, a senior researcher in networking and security for the <a href="https://www.icsi.berkeley.edu/icsi/people/nweaver" target="_blank">International Computer Science Institute</a> (ICSI), said the same logic behind what the FBI seeks could just as easily apply to a mandate forcing Microsoft, Google, Apple, and others to push malicious code to a device through automatic updates when the device isn&#8217;t yet in law enforcement&#8217;s hand.</p>
<p>&#8220;The request to Apple is accurately paraphrased as &#8216;Create malcode designed to subvert security protections, with additional forensic protections, customized for a particular target&#8217;s phone, cryptographically sign that malcode so the target&#8217;s phone accepts it as legitimate, and run that customized version through the update mechanism&#8217;,&#8221; Weaver <a href="https://lawfareblog.com/not-slippery-slope-jump-cliff" target="_blank">wrote</a>.</p>
<p>Apple appears ready to fight this all the way to the Supreme Court. If the courts decide in the government&#8217;s favor, the FBI won&#8217;t soon be alone in requesting this authority, Weaver warns.</p>
<p>&#8220;Almost immediately, the National Security Agency is going to secretly request the same authority through the Foreign Intelligence Surveillance Court (FISC),&#8221; Weaver wrote. &#8220;How many honestly believe the FISC wouldn&#8217;t rule in the NSA&#8217;s favor after the FBI succeeds in getting the authority?&#8221;</p>
<p>This debate will almost certainly be decided in the courts, perhaps even by the U.S. Supreme Court. In the meantime, lawmakers in Washington, D.C. are already positioning themselves to&#8230;well, study the issue more.</p>
<p>In <a href="https://krebsonsecurity.com/wp-admin/post.php?post=33938&amp;action=edit" target="_blank">letters</a> sent last week to Apple and the Justice Department, the <strong>House Energy &amp; Commerce Committee</strong> invited leaders of both organizations to come testify on the issue in an upcoming hearing. In addition, <strong>Sen. Mark Warner</strong> (D-Va.) and <strong>Rep. Michael McCaul</strong> (R-Texas) say they plan to <a href="http://bipartisanpolicy.org/events/shedding-light-on-going-dark-practical-approaches-to-the-encryption-challenge/" target="_blank">unveil legislation</a> later this week to create a &#8220;Digital Security Commission&#8221; to investigate whether Congress has a bigger role to play here.</p>
<p>Twitter addicts can follow this lively debate at the hashtag #FBIvsApple, although to be fair the pro-Apple viewpoints appear to be far more represented so far. Where do you come down on this debate? Sound off in the comments below.</p>
<p>Recommended further reading: <a href="http://zdziarski" target="_blank">Jonathan Zdziarski&#8217;s take</a> on why this case is different from previous requests from the FBI to Apple.</p>


feed_id: http://krebsonsecurity.com/?p=33877
title: Dell to Customers: Report ‘Service Tag’ Scams
uri: Dell-to-Customers-Report-Service-Tag-Scams
url: http://krebsonsecurity.com/2016/02/dell-to-customers-report-service-tag-scams/
content:
<p>Computer maker <strong>Dell</strong> is asking for help in an ongoing probe into the source of customer information that appears to have somehow landed in the laps of fraudsters posing as Dell computer support technicians. KrebsOnSecurity readers continue to report being called by scammers posing as Dell support personnel who offer &#8220;proof&#8221; that they&#8217;re with Dell by rattling off the unique Dell &#8220;service tag&#8221; code printed on each Dell customer&#8217;s PC or laptop, as well as information from any previous (legitimate) service issues the customer may have had with Dell.</p>
<div id="attachment_33929" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-33929" src="media/de57746b.dellwiki-580x429.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/02/dellwiki-580x429.png" alt="Image: Wikipedia" width="580" height="429" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/02/dellwiki-580x429.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/02/dellwiki.png 716w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Image: Wikipedia</p></div>
<p>In January, <strong>Ars Technica&#8217;s</strong> <a href="http://arstechnica.com/author/dan-goodin/" target="_blank">Dan Goodin</a> wrote about a guy who&#8217;d been <a href="http://www.10zenmonkeys.com/2016/01/04/dell-computers-has-been-hacked/" target="_blank">complaining</a> to Dell for six months about the very same problem, in which the scammers try to convince the customer that their computer is infected and in need of professional services. Dell responded at the time that its customer&#8217;s data protection was a top priority, and it reminded customers that Dell doesn&#8217;t make unsolicited calls asking to charge to fix an issue they did not report or previously request help with unless they have signed up for premium support services.</p>
<p>I first heard about this in December 2015 from Israeli resident <strong>Yosef Kaner</strong>, who reported receiving a phone call from someone with a thick Indian accent claiming to be from Dell technical support.</p>
<p>&#8220;He said that they had been monitoring my computer usage for the past couple of weeks, and that I had downloaded a dangerous piece of software,&#8221; Kaner said. &#8220;He offered to help me remove said software. Understanding that this was a scam, I asked him for a callback number. He gave me one. He also, though, knew my name and gave me the Service Tag of my PC. I thanked him and hung up. Then I Googled the number he gave me. It was a known number from a known scam.&#8221;</p>
<p>Almost every week this past month, I&#8217;ve received similar messages from other readers. Like this one, from <strong>Lucy Thomson</strong> of Washington, D.C. Thomson is the author of the <a href="http://www.amazon.com/Data-Breach-Encryption-Handbook-Thomson/dp/1604429895" target="_blank">ABA Data Breach and Encryption Handbook</a>, and a former Justice Department fraud prosecutor.</p>
<p>&#8220;So I am not happy that Dell has had this breach and many people are potentially in jeopardy,&#8221; Thomson said. &#8220;I confirmed with two of the people who called on two different days, one who said he was in San Jose, CA and another who said he was in India, the nature of the PII and service records they have. All of it was correct and they have quite a bit of contact information and service records with specific dates of calls and service.&#8221;</p>
<p>Thomson said she called 1-866-383-4713 (the real Dell&#8217;s support line) and told the technician about having received calls every day for the previous five days from people claiming to be Dell certified technicians or who worked for Dell.</p>
<p>&#8220;I then told him they had all my PII and Dell service records for the computer I purchased from Dell in 2012,&#8221; Thomson recalled. &#8220;He said they had received calls &#8216;from people like you,&#8217; and &#8216;many customers have called.&#8217; In response to my question about why they had not sent data breach notifications, he said &#8216;The legal team is in charge. The legal team is working with the FBI on this.&#8217; He said that twice. At the end of the call he said &#8216;we are creating a platform so this will never happen again.'&#8221;<span id="more-33877"></span></p>
<p>Reader <strong>Peter Sullivan</strong> sent me this note two days ago:</p>
<blockquote><p>I received a phone call this afternoon from a male with an Asian (Indian?) accent purporting to be a Dell support tech advising me that my computer had been infected with potentially damaging malware. As you can imagine, I was more than a little skeptical. After asking him several challenging questions, I said ‘I have two Dell computers, which one is infected?”</p>
<p>The caller gave me the Service Tag for my XPS 15 (L521x)! When I suggested that I would like to call him back, he told me that the support #s are very busy (!!) and I wouldn’t be able to get through. “ if I give you your Express Service Code will you trust me then?,” he said proceeded to give me the correct number.</p>
<p>I hung up and did a quick search, coming up with some problems from 2015 involving Dell System Detect that had exposed some Dell computers (I thought that I had responded to that issue). To be on the safe side I called Dell Tech Support and they told me that they don’t call … I wasn’t surprised.</p></blockquote>
<p>Dell spokesman <strong>David Frink</strong> said the company has &#8220;no indication that customer information used in the sames reported recently were obtained through an external attack,&#8221; but he declined to respond to direct questions about whether the company had ruled out an insider attack, such as a current or previous channel partner that got hacked or illegally sold Dell customer information.</p>
<p>&#8220;Fact is, these phishing scams are increasingly more sophisticated, they are touching not only technology companies, but all industry, and we have devoted considerable resources to addressing them,&#8221; Frink said. &#8220;We have no indication that customer information used in the scams reported recently were obtained through an external attack. We continuously evaluate our internal physical and technical security measures to determine if there are additional efforts that would further ensure this customer data is secure. And, we investigate any customer complaint received when there is sufficient information to investigate.&#8221;</p>
<p>He pointed concerned Dell customers to information on the company&#8217;s site that <a href="http://en.community.dell.com/dell-blogs/direct2dell/b/direct2dell/archive/2015/10/02/watch-out-for-tech-support-phone-scams" target="_blank">warns customers</a> to be on alert for phone scams.</p>
<p><span class="pullquote pqleft">&#8220;We also have provided <a href="http://www.dell.com/reportphonescams" target="_blank">an intake form</a> to make it easy for customers to submit information for our teams to investigate,&#8221; Frink wrote in an email to KrebsOnSecurity.</span> &#8220;We’re encouraging our customers to come to us with any information that could facilitate the investigations.  We are investigating the issue, but can only do so with assist from customers who believe that someone tried to scam them. This is a continuing investigation, which by its nature, is based primarily on input from customers. We have no indication at this time that customer information used in the scams reported recently were obtained through an external attack.&#8221;</p>
<p>So if this wasn&#8217;t the result of a rogue partner, exactly how have the scammers managed to glean so much information about Dell customers and any previous service issues? Ars Technica&#8217;s Dan Goodin posited one possibility: That the scammers <a href="http://krebsonsecurity.com/2015/11/security-bug-in-dell-pcs-shipped-since-815/" target="_blank">exploited a vulnerability in Dell computers that became public in November.</a></p>
<p>&#8220;It resided on Dell PCs that came pre-installed with digital certificates that made it easy for attackers to cryptographically impersonate any website on the Internet,&#8221; Goodin wrote. &#8220;The same certificate, it turned out, also allowed hackers to surreptitiously obtain the unique service tag Dell assigns to computers it sells.&#8221;</p>
<p>Goodin said that theory still doesn&#8217;t explain how scammers obtained contact information and support histories.</p>
<p>&#8220;The vulnerability, however, does demonstrate the plausibility that hackers could have devised a way to obtain personal details belonging to Dell customers,&#8221; he wrote. &#8220;For the time being, owners of Dell computers should presume their support histories and purchase and contact information has been compromised, and act accordingly.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=33881
title: This is Why People Fear the ‘Internet of Things’
uri: This-is-Why-People-Fear-the-Internet-of-Things
url: http://krebsonsecurity.com/2016/02/this-is-why-people-fear-the-internet-of-things/
content:
<p>Imagine buying an internet-enabled surveillance camera, network attached storage device, or home automation gizmo, only to find that it secretly and constantly phones home to a vast peer-to-peer (P2P) network run by the Chinese manufacturer of the hardware. Now imagine that the geek gear you bought doesn&#8217;t actually let you block this P2P communication without some serious networking expertise or hardware surgery that few users would attempt.</p>
<div id="attachment_33904" style="width: 277px" class="wp-caption alignright"><img class=" wp-image-33904" src="media/c88745c3.FI9286P.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/02/FI9286P.png" alt="The FI9286P, a Foscam camera that includes P2P communication by default." width="267" height="288" /><p class="wp-caption-text">The FI9286P, a Foscam camera that includes P2P communication by default.</p></div>
<p>This is the nightmare &#8220;Internet of Things&#8221; (IoT) scenario for any system administrator: The IP cameras that you bought to secure your physical space suddenly turn into a vast cloud network designed to share your pictures and videos far and wide. The best part? It&#8217;s all plug-and-play, no configuration necessary!</p>
<p>I first became aware of this bizarre experiment in how not to do IoT last week when a reader <a href="http://foscam.us/forum/foscam-dialing-out-to-suspect-hosts-t17699.html" target="_blank">sent a link to a lengthy discussion thread</a> on the support forum for <strong>Foscam,</strong> a Chinese firm that makes and sells security cameras. The thread was started by a Foscam user who noticed his IP camera was noisily and incessantly calling out to more than a dozen online hosts in almost as many countries.</p>
<p>Turns out, this Focscam camera was one of several newer models the company makes that comes with peer-to-peer networking capabilities baked in. This fact is not exactly spelled out for the user (although <a href="http://www.amazon.com/s/ref=nb_sb_noss?url=search-alias%3Delectronics&amp;field-keywords=foscam+p2p" target="_blank">some of the models listed</a> do say &#8220;P2P&#8221; in the product name, <a href="http://www.amazon.com/review/RFM7GAPVPH6RD/ref=cm_cr_rev_detup_redir?_encoding=UTF8&amp;asin=B00I9M4HBO&amp;cdForum=Fx1BLJ13RLI7PNQ&amp;cdPage=1&amp;cdThread=Tx2YIXUHKRE2TPS&amp;newContentID=Mx2RJN1XPG6RJVR&amp;store=photo#Mx2RJN1XPG6RJVR" target="_blank">others do not</a>).</p>
<p>But the bigger issue with these P2P -based cameras is that while the user interface for the camera has a setting to disable P2P traffic (it is enabled by default), Foscam admits that disabling the P2P option <a href="http://foscam.us/forum/foscam-dialing-out-to-suspect-hosts-t17699-40.html#p70740" target="_blank">doesn&#8217;t actually do anything</a> to stop the device from seeking out other P2P hosts online (see screenshot below).</p>
<p>This is a concern because the P2P function built into Foscam P2P cameras is designed to punch through firewalls and can&#8217;t be switched off without <a href="http://foscam.us/forum/foscam-dialing-out-to-suspect-hosts-t17699-70.html#p71046" target="_blank">applying a firmware update plus an additional patch</a> that the company only released after repeated pleas from users on its support forum.</p>
<div id="attachment_33902" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-33902" src="media/ac1c54fe.foscamsettings-580x205.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/02/foscamsettings-580x205.png" alt="Yeah, this setting doesn't work. P2P is still enabled even after you uncheck the box." width="580" height="205" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/02/foscamsettings-580x205.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/02/foscamsettings-768x272.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/02/foscamsettings-940x333.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/02/foscamsettings.png 954w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Yeah, this setting doesn&#8217;t work. P2P is still enabled even after you uncheck the box.</p></div>
<p>One of the many hosts that Foscam users reported seeing in their firewall logs was <strong>iotcplatform.com</strong>, a domain registered to Chinese communications firm <strong>ThroughTek Co., Ltd. </strong>Turns out, this domain has shown up in firewall logs for a number of other curious tinkerers who cared to take a closer look at what their network attached storage and home automation toys were doing on their network.</p>
<p>In January 2015, a contributing writer for the threat-tracking <strong>SANS Internet Storm Center</strong> wrote in <a href="https://isc.sans.edu/diary/IoT%3A+The+Rise+of+the+Machines+(Guest+Diary)/19173" target="_blank">IoT: The Rise of the Machines</a> that he found the same iotcplatform.com domain called out in network traffic generated by a Maginon SmartPlug he&#8217;d purchased (smart plugs are power receptacles into which you plug lights and other appliances you may wish to control remotely).</p>
<p>What is the IOTC Plaform? According to ThroughTek, it&#8217;s a service developed to establish P2P communications between devices.</p>
<p>&#8220;I read the documentation provided with the device as well as all the website pages and there is no mention of this service,&#8221; wrote <strong>Xavier Mertens</strong>, an incident handler and blogger for SANS. &#8220;Manufacturers should include some technical documentation about the network requirements (ex: to download firmware updates).&#8221;</p>
<p>In another instance from May 2015, <a href="https://thecomputerperson.wordpress.com/2015/05/03/compromised-or-suspicious-swann-dvr-traffic/" target="_blank">this blogger noted similar communications traffic</a> emanating from a digital video recorder (DVR) device that&#8217;s sold in tandem with Internet-enabled surveillance cameras made by a company called <strong>Swann</strong>.</p>
<p>Likewise, postings <a href="http://forum.qnap.com/viewtopic.php?f=45&amp;t=100575" target="_blank">from Dec. 2014</a> on the <strong>QNAP</strong> network attached storage (NAS) user forum indicate that some QNAP customers discovered mysterious traffic to iotcplatform.com and other Internet address requests that also were found in the Swann and Smart Plug traffic.</p>
<p>What do all of these things have in common? A visit to ThroughTek&#8217;s Web lists <a href="http://www.throughtek.com/solution_casestudies.html" target="_blank">several &#8220;case studies&#8221; for its products</a>, including Swann, QNAP and a home automation company based in Taiwan called <strong>AboCom</strong>.</p>
<p>ThroughTek did not respond to requests for comment. <span class="pullquote pqleft">A ThroughTek press release from October 2015 announced that the company&#8217;s P2P network &#8212; which it calls the <a href="http://forum.tutk.com/index.php?topic=2.0" target="_blank">Kalay Network</a> &#8212; had grown to support more than seven million connected devices</span> and 100 million &#8220;IoT connections.&#8221;</p>
<p>I contacted Foscam to better understand the company&#8217;s relationship to ThroughTek, and to learn just how many Foscam devices now ship with ThroughTek&#8217;s built-in, always-on P2P technology. Foscam declined to say how many different models bundled the P2P technology, but it&#8217;s at least a dozen by my count of the models mentioned in the Foscam <a href="media/c0b2ff08.Camaras_IP_Foscam_de_interior_User_manual.pdf" data-original-source="http://www.foscam.es/descarga/Camaras_IP_Foscam_de_interior_User_manual.pdf" target="_blank">user manual</a> and <a href="http://foscam.us/forum/foscam-dialing-out-to-suspect-hosts-t17699.html" target="_blank">discussion thread</a>.<span id="more-33881"></span></p>
<p>Foscam customer service representative <strong>David Qu</strong> wrote in reply to requests for comment that &#8220;ThroughTek provides P2P technical support service for us.&#8221; He also said the P2P cameras merely keep a &#8220;heartbeat&#8221; connection to Foscam&#8217;s P2P server to check the connection status with the servers, and that no camera data will be stored on the company&#8217;s servers.</p>
<p>&#8220;The details about how P2P feature works which will be helpful for you understand why the camera need communicate with P2P servers,&#8221; Qu explained. &#8220;Our company deploy many servers in some regions of global world.&#8221; Qu further explained:</p>
<blockquote><p>1. When the camera is powered on and connected to the internet, the camera will log in our main P2P server with fastest response and get the IP address of other server with low load and log in it. Then the camera will not connect the main P2P server.</p>
<p>2. When log in the camera via P2P with Foscam App, the app will also log in our main P2P server with fastest response and get the IP address of the server the camera connect to.</p>
<p>3. The App will ask the server create an independent tunnel between the app and the camera. The data and video will transfers directly between them and will not pass through the server. If the server fail to create the tunnel, the data and video will be forwarded by the server and all of them are encrypted.</p>
<p>4. Finally the camera will keep hearbeat connection with our P2P server in order to check the connection status with the servers so that the app can visit the camera directly via the server. Only when the camera power off/on or change another network, it will replicate the steps above.&#8221;</p></blockquote>
<p>As I noted in a recent column <a href="http://krebsonsecurity.com/2016/02/iot-reality-smart-devices-dumb-defaults/" target="_blank">IoT Reality: Smart Devices, Dumb Defaults</a>, the problem with so many IoT devices is not necessarily that they&#8217;re ill-conceived, it&#8217;s that their default settings often ignore security and/or privacy concerns. I&#8217;m baffled as to why such a well-known brand as Foscam would enable P2P communications on a product that is primarily used to monitor and secure homes and offices.</p>
<p>Apparently I&#8217;m not alone in my bafflement. <strong>Nicholas Weaver</strong>, a senior researcher in networking and security for the <a href="https://www.icsi.berkeley.edu/icsi/people/nweaver" target="_blank">International Computer Science Institute</a> (ICSI), called the embedded P2P feature &#8220;an insanely bad idea&#8221; all around.</p>
<p><span class="pullquote pqleft">&#8220;It opens up all Foscam users not only to attacks on their cameras themselves (which may be very sensitive), but an exploit of the camera also enables further intrusions into the home network,&#8221; Weaver said.</span></p>
<p>&#8220;Given the seemingly cavalier attitude and the almost certain lack of automatic updates, it is almost certain that these devices are remotely exploitable,&#8221; he added. &#8220;It is no wonder that Director of National Intelligence James Clapper is worried about the Internet of Things, how many government officials have or may unwittingly install potential spies like this in their home.&#8221;</p>
<p>If you&#8217;re curious about an IoT device you purchased and what it might do after you connect it to a network, the information is there if you know how and where to look. <a href="http://lifehacker.com/how-to-tap-your-network-and-see-everything-that-happens-1649292940" target="_blank">This Lifehacker post</a> walks through some of the basic software tools and steps that even a novice can follow to learn more about what&#8217;s going on across a local network.</p>


feed_id: http://krebsonsecurity.com/?p=33843
title: The Great EMV Fake-Out: No Chip For You!
uri: The-Great-EMV-Fake-Out-No-Chip-For-You
url: http://krebsonsecurity.com/2016/02/the-great-emv-fake-out-no-chip-for-you/
content:
<p>Many banks are now issuing customers more secure chip-based credit cards, and most retailers now have card terminals in their checkout lanes that can handle the &#8220;dip&#8221; of chip-card transactions (as opposed to the usual swipe of the card&#8217;s magnetic stripe). But comparatively few retailers actually allow chip transactions: Most are still asking customers to swipe the stripe instead of dip the chip. This post will examine what&#8217;s going on here, why so many merchants are holding out on the dip, and where this all leaves consumers.</p>
<p><strong><img class="alignright wp-image-33866" src="media/88f001a8.chiptrans.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/02/chiptrans.png" alt="chiptrans" width="293" height="269" />Visa</strong> <strong>CEO Charles W. Scharf</strong> <a href="media/2a47301a.Visa-Q1-2016-Corrected-Earnings-Transcript-1-28-16.pdf" data-original-source="http://s1.q4cdn.com/050606653/files/doc_financials/2016/Q1/Visa-Q1-2016-Corrected-Earnings-Transcript-1-28-16.pdf" target="_blank">said in an earnings call</a> late last month that more than 750,000 locations representing 17 percent of the U.S. face-to-face card-accepting merchant base are now enabled to handle chip-based transactions, also known as the <a href="https://en.wikipedia.org/wiki/EMV" target="_blank">EMV (&#8220;Europay, Mastercard and Visa&#8221;) payment standard</a>.</p>
<p>Viewed another way, that means U.S. consumers currently can expect to find chip cards accepted in checkout lines at fewer than one in five brick-and-mortar merchants.</p>
<p>Why are so many chip-capable checkout terminals already installed that have not been enabled to actually accept chip cards? <strong>Allen Weinberg</strong>, co-founder of Menlo Park, Calif. based management consulting firm <a href="http://glenbrook.com/" target="_blank">Glenbrook Partners</a>, examined this very question in <a href="http://paymentsviews.com/2016/02/09/fake-out-you-cant-put-your-card-in-that-emv-slot/" target="_blank">a recent column</a> that pointed to several factors holding retailers back from enabling dip-the-chip.</p>
<h4>WHAT LIABILITY SHIFT?</h4>
<p>New <strong>MasterCard</strong> and <strong>Visa</strong> rules that went into effect Oct. 1, 2015 put merchants on the hook to absorb 100 percent of the costs of fraud associated with transactions in which the customer presented a chip-based card yet was not asked or able to dip the chip. The chip cards encrypt the cardholder data and are far more expensive and difficult for card thieves to clone.</p>
<p>Despite the increased risk of eating the entire loss from counterfeit card use in their stores, many merchants are taking a wait-and-see approach on enabling chip card transactions. <span class="pullquote pqleft">Weinberg said some merchants &#8212; particularly the larger ones &#8212; want to turn the often painful experience of training customers how to use the chip cards and terminals into someone else&#8217;s problem.</span></p>
<p>&#8220;They see [chip cards] as just slowing down lines and chose to wait until consumers learned what to do &#8212; and do it quickly &#8212; at someone else&#8217;s store,&#8221; Weinberg wrote.</p>
<p>Weinberg adds that for many larger merchants, switching on the chip readers also can be a big and expensive project. Part of the problem, he says, is that many integrated point of sale systems &#8212; particularly the electronic cash register software for these systems &#8212; were just not ready in time for the Oct. 2015 liability shift.</p>
<p>&#8220;Even if the software was ahead of the game, they faced long certification queues at many acquirers,&#8221; Weinberg wrote. &#8220;I believe this is going to be a problem for a while.&#8221;</p>
<p>Visa said based on recent client surveys it expects 50% of face-to-face card accepting merchants to have chip card transactions enabled by the end of this year. But even 50 percent adoption can mask a long tail of smaller merchants who will put off as long as they can the expensive software and hardware upgrades for accepting chip transactions.</p>
<p>&#8220;My dry cleaner isn&#8217;t worried about someone using counterfeit cards at his cash register,&#8221; Weinberg said, noting that many businesses meanwhile discount the chances that hackers will siphon customer cards by sneaking malicious software onto point-of-sale devices &#8212; a problem that has lead to one breach after another at brand name retailers, restaurants and hotels over the past several  years.<span id="more-33843"></span></p>
<h4>AN INVISIBLE HAND</h4>
<p>The United States is the last of the <a href="https://en.wikipedia.org/wiki/G-20_major_economies" target="_blank">G20 nations</a> to move to more secure chip-based cards. As late as the United States is on EMV implementation globally, the process of merchants shifting to all-EMV transactions is still going to take several more years. Visa has said it typically took about three years after the liability shifts in other countries before 90% of payment card transactions were “chip-on-chip,” or generated by a chip card used at a chip-based terminal.</p>
<p><a href="https://www.linkedin.com/in/terrencecrowley" target="_blank">Terry Crowley</a>, CEO of <strong>TranSend</strong>, a company that makes software to help merchants and their equipment work with the EMV standard, said software code for card-accepting devices has historically been simple &#8212; so much so that it could be written on the back of a business card.</p>
<p>&#8220;But now with EMV, that same software wraps around the walls of a room three times&#8230;hundreds of thousands of lines of code,&#8221; Crowley said. &#8220;Historically, software was developed by terminal manufacturers and some-few contract programmers who kept up with the old-school operating systems, software development kits and so on for each terminal manufacturer. It was so easy that merchants and processors installed specialized tweaks that created countless variants in the marketplace.&#8221;</p>
<p>Now with the EMV liability shift deadline come and gone, Crowley says, suddenly there is a fire drill to replace all of this once-easy software and its countless variants. Compounding the problem, Crowley says, is that EMV code is hard to write and harder to push through the certification birth canal. What&#8217;s more, he adds: There are very few EMV software developers who understand the U.S. market.</p>
<p><span class="pullquote pqright">Crowley predicts that plenty of smaller merchants could soon get hit with a wave of chargebacks from unscrupulous people abusing the liability shift at merchants that still don&#8217;t offer the chip dip.</span></p>
<p>&#8220;There&#8217;s an invisible hand at work that is about to kick everyone in the pants and accelerate U.S. dipping into EMV slots,&#8221; Crowley said. &#8220;If you use a chip card at a point of sale that says swipe &#8212; and you later say that wasn’t me &#8211;there’s very little a merchant can do to dispute that charge. It’s going to happen because what people aren’t thinking about is the friendly fraud. When people are made aware that if I swipe and I have a chip card, that lunch can be free if I’m a bad consumer.&#8221;</p>
<p>And the international [banks] are going to be the first ones lay in, Crowley predicts.</p>
<p>&#8220;International card issuers are used to all these chargeback codes and minutia that goes around with EMV disputes,&#8221; he said. &#8220;They know the rules pretty well and have had EMV cards for years. So when this first wave of chargebacks starts hitting next month, things are really going to ramp up for EMV adoption by smaller merchants here in the U.S.  It just takes one chargeback for those [smaller merchants] to get religion on EMV.&#8221;</p>
<h4>MAD AS HELL?</h4>
<p>If you&#8217;re curious about chip card swipe adoption in your area, take an informal survey: My own decidedly unscientific survey involved a shopping spree one recent morning to no fewer than seven different retail locations, which revealed exactly seven different chip-capable payment terminals instructing customers to &#8220;Please Swipe Card.&#8221;</p>
<p>So what&#8217;s the takeaway for consumers? Why aren&#8217;t consumers mad as hell about being asked to swipe their chip cards, thereby defeating the added security on the card?</p>
<p>For his part, Weinberg said he&#8217;s mad as hell, but he says if consumers get mad about anything chip-card related, it&#8217;s probably going to be about the 10-15 extra seconds it will take to dip the chip versus swipe the stripe.</p>
<p>&#8220;If anything, consumers are getting pissed off at how many more seconds it takes to do chip card transactions,&#8221; which require the consumer to keep the card inserted into the card terminal until the transaction comes back as approved, Weinberg said.</p>
<p>&#8220;We Americans care more about convenience than we do about security,&#8221; he said. &#8220;In the end, consumers hold their banks accountable for this stuff, because they&#8217;re the ones having to reissue the cards each time there&#8217;s another breach.&#8221;</p>
<p>Here&#8217;s another basic takeaway for any consumers still reading: Use a credit card and kick debit cards to the curb. If a thief makes a charge on your credit card that you didn&#8217;t authorize, a simple phone call can fix the problem. If the crooks manage to siphon all cash from your checking account, that&#8217;s a bigger problem that could take several days to sort out with the bank (and longer if you count any other businesses you may have just paid with a check).</p>


feed_id: http://krebsonsecurity.com/?p=33747
title: Fraudsters Tap Kohl’s Cash for Cold Cash
uri: Fraudsters-Tap-Kohl-s-Cash-for-Cold-Cash
url: http://krebsonsecurity.com/2016/02/fraudsters-tap-kohls-cash-for-cold-cash/
content:
<p>Scam artists have been using hacked accounts from retailer <strong>Kohls.com</strong> to order high-priced, bulky merchandise that is then shipped to the victim&#8217;s home. While the crooks don&#8217;t get the stolen merchandise, the unauthorized purchases rack up valuable credits called &#8220;Kohl&#8217;s cash&#8221; that the thieves quickly redeem at Kohl&#8217;s locations for items that can be resold for cash or <a href="http://krebsonsecurity.com/2015/12/the-role-of-phony-returns-in-gift-card-fraud/" target="_blank">returned for gift cards</a>.</p>
<p><img class="alignright size-full wp-image-33837" src="media/27ab6989.kohlscash.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/02/kohlscash.png" alt="kohlscash" width="264" height="205" />KrebsOnSecurity reader <strong>Suzanne Perry</strong>, a self-professed &#8220;shopaholic&#8221; from Gilbert, Penn., said she recently received an email from Kohls.com stating that the email address on her account had been changed. Recognizing this as a common indicator of a compromised account, Perry said she immediately went to Kohls.com &#8212; which confirmed her fears that her password had been changed.</p>
<p>On a whim, Perry said she attempted to log in with the “updated” email address (the one the thief used) along with her existing password. Happily, the thieves had been too lazy to change the password.</p>
<p>&#8220;Once I was logged in, I checked my order history to determine if any fraudulent orders were placed in the 20 minutes since I received the notification,&#8221; she said. &#8220;I wasn’t that surprised to see two online orders, totaling almost $700 each, but I was very surprised to see they were being shipped to my house and not some address I never heard of.&#8221;</p>
<p>Perry said she then contacted Kohl&#8217;s and gave them the two order numbers and the fraudulent email address.</p>
<p>&#8220;I explained what happened, and they were very helpful in canceling the orders, updating my email address, and resetting my password,&#8221; she said. &#8220;I told them I couldn’t understand why someone would hack into my account just to have a bunch of stuff shipped to my own address. I was trying to figure out what the criminal would possibly have to gain from the effort, but the service representative informed me that is actually a very common occurrence for them.&#8221;</p>
<p>Turns out, the criminal wasn’t after the merchandise at all. Rather, the purpose of changing her email address was to drain the account&#8217;s stored Kohl&#8217;s cash, a form of rebate that Kohl&#8217;s offers customers &#8212; currently $10 for every $50 spent at the store. The two fraudulent orders yielded $220 in Kohls cash total, which is emailed once the order is confirmed (hence the need to change the victim&#8217;s email address).</p>
<p>&#8220;Since the orders were being shipped to me, even though they were  above the threshold for what my typical online spending behavior is, no red flags were raised on their end,&#8221; Perry said.</p>
<p>More interestingly, virtually all of the merchandise the thieves ordered to build up the account&#8217;s Kohl&#8217;s cash balance were bulky items: Three baby cribs, a stroller system and car seat, and a baby bath tub, among other items. Perry said Kohl&#8217;s told her that the thieves do this because they know bulky items usually take longer to return, and since Kohl&#8217;s revokes Kohl&#8217;s cash credits earned on items that are later returned, the thieves can spend the stolen Kohl&#8217;s credits as long as the owner of the hijacked account doesn&#8217;t return the fraudulently ordered items.<span id="more-33747"></span></p>
<p>&#8220;The representative told me when these types of fraudulent transactions occur, the victim usually is unaware of it until the items arrive at their house,&#8221; Perry said of her conversation with the Kohl&#8217;s representative. &#8220;Since the items ordered tend to be large, it generally takes longer for a customer to be able to bring them back for a refund. Had I not questioned the email address change, the items would have shipped to me and the $220 in Kohl&#8217;s cash would have been long spent by the criminal before I had the opportunity to take the items back and rectify the situation.&#8221;</p>
<p>Perry said she was shocked by the scam&#8217;s complexity and sheer gumption.</p>
<p>&#8220;The people behind this are clearly making every effort to not only defraud an account, but also to inconvenience the affected customer as much as possible,&#8221; she said. &#8220;I think Kohl&#8217;s handled the situation well over all; the email notification of an account change is more than I get from some other online shopping sites, and they were able to cancel the Kohl&#8217;s cash. Still, I’m a bit surprised they aren’t doing anything to promote awareness among their customer base.&#8221;</p>
<p>Reached for comment about the apparent fraud trend, Kohl&#8217;s spokesperson <strong>Jen Johnson</strong> said the company &#8220;is aware of a limited number of cases where fraudsters have obtained login information from outside sources to make purchases to earn Kohl’s Cash.&#8221;</p>
<p>&#8220;We are always working to protect our customer shopping experience and will continue to look at ways to make it more difficult for fraudsters in the future,&#8221; Johnson wrote in an emailed statement. &#8220;Customer service is a top priority for Kohl&#8217;s and, as always, we will work with any customer who has had a less than optimal experience. As a best practice, we would encourage customers to regularly change their passwords and to not use the same password for multiple accounts.&#8221;</p>
<p>This type of fraud usually stems from customers picking weak passwords, or re-using the same password at multiple sites. However, Perry said she&#8217;s still mystified how the thieves were able to get hold of her password, which she said was an 11-character, three-word phrase that she didn&#8217;t use on any other site.</p>
<p>It&#8217;s unclear how much is lost annually to points and rewards fraud, but the industry is ripe for the picking: Loyalty program experts at <strong>Colloquy.com</strong> estimated in 2011 that some 2.6 billion loyalty memberships generated $48 billion in rewarded points and miles.</p>
<p>Have you experienced similar fraud at merchants that offer rewards points or cash? Sound off in the comments below.</p>


feed_id: http://krebsonsecurity.com/?p=33824
title: Critical Fixes Issued for Windows, Java, Flash
uri: Critical-Fixes-Issued-for-Windows-Java-Flash
url: http://krebsonsecurity.com/2016/02/criticial-fixes-issued-for-windows-java-flash/
content:
<p><strong>Microsoft Windows</strong> users and those with <strong>Adobe</strong> <strong>Flash Player </strong>or<strong> Java</strong> installed, it&#8217;s time to update again! Microsoft released 13 updates to address some three dozen unique security vulnerabilities. Adobe issued security fixes for its Flash Player software that plugs at least 22 security holes in the widely-used browser component. Meanwhile, <strong>Oracle</strong> issued an unscheduled security fix for Java, its second security update for Java in as many weeks.</p>
<p><img class="alignright wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="214" height="224" />One <a href="https://technet.microsoft.com/en-us/library/security/ms16-feb.aspx" target="_blank">big critical update</a> from Redmond mends more than a dozen security problems with <strong>Internet Explorer</strong>. Another critical patch addresses flaws <strong>Microsoft Edge</strong> &#8212; including four that appear to share the same vulnerability identifiers (meaning Microsoft re-used the same vulnerable IE code in its newest Edge browser). Security vendor <strong>Qualys</strong> as usual has a <a href="https://blog.qualys.com/laws-of-vulnerabilities/2016/02/09/patch-tuesday-february-2016" target="_blank">good roundup</a> of the rest of the critical Microsoft updates.</p>
<p>Adobe issued <a href="https://helpx.adobe.com/security/products/flash-player/apsb16-04.html">an update</a> for Flash Player that fixes a slew of security problems with Flash, a very powerful yet vulnerable piece of software that is also unfortunately ubiquitous. After all, as <strong>Chris Goettl</strong> at <a href="http://blog.shavlik.com/february-patch-tuesday-2016/" target="_blank">Shavlik reminds us</a>, fixing Flash on a modern computer can be a complicated affair: &#8220;You need to update Adobe Flash for IE, Flash for Google Chrome, and Flash for Firefox to completely plug all of these 22 vulnerabilities.&#8221; Thankfully, Chrome and IE should auto-install the latest Flash version on browser restart (I had to manually restart Chrome to get the latest Flash version).<span id="more-33824"></span></p>
<p>If you decide to update (more on hobbling or uninstalling Flash in a moment), make sure you watch for unwanted add-ons that come pre-checked with Adobe&#8217;s Flash updater. The latest version of Flash for most Windows and Mac users will be <em>v. 20.0.0.306.</em> <a href="http://www.adobe.com/products/flash/about/" target="_blank">This page</a> will tell you which version of Flash you have installed (if Flash isn&#8217;t installed, the page will offer a downloader to install it).</p>
<p><img class="alignleft size-full wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="211" height="180" />Patch away, please, but I&#8217;d also advise Flash users to figure out how to put the program in a box so that it can&#8217;t run unless you want it to. Doing without Flash (or at least without Flash turned on all the time) just makes good security sense, and it isn’t as difficult as you might think: See my post, <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">A Month Without Adobe Flash Player</a>, for tips on how to minimize the risks of having Flash installed.</p>
<p>Finally, Oracle pushed out the second security update (Java SE 8, Update 73) this week for Java JRE. as well as an emergency security update from Oracle for Java &#8212; the second patch for Java in a week. <a href="http://news.softpedia.com/news/dll-hijacking-issue-plagues-products-like-firefox-chrome-itunes-openoffice-500060.shtml" target="_blank">This piece</a> explores the back story behind the latest Java update, but the short version is that Oracle is fixing a so-called &#8220;DLL side loading bug&#8221; that allows malicious applications to hijack Java&#8217;s legitimate system processes and avoid having to rely on convincing users double-clicking and executing the malicious file.</p>
<p>This DLL hijacking problem is not unique to Java or Oracle, but I still advise readers to treat Java just like I do Flash: Uninstall the program unless you have an affirmative use for it. If you can&#8217;t do that, take steps to unplug it from your browser (or at least from your primary browser).</p>
<p>If you have an specific use or need for Java, there is a way to have this program installed while minimizing the chance that crooks will exploit unknown or unpatched flaws in the program: unplug it from the browser unless and until you’re at a site that requires it (or at least take advantage of <a title="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" href="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" target="_blank">click-to-play</a>, which can block Web sites from displaying both Java and Flash content by default). The latest versions of Java let users <a title="http://www.java.com/en/download/help/disable_browser.xml" href="http://www.java.com/en/download/help/disable_browser.xml" target="_blank" rel="noreferrer">disable Java content in web browsers</a> through the <a title="http://www.java.com/en/download/help/javaconsole.xml" href="http://www.java.com/en/download/help/javaconsole.xml" target="_blank" rel="noreferrer">Java Control Panel</a>.</p>
<p>Alternatively, consider a dual-browser approach, unplugging Java from the browser you use for everyday surfing, and leaving it plugged in to a second browser that you only use for sites that require Java.</p>
<p>Many people confuse Java with <strong> JavaScript</strong>, a powerful scripting language that helps make sites interactive. Unfortunately, a huge percentage of Web-based attacks use JavaScript tricks to foist malicious software and exploits onto site visitors. For more about ways to manage JavaScript in the browser, check out my tutorial <a title="http://krebsonsecurity.com/tools-for-a-safer-pc/" href="http://krebsonsecurity.com/tools-for-a-safer-pc/" target="_blank">Tools for a Safer PC</a>.</p>


feed_id: http://krebsonsecurity.com/?p=33799
title: Skimmers Hijack ATM Network Cables
uri: Skimmers-Hijack-ATM-Network-Cables
url: http://krebsonsecurity.com/2016/02/skimmers-hijack-atm-network-cables/
content:
<p>If you have ever walked up to an ATM to withdraw cash only to decide against it after noticing a telephone or ethernet cord snaking from behind the machine to a jack in the wall, your paranoia may not have been misplaced: ATM maker <strong>NCR</strong> is warning about skimming attacks that involve keypad overlays, hidden cameras and skimming devices plugged into the ATM network cables to intercept customer card data.</p>
<div id="attachment_33806" style="width: 214px" class="wp-caption alignright"><img class="size-full wp-image-33806" src="media/a5b64ab0.networkskim2.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/02/networkskim2.png" alt="Two network cable card skimming devices, as found attached to this ATM." width="204" height="397" /><p class="wp-caption-text">Two network cable card skimming devices, as found attached to this ATM.</p></div>
<p>In an alert sent to customers Feb. 8, NCR said it received reliable reports of NCR and Diebold ATMs being attacked through the use of external skimming devices that hijack the cash machine&#8217;s phone or Internet jack.</p>
<p>&#8220;These devices are plugged into the ATM network cables and intercept customer card data. Additional devices are attached to the ATM to capture the PIN,&#8221; NCR warned. &#8220;A keyboard overlay was used to attack an NCR ATM, a concealed camera was used on the <strong>Diebold</strong> ATM. PIN data is then likely transmitted wirelessly to the skimming device.&#8221;</p>
<p>The ATM maker believes these attacks represent a continuation of the trend where criminals are finding alternative methods to skim magnetic strip cards. Such alternative methods avoid placing the skimmer on the ATM card entry bezel, which is where most anti-skimming technology is located.</p>
<p>NCR said cash machine operators must consider all points where card data may be accessible &#8212; in addition to the traditional point of vulnerability at the card entry bezel &#8212; and that having ATM network communications cables and connections exposed in publicly accessible locations only invites trouble.<span id="more-33799"></span></p>
<div id="attachment_33807" style="width: 546px" class="wp-caption aligncenter"><img class="size-full wp-image-33807" src="media/7531ecdc.networkskim1.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/02/networkskim1.png" alt="A closer look at the two network cable card skimming devices that were attached to the stand-alone ATM pictured at the top of this story." width="536" height="275" /><p class="wp-caption-text">A closer look at the two network cable card skimming devices that were attached to the stand-alone ATM pictured at the top of this story.</p></div>
<p>If something doesn&#8217;t look right about an ATM, don&#8217;t use it and move on to the next one. It&#8217;s not worth the hassle and risk associated with having your checking account emptied of cash. Also, it&#8217;s best to favor ATMs that are installed inside of a building or wall as opposed to free-standing machines, which may be more vulnerable to tampering.</p>


feed_id: http://krebsonsecurity.com/?p=34148
title: Hackers Target Anti-DDoS Firm Staminus
uri: Hackers-Target-Anti-DDoS-Firm-Staminus
url: http://krebsonsecurity.com/2016/03/hackers-target-anti-ddos-firm-staminus/
content:
<p><strong>Staminus Communications Inc</strong>., a California-based Internet hosting provider that specializes in protecting customers from massive &#8220;distributed denial of service&#8221; (DDoS) attacks aimed at knocking sites offline, has itself apparently been massively hacked. Staminus&#8217;s entire network was down for more than 20 hours until Thursday evening, leaving customers to vent their rage on the company&#8217;s Facebook and Twitter pages. In the midst of the outage, someone posted online download links for what appear to be Staminus&#8217;s customer credentials, support tickets, credit card numbers and other sensitive data.</p>
<div id="attachment_34150" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-34150" src="media/26998720.staminus-580x578.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/staminus-580x578.png" alt="The e-zine posted online Thursday following an outage at Staminus Communications. " width="580" height="578" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/03/staminus-580x578.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/03/staminus-768x765.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/03/staminus-940x937.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/03/staminus.png 1080w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The e-zine posted online Thursday following an outage at Staminus Communications.</p></div>
<p>Newport Beach, Calif.-based Staminus first acknowledged an issue on its social media pages because <a href="https://www.staminus.net" target="_blank">the company&#8217;s Web site</a> was unavailable much of Thursday.</p>
<p>&#8220;Around 5am PST today, a rare event cascaded across multiple routers in a system wide event, making our backbone unavailable,&#8221; Staminus wrote to its customers. &#8220;Our technicians quickly began working to identify the problem. We understand and share your frustration. We currently have all hands on deck working to restore service but have no ETA for full recovery.&#8221;</p>
<p>Staminus now says its global services are back online, and that ancillary services are being brought back online. However, the company&#8217;s Web site still displays a black page with a short message directing customers to Staminus&#8217;s social media pages.</p>
<p>Meanwhile, a huge trove of data appeared online Thursday, in a classic &#8220;<a href="http://web.textfiles.com/ezines/" target="_blank">hacker e-zine</a>&#8221; format entitled, &#8220;Fuck &#8217;em all.&#8221; The page includes links to download databases reportedly stolen from Staminus and from <a href="https://www.intrepid.com" target="_blank">Intreppid</a>, another Staminus project that targets customers looking for protection against large DDoS attacks.<span id="more-34148"></span></p>
<div id="attachment_34157" style="width: 498px" class="wp-caption aligncenter"><img class="size-full wp-image-34157" src="media/ed7f670c.stam-fb.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/stam-fb.png" alt="Frustrated Staminus customers vent on the company's Facebook page." width="488" height="659" /><p class="wp-caption-text">Frustrated Staminus customers vent on the company&#8217;s Facebook page.</p></div>
<p>The authors of this particular e-zine indicated that they seized control over most or all of Staminus&#8217;s Internet routers and reset the devices to their factory settings. They also accuse Staminus of &#8220;using one root password for all the boxes,&#8221; and of storing customer credit card data in plain text, which is violation of payment card industry standards.</p>
<p>Staminus so far has not offered any additional details about what may have caused the outage, nor has it acknowledged any kind of intrusion. Several Twitter accounts associated with people who claim to be Staminus customers frustrated by the outage say they have confirmed seeing their own account credentials in the trove of data dumped online.</p>
<p>I&#8217;ve sent multiple requests for comment to Staminus, which is no doubt busy with more pressing matters at the moment. I&#8217;ll update this post in the event I hear back from them.</p>
<p>It is not unusual for attackers to target Anti-DDoS providers. After all, they typically host many customers whose content or message might be offensive &#8212; even hateful &#8212; speech to many. For example, among the company&#8217;s many other clients is kkk-dot-com, the official home page of the <a href="https://en.wikipedia.org/wiki/Ku_Klux_Klan" target="_blank">Ku Klux Klan</a> (KKK) white supremacist group. In addition, Staminus appears to be hosting a large number of internet relay chat (IRC) networks, text-based communities that are often the staging grounds for large-scale DDoS attack services.</p>


feed_id: http://krebsonsecurity.com/?p=34082
title: eero: A Mesh WiFi Router Built for Security
uri: eero-A-Mesh-WiFi-Router-Built-for-Security
url: http://krebsonsecurity.com/2016/03/eero-a-mesh-wifi-router-built-for-security/
content:
<p>User-friendly and secure. Hardly anyone would pick either word to describe the vast majority of wireless routers in use today. So naturally I was intrigued a year ago when I had the chance to pre-order a <strong><a href="https://www.eero.com" target="_blank">eero</a></strong>, a new WiFi system billed as easy-to-use, designed with security in mind, and able to dramatically extend the range of a wireless network without compromising speed. Here&#8217;s a brief review of the eero system I received and installed a week ago.</p>
<div id="attachment_34094" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-34094" src="media/ff6cf5cb.eero-580x569.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/eero-580x569.jpg" alt="Three eero devices designed to create a &quot;mesh&quot; wireless network with extended range without compromising speed." width="580" height="569" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/03/eero-580x569.jpg 580w, http://krebsonsecurity.com/wp-content/uploads/2016/03/eero-768x754.jpg 768w, http://krebsonsecurity.com/wp-content/uploads/2016/03/eero-940x923.jpg 940w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Three eero devices designed to create an extended range &#8220;mesh&#8221; wireless network without compromising speed.</p></div>
<p>The standard eero WiFi system comes with three eero devices, each about the width of a square coaster and roughly an inch thick. Every individual eero unit has two built-in WiFi radios that are designed to hand off traffic with the other two units.</p>
<p>This two-radio aspect is important, as most consumer devices that are made and marketed as WiFi range extenders or &#8220;repeaters&#8221; contain only one radio, and thus end up halving the speed of the repeated WiFi signal.</p>
<p>The makers of eero recommend one device for every 1,000 square feet, and advise placing one device no further than 40 feet from another. Each eero has two ethernet ports in the back, but only one of the eeros needs to be connected directly into your modem with an ethernet cable. That means that a 3-piece eero set has a total of five available ethernet ports, or at least one open ethernet port at each eero location.</p>
<p>Most wireless routers require owners to configure the device by using a hard-wired computer or laptop, opening a browser and navigating to a numeric Internet address to enter some default credentials. From there, you&#8217;re on your own. In contrast, the eero system relies on a simple mobile app for setup. The app asks for your name, email address and mobile number, and then sends a text with a one-time passcode.</p>
<p>After you verify the code on your mobile device, the app prompts you to pick a network name (SSID) and password. The device defaults to WPA-2 PSK (AES) for encryption &#8212; the strongest security currently available.</p>
<p>Once you&#8217;ve assigned each eero a unique location &#8212; and as long as the three devices can talk to each other &#8212; the network should be set up. The entire process &#8212; from placing and plugging in the eeros to setting up the network &#8212;  took me about five minutes, but most of that was just me walking from one room or floor to the next to adjust the location of the devices.<span id="more-34082"></span></p>
<h4>MY TAKE?</h4>
<p>The eero system did indeed noticeably extend the range of my home WiFi network. My most recent router &#8212; an <a href="https://www.asus.com/us/Networking/RTN66U/" target="_blank">ASUS RT-N66U</a>, a.k.a the &#8220;Dark Knight&#8221; &#8212; cost about $150 when I bought it, but it never gave me coverage throughout our three-level home despite multiple experiments with physical placement of the device. In contrast, the eero system extended the range of my network throughout our home and to about a dozen meters outside the house in every direction.</p>
<p>In fact, I&#8217;m now writing this column from a folding chair in the front lawn, something I couldn&#8217;t do with any router I&#8217;ve previously owned. Then again, a wireless network that extends well beyond one&#8217;s home may actually be a security minus for those who&#8217;d rather not have their network broadcast beyond their front porch or apartment walls.</p>
<p>This is a good time to note one of eero&#8217;s best features: The ability to add guests to your wireless network quickly and easily. According to an interview with eero&#8217;s co-founder (more on that below), the firewall rules that govern any devices added to a eero guest network prevent individual hosts from directly communicating with any other on the local network. With a few taps on the app, guests are invited to join via a text or email message, and the invite contains the name (SSID) of the guest wireless network and a plaintext password.</p>
<p>There are a few aspects about the eero system that may give pause to some readers &#8212; particularly the tinfoil hat types and those who crave more granular control over their wireless router. Control freaks may have a hard time letting go with the eero &#8212; in part because it demands a great deal of trust &#8212; but also because frankly it&#8217;s a little too easy to set up.</p>
<p>There aren&#8217;t a lot of configuration options available in the app. eero says it is working on rolling out new features and options, and that it&#8217;s so far been focused on getting shipping all of the pre-ordered units so that they work as advertised. This is a WiFi system that I can see selling very nicely to relatively well-off consumers who don&#8217;t know or don&#8217;t want to know how to configure a wireless router.</p>
<p>To be clear, the eero is not a cheap WiFi system. I paid $299 for my three eeros, and that was at the pre-order rate. The same package now retails for $499. In contrast, your average, 4-port consumer WiFi router sells for about $45-$50 at the local electronics store and will do the job okay for most Internet users.</p>
<p>Another behavior central to the eero that is bound to be a sticking point with some is that it is regularly checking for or downloading new security and bug updates from the cloud. This may be a huge change for consumers accustomed to configuring all of this themselves, but overall I think it&#8217;s a positive development if done right.</p>
<p>For starters, the vast majority of consumer grade routers ship with poorly written and insecure software, and often with unnecessary networking features turned on. It&#8217;s a fair bet that if you were to buy a regular WiFi router off the shelf at the local electronics store, that software or &#8220;firmware&#8221; that powers that device is going to be out-of-date and in need of updating straight out of the box.</p>
<p>Worse still, most of these device will remain in this default insecure state for the remainder of their Internet-connected lifespan (which is probably at least several years), because few consumer routers make it easy for consumers to update, or even alert them that the devices need updates. There are so many out-of-date and insecure routers exposed to the Internet now that it&#8217;s not uncommon to find <a href="http://krebsonsecurity.com/?s=router+botnet&amp;x=0&amp;y=0" target="_blank">criminal botnets made up entirely of hacked home routers</a>.</p>
<p>True, geeks who feel at home tinkering with open-source router firmware can void their warranty by installing something like <a href="http://www.dd-wrt.com/site/index" target="_blank">DD-WRT</a> or <a href="http://www.polarcloud.com/tomato" target="_blank">Tomato</a> on a normal wireless router, and I have <a href="http://krebsonsecurity.com/tools-for-a-safer-pc/" target="_blank">recommended</a> as much for those with the confidence to do so. But I also am careful to note that anyone who updates their router with third-party firmware but fumbles a crucial step can quickly be left with an oversized and otherwise useless paperweight.</p>
<h4>INTERVIEW WITH EERO CEO/CO-FOUNDER</h4>
<p>I wanted to know more about the security design that went into the eero, and fortunately was in eero&#8217;s hometown of San Francisco last week for the RSA Security conference. So I dropped by the company&#8217;s headquarters and got to sit down briefly with the company&#8217;s CEO and co-founder, <a href="https://www.linkedin.com/in/nsweaver" target="_blank">Nick Weaver</a>.</p>
<p>&#8220;The way we designed the eero system in general is that it’s a distributed system that runs in your home, and the system we use to deliver that experience is also a distributed system,&#8221; Weaver explained. &#8220;In your home, the system distributes the load of clients, compute, updates, and diagnostics across the units in your home. We also have a cloud with a distributed architecture, and that’s what allows the eero networks to update an configure themselves automatically.&#8221;</p>
<p><strong>BK:</strong> Where does that distributed cloud architecture live?</p>
<p><strong>NW:</strong> Today it’s <strong>Amazon,</strong> and everything is hosted on <strong>AWS</strong>. There’s a high frequency [of check-ins] but not a lot of traffic.  There is very little information exchanged. Only diagnostic info that explains how the links between the eeros are doing. You can think of it as a network engineer in the sky who helps ensure that your network is configured properly.</p>
<p><strong>BK:</strong> How does the eero know the updates being pushed to it are from eero and not from someone else?</p>
<p><strong>NW:</strong> Every update is signed by a key, and that key is locked away at [the bank].</p>
<p><strong>BK:</strong> Does eero collect any other information about its users?</p>
<p><strong>NW:</strong> There is no information collected ever about where you go on the Internet or how your connection is being used. That is not information that’s interesting to us. The other co-founder studied networking and security and contributed quite a bit to the <a href="https://www.torproject.org/" target="_blank">Tor Project</a>. We’ve got all the right tensions in our founding team. Security is really important. And it’s been totally underestimated by all the existing players. As we’re discovering more and more security vulnerabilities, we have to be able to move quickly and deploy quickly. Because if you don’t, you&#8217;re doing a disservice to your customers.</p>
<p>Would you buy a eero system? Sound off in the comments below.</p>
<p><strong>Update 12:58 p.m. ET:</strong> Corrected the price of the 3-eero unit.</p>


feed_id: http://krebsonsecurity.com/?p=34116
title: Adobe, Microsoft Push Critical Updates
uri: Adobe-Microsoft-Push-Critical-Updates
url: http://krebsonsecurity.com/2016/03/adobe-microsoft-push-critical-updates/
content:
<p><strong>Microsoft</strong> today pushed out 13 security updates to fix at least 39 separate vulnerabilities in its various <strong>Windows</strong> operating systems and software. Five of the updates fix flaws that allow hackers or malware to break into vulnerable systems without any help from the user, save for perhaps visiting a hacked Web site.</p>
<p><img class="alignright size-full wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="229" height="240" />The bulk of the security holes plugged in this month&#8217;s Patch Tuesday reside in either <strong>Internet Explorer</strong> or in Microsoft&#8217;s flagship browser &#8212; <strong>Edge</strong>. As security firm <strong>Shavlik</strong> <a href="http://blog.shavlik.com/march-patch-tuesday-2016/" target="_blank">notes</a>, Microsoft&#8217;s claim that Edge is more secure than IE seems to be holding out, albeit not by much. So far this year, Shavlik found, Edge has required 19 fixes versus IE&#8217;s 27.</p>
<p>Windows users who get online with a non-Microsoft browser still need to get their patches on: Ten of the updates affect Windows &#8212; including three other critical updates from Microsoft. As always, Qualys has <a href="https://blog.qualys.com/laws-of-vulnerabilities/2016/03/08/patch-tuesday-march-2016" target="_blank">a readable post</a> about the rest of the Microsoft patches. If you experience any issues with the Windows patches, please share your experience in the comments below.</p>
<p>As it is known to do on patch Tuesday, Adobe <a href="https://helpx.adobe.com/security/products/acrobat/apsb16-09.html" target="_blank">issued security updates</a> for its Reader and Acrobat software. Alas, there appears to be no update for Adobe&#8217;s Flash Player plugin as per usual on Patch Tuesday. However, an Adobe spokesperson told KrebsOnSecurity that the company will be issuing a Flash Player update on Thursday morning.</p>


feed_id: http://krebsonsecurity.com/?p=34123
title: IRS Suspends Insecure ‘Get IP PIN’ Feature
uri: IRS-Suspends-Insecure-Get-IP-PIN-Feature
url: http://krebsonsecurity.com/2016/03/irs-suspends-insecure-get-ip-pin-feature/
content:
<p>Citing ongoing security concerns, the <strong>Internal Revenue Service</strong> (IRS) has suspended a service offered via its Web site that allowed taxpayers to retrieve so-called IP Protection PINs (IP PINs), codes that the IRS has mailed to some 2.7 million taxpayers to help prevent those individuals from becoming victims of tax refund fraud two years in a row. The move comes just days after KrebsOnSecurity first exposed how ID thieves were abusing the service to revisit tax refund on innocent taxpayers two years running.</p>
<p><img class="alignright wp-image-34053" src="media/c9553d7a.irsbldg-580x740.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/irsbldg-580x740.png" alt="irsbldg" width="271" height="346" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/03/irsbldg-580x740.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/03/irsbldg.png 666w" sizes="(max-width: 271px) 100vw, 271px" />Last week, this blog <a href="http://krebsonsecurity.com/2016/03/thieves-nab-irs-pins-to-hijack-tax-refunds/" target="_blank">told the story of Becky Wittrock</a>, a certified public accountant (CPA) from Sioux Falls, S.D., who received an IP PIN in 2014 after crooks tried to impersonate her to the IRS. Wittrock said she found out her IP PIN had been compromised by thieves this year after she tried to file her tax return on Feb. 25, 2016. Turns out, the crooks beat her to the punch by more than three weeks, filing a large refund request with the IRS on Feb. 2, 2016.</p>
<p>The problem, as Wittrock&#8217;s case made clear, is that IRS allows IP PIN recipients to retrieve their PIN via the agency’s Web site, after supplying the answers to four easy-to-guess questions from consumer credit bureau <strong>Equifax</strong>. These so-called knowledge-based authentication (KBA) or “out-of-wallet” questions focus on things such as previous address, loan amounts and dates and can be successfully enumerated with random guessing. In many cases, the answers can be found by consulting free online services, such as Zillow and Facebook.</p>
<p>In a statement issued Monday evening, the IRS said that as part of its ongoing security review, the agency was temporarily suspending the Identity Protection PIN tool on IRS.gov.</p>
<p>&#8220;The IRS is conducting a further review of the application that allows taxpayers to retrieve their IP PINs online and is looking at further strengthening the security features on the tool,&#8221; the agency said.<span id="more-34123"></span></p>
<p>According to the IRS, of the 2.7 million IP PINs sent to taxpayers by mail for the current filing season, about 5 percent of those – approximately 130,000 – used the online tool to try retrieving a lost or forgotten IP PIN. The agency said that through the end of February 2016, the IRS had confirmed and stopped 800 fraudulent returns using an IP PIN.</p>
<p>&#8220;For taxpayers retrieving a lost IP PIN, the IRS emphasizes it has put strengthened processes and filters in place for this tax season to review these tax returns,&#8221; the statement continued. &#8220;These strengthened review procedures – which are invisible to taxpayers – have helped detect potential identity theft and stopped refund fraud. Taxpayers who have been issued an IP PIN should continue to file their tax returns as they normally would. The online tool is primarily used by taxpayers who have lost their IP PINs and need to retrieve their numbers. Most taxpayers receive their IP PIN via mail and never use the online tool.&#8221;</p>
<p>Eight hundred taxpayers may not seem like a lot of folks impacted by this security weakness, but then again the IRS doesn&#8217;t release stats on fraud it may have missed. Also, the agency has a history of significantly revising the victim numbers upwards in incidents like these.</p>
<p>For example, the very same weakness caused the IRS last year to disable online access to its &#8220;Get Transcript&#8221; feature (the IRS disabled access to the Get Transcript tool in May 2015). The IRS originally said a little over 100,000 people were impacted by the Get Transcript weakness, a number it later revised to 340,000 and last month more than <a href="http://krebsonsecurity.com/2016/02/irs-390k-more-victims-of-irs-gov-weakness/" target="_blank">doubled again to more than 700,000 taxpayers</a>.</p>


feed_id: http://krebsonsecurity.com/?p=34096
title: Seagate Phish Exposes All Employee W-2’s
uri: Seagate-Phish-Exposes-All-Employee-W-2-s
url: http://krebsonsecurity.com/2016/03/seagate-phish-exposes-all-employee-w-2s/
content:
<p>Email scam artists last week tricked an employee at data storage giant <strong><a href="http://www.seagate.com/" target="_blank">Seagate Technology</a></strong> into giving away W-2 tax documents on all current and past employees, KrebsOnSecurity has learned. W-2 forms contain employee Social Security numbers, salaries and other personal data, and are highly prized by thieves involved in filing phony tax refund requests with the Internal Revenue Service (IRS) and the states.</p>
<div id="attachment_34100" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-34100" src="media/1981c57a.seagate-580x311.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/seagate-580x311.png" alt="Seagate headquarters in Cupertino, Calif. Image: Wikipedia" width="580" height="311" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/03/seagate-580x311.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/03/seagate-768x412.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/03/seagate-940x504.png 940w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Seagate headquarters in Cupertino, Calif. Image: Wikipedia</p></div>
<p>According to Seagate, the scam struck on March 1, about a week after KrebsOnSecurity <a href="http://krebsonsecurity.com/2016/02/phishers-spoof-ceo-request-w2-forms/#more-33969" target="_blank">warned readers</a> to be on the lookout for email phishing scams directed at finance and HR personnel that spoof a letter from the organization&#8217;s CEO requesting all employee W-2 forms.</p>
<p>KrebsOnSecurity first learned of this incident from a former Seagate employee who received a written notice from the company. Seagate spokesman <strong>Eric DeRitis</strong> confirmed that the notice was, unfortunately, all too real.</p>
<p>&#8220;On March 1, Seagate Technology learned that the 2015 W-2 tax form information for current and former U.S.-based employees was sent to an unauthorized third party in response to the phishing email scam,&#8221; DeRitis said. &#8220;The information was sent by an employee who believed the phishing email was a legitimate internal company request.&#8221;<span id="more-34096"></span></p>
<p>DeRitis continued:</p>
<blockquote><p>&#8220;When we learned about it, we immediately notified federal authorities who are now actively investigating it. We deeply regret this mistake and we offer our sincerest apologies to everyone affected. Seagate is aggressively analyzing where process changes are needed and we will implement those changes as quickly as we can.&#8221;</p></blockquote>
<p>Asked via email how many former and current employees may have been impacted, DeRitis declined to be specific.</p>
<p>&#8220;We&#8217;re not giving that out publicly &#8212; only to federal law enforcement,&#8221; he said. &#8220;It&#8217;s accurate to say several thousand. But less 10,000 by a good amount.&#8221;</p>
<p>Naturally, Seagate is offering affected employees at least two-years&#8217; membership to <strong>Experian’s</strong> <strong>ProtectMyID</strong> service, paid for by the company. Too bad <a href="http://krebsonsecurity.com/2014/03/are-credit-monitoring-services-worth-it/" target="_blank">having credit monitoring</a> through Experian won&#8217;t protect employees from the real threat here &#8212; tax refund fraud.</p>
<p>As I noted in last month&#8217;s warning about W-2 phishing, fraudsters who perpetrate tax refund fraud prize W-2 information because it contains virtually all of the data one would need to fraudulently file someone’s taxes and request a large refund in their name. Indeed, scam artists involved in refund fraud <a href="http://krebsonsecurity.com/2015/08/irs-330k-taxpayers-hit-by-get-transcript-scam/" target="_blank">stole W-2 information on more than 330,000 people last year</a> directly from the Web site of the Internal Revenue Service (IRS). Scammers last year also <a href="http://krebsonsecurity.com/2014/04/tax-fraud-gang-targeted-healthcare-firms/" target="_blank">massively phished online payroll management account credentials</a> used by corporate HR professionals.</p>
<p>According to <a href="http://krebsonsecurity.com/2016/01/ftc-tax-fraud-behind-47-spike-in-id-theft/" target="_blank">recent stats</a> from the Federal Trade Commission, tax refund fraud was responsible for a nearly 50 percent increase in consumer identity theft complaints last year. The best way to avoid becoming a victim of tax refund fraud is to file your taxes before the fraudsters can. See <a href="http://krebsonsecurity.com/2015/12/dont-be-a-victim-of-tax-refund-fraud-in-16/" target="_blank">Don’t Be A Victim of Tax Refund Fraud in ’16</a> for more tips on avoiding this ID theft headache.</p>
<p><strong>Update, March 7, 12:36 p.m. ET:</strong> Several readers have forwarded news reports about other companies similarly victimized in W-2 phishing scams, including mobile communications firm <a href="http://money.cnn.com/2016/02/29/technology/snapchat-phishing-scam/index.html" target="_blank">Snapchat</a> and <a href="http://www.ktva.com/more-than-2500-gci-employees-w-2-information-stolen-in-phishing-scam-524/" target="_blank">GCI</a>, an Alaskan ISP and telecom provider that handed thieves some 2,500 employee W-2&#8217;s.</p>


feed_id: http://krebsonsecurity.com/?p=33756
title: Credit Unions Feeling Pinch in Wendy’s Breach
uri: Credit-Unions-Feeling-Pinch-in-Wendy-s-Breach
url: http://krebsonsecurity.com/2016/03/credit-unions-feeling-pinch-in-wendys-breach/
content:
<p>A number of credit unions say they have experienced an unusually high level of debit card fraud from the breach at nationwide fast food chain Wendy&#8217;s, and that the losses so far eclipse those that came in the wake of huge card breaches at Target and Home Depot.</p>
<p><img class="alignright wp-image-34063" src="media/3500af38.wendysky-580x392.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/wendysky-580x392.png" alt="wendysky" width="313" height="212" />As <a href="http://krebsonsecurity.com/2016/01/wendys-probes-reports-of-credit-card-breach/" target="_blank">first noted</a> on this blog in January, Wendy&#8217;s is investigating a pattern of unusual card activity at some stores. In a <a href="http://ir.wendys.com/phoenix.zhtml?c=67548&amp;p=irol-newsArticle&amp;ID=2136634" target="_blank">preliminary 2015 annual report</a>, Wendy&#8217;s confirmed that malware designed to steal card data was found on some systems. The company says it doesn&#8217;t yet know the extent of the breach or how many customers may have been impacted.</p>
<p>According to <strong>B. Dan Berger</strong>, CEO at the <a href="https://www.nafcu.org/" target="_blank">National Association of Federal Credit Unions</a>, many credit unions saw a huge increase in debit card fraud in the few weeks before the Wendy&#8217;s breach became public. He said much of that fraud activity was later tied to customers who&#8217;d patronized Wendy&#8217;s locations less than a month prior.</p>
<p>&#8220;This is what we&#8217;ve heard from three different credit union CEOs in Ohio now: It&#8217;s more concentrated and the amounts hitting compromised debit accounts is much higher that what they were hit with after Home Depot or Target,&#8221; Berger said. &#8220;It seems to have been been [the work of] a sophisticated group, in terms of the timing and the accounts they targeted. They were targeting and draining debit accounts with lots of money in them.&#8221;</p>
<p>Berger shared an email sent by one credit union CEO who asked not to be named in this story:</p>
<blockquote><p>&#8220;Please take this Wendy’s story very seriously. We have been getting killed lately with debit card fraud. We have already hit half of our normal yearly fraud so far this year, and it is not even the end of January yet. After reading this, we reviewed activity on some of our accounts which had fraud on them. The first six we checked had all been to Wendy’s in the last quarter of 2015.&#8221;</p>
<p>All I am suggesting is that we are experiencing much high[er] losses lately than we ever did after the Target or Home Depot problems. I think we may be end up with 5 to 10 times the loss on this breach, wherever it occurred. Accordingly, please put this story in the proper perspective.&#8221;</p></blockquote>
<p>Wendy&#8217;s declined to comment for this story.</p>
<p>Even if thieves don&#8217;t know the PIN assigned to a given debit card, very often banks and credit unions will let customers call in and change their PIN using automated systems that ask the caller to verify the cardholder&#8217;s identity by keying in static identifiers, like Social Security numbers, dates of birth and the card&#8217;s expiration date.</p>
<p>Thieves can abuse these automated systems to reset the PIN on the victim&#8217;s debit card, and then use a counterfeit copy of the card to withdraw cash from the account at ATMs. As I reported in September 2014, <a href="http://krebsonsecurity.com/2014/09/in-wake-of-confirmed-breach-at-home-depot-banks-see-spike-in-pin-debit-card-fraud/" target="_blank">this is exactly what happened in the wake of the Home Depot breach</a>.<span id="more-33756"></span></p>
<p>Berger said NAFCU&#8217;s members are still trying to figure out whether they should just reissue cards for any customers who ate at Wendy&#8217;s anytime recently. After all, the restaurant chain hasn&#8217;t yet said how long the breach lasted &#8212; or indeed if the breach is even fully contained yet.</p>
<p>This brings up a fascinating phenomenon that occurs with card fraud linked to breached retailers or restaurants that customers patronize frequently. I recently spoke with a bank security consultant who was helping several financial institutions deal with the fallout from the Wendy&#8217;s breach. The consultant, who spoke on condition of anonymity, said many of his client banks had customers who re-compromised their cards several times in a month because they ate at several different Wendy&#8217;s locations throughout the month.</p>
<p>&#8220;A lot of them are kind of having a tough time because of they&#8217;re having trouble putting context around the exposure window, and because customers keep re-compromising themselves,&#8221; the consultant said. &#8220;The banks are reluctant to keep re-issuing cards if the cards are going to get re-compromised over and over because some customers just have to have their hamburgers each week.&#8221;</p>
<p>Many banks and credit unions are now issuing more secure (and more expensive to manufacture) chip-based credit and debit cards. The chip cards &#8212; combined with chip card readers at merchant cash registers &#8212; are designed to make it much harder and more expensive for thieves to counterfeit stolen cards. It&#8217;s not for certain yet but seems likely that the breached Wendy&#8217;s locations were not asking customers to dip their chip cards but instead swipe the card&#8217;s magnetic stripe.</p>
<p>Curious about why so many retailers have chip-enabled credit/debit card terminals and yet still ask customers to swipe? Check out <a href="http://krebsonsecurity.com/2016/02/the-great-emv-fake-out-no-chip-for-you/" target="_blank">The Great EMV Fakeout: No Chip For You!</a> For a primer on why so many financial institutions in the United States are adopting chip-and-signature over chip-and-PIN, see <a href="http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signature/" target="_blank">this piece</a>.</p>


feed_id: http://krebsonsecurity.com/?p=34039
title: Thieves Nab IRS PINs to Hijack Tax Refunds
uri: Thieves-Nab-IRS-PINs-to-Hijack-Tax-Refunds
url: http://krebsonsecurity.com/2016/03/thieves-nab-irs-pins-to-hijack-tax-refunds/
content:
<p>Last year, KrebsOnSecurity <a href="http://krebsonsecurity.com/2015/08/irs-330k-taxpayers-hit-by-get-transcript-scam/" target="_blank">warned</a> that the <strong>Internal Revenue Service</strong>&#8216;s (IRS) solution for helping victims of tax refund fraud avoid being victimized two years in a row was vulnerable to compromise by identity thieves. According to a story shared by one reader, the crooks are well aware of this security weakness and are using it to revisit tax refund fraud on at least some victims two years running &#8212; despite the IRS&#8217;s added ID theft protections.</p>
<p><img class="alignright wp-image-34053" src="media/c9553d7a.irsbldg-580x740.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/irsbldg-580x740.png" alt="irsbldg" width="300" height="383" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/03/irsbldg-580x740.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/03/irsbldg.png 666w" sizes="(max-width: 300px) 100vw, 300px" />Tax refund fraud affects hundreds of thousands &#8212; if not millions &#8212; of U.S. citizens annually. It starts when crooks submit your personal data to the IRS and claim a refund in your name, but have the money sent to an account or address you don&#8217;t control.</p>
<p>Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS.</p>
<p>The IRS’s preferred method of protecting tax refund victims from getting hit two years in a row — the <strong>Identity Protection (IP) PIN</strong> — has already been mailed to some 2.7 million tax ID theft victims. The six-digit PIN must be supplied on the following year’s tax application before the IRS will accept the return as valid.</p>
<p>As I&#8217;ve noted in several stories here, the trouble with this approach is that the IRS allows IP PIN recipients to <a href="https://www.irs.gov/Individuals/Retrieve-Your-IP-PIN" target="_blank">retrieve their PIN</a> via the agency’s Web site, after supplying the answers to four easy-to-guess questions from consumer credit bureau <strong>Equifax</strong>.  These so-called knowledge-based authentication (KBA) or &#8220;out-of-wallet&#8221; questions focus on things such as previous address, loan amounts and dates and can be successfully enumerated with random guessing.  In many cases, the answers can be found by consulting free online services, such as Zillow and Facebook.</p>
<p class="p1"><span class="s1"><strong>Becky Wittrock</strong>, a certified public accountant (CPA) from Sioux Falls, S.D., said she received an IP PIN in 2014 after crooks tried to impersonate her to the IRS. </span></p>
<p class="p1"><span class="s1">Wittrock said she found out her IP PIN had been compromised by thieves this year after she tried to file her tax return on Feb. 25, 2016. Turns out, the crooks beat her to the punch by more than three weeks, filing a large refund request with the IRS on Feb. 2, 2016. </span></p>
<p class="p1"><span class="s1">&#8220;So, last year I was devastated by this,&#8221; Wittrock said, &#8220;But this year I&#8217;m just pissed.&#8221;</span></p>
<p class="p1">Wittrock said she called the toll-free number for the IRS that was printed on the identity theft literature she received from the year before.</p>
<p class="p1"><span class="s1">&#8220;I tried to e-file this weekend and the return was rejected,&#8221; Wittrock said. &#8220;I received the PIN since I had IRS fraud on my 2014 return. <span class="pullquote pqleft">I called the IRS this morning and they stated that the fraudulent use of IP PINs is a big problem for them this year.&#8221;</span></span></p>
<p class="p1"><span class="s1">Wittrock said that to verify herself to the IRS representative, she had to regurgitate a litany of static data points about herself, such as her name, address, Social Security number, birthday, how she filed the previous year (married/single/etc), whether she claimed any dependents and if so how many. </span></p>
<p class="p1"><span class="s1">&#8220;The guy said, &#8216;Yes, I do see a return was filed under your name on Feb. 2, and that there was the correct IP PIN supplied&#8217;,&#8221; Wittrock recalled. &#8220;I asked him how can that be, and he said, &#8216;You’re not the first, we’ve had many cases of that this year.'&#8221;</span></p>
<p class="p1"><span class="s1">According to Wittrock, the IRS representative shared that the agency wouldn&#8217;t be relying on IP PINs for long. </span></p>
<p class="p1"><span class="s1">&#8220;He said, &#8216;We won’t be using the six digit PIN next year. We&#8217;re working on coming up with another method of verification&#8217;,&#8221; she recalled. &#8220;He also had thrown in something about [requiring] a driver&#8217;s license, which didn&#8217;t sound like a good solution to me.&#8221;</span><span id="more-34039"></span></p>
<p class="p1">Interestingly, the IRS&#8217;s own failure to use anything close to modern authentication methods may have contributed to Wittrock&#8217;s original victimization. From January 2014 to May 2015, the IRS allowed anyone to access someone else&#8217;s previous year&#8217;s W-2 forms, just by supplying the taxpayer&#8217;s name, date of birth, Social Security number, address, and the answers to easy-to-guess-or-Google KBA questions.</p>
<p class="p1">The IRS killed the Get Transcript function in May 2015 after it was revealed (<a href="http://krebsonsecurity.com/2015/03/sign-up-at-irs-gov-before-crooks-do-it-for-you/" target="_blank">first on this blog</a>) that crooks were abusing it to hijack consumer identities and refunds. But here&#8217;s the problem: the agency requires IP PIN holders seeking a copy of their PIN to jump through the exact same flawed authentication process that afflicted its now-defunct Get Transcript service.</p>
<p class="p1">According to the IRS, at least 724,000 citizens had their tax data stolen through the IRS&#8217;s Get Transcript feature between January 2014 and May 2015. This may in fact be a lowball number: The IRS previously said the number of those affected was 334,000, figures that were sharply revised from an initial estimate of 110,000 taxpayers.</p>
<p class="p1">The IRS did not respond to requests for comment for this story. But in <a href="http://qz.com/445233/inside-the-irss-massive-data-breach/" target="_blank">a related story by Quartz last year</a>, the IRS said access to an IP PIN itself &#8220;does not expose taxpayer Personally Identifiable Information.&#8221; However, this may be of small solace to taxpayers who had their tax and income data stolen directly from the IRS in the first place.</p>
<p class="p1">The IRS told Quartz that taxpayers who use IP PINs will be sent a new one in the mail each year, prior to each tax season—making it much harder for an identity thief to access this information.</p>
<p class="p1">&#8220;That is, hackers would have a small window—between the end of the tax year and the moment a taxpayer files a return—to try to steal the IP PIN,&#8221; Keith Collins wrote. &#8220;The statement added: “In addition, we carefully monitor IP PIN traffic in order to respond swiftly to any potentially suspicious activity.”</p>
<p class="p1">I suppose time will tell how swiftly the IRS is moving to respond to suspicious IP PIN activity. In the meantime, if you&#8217;d like to know more about tax ID theft and what you can do to minimize your chances of becoming the next victim, check out <a href="http://krebsonsecurity.com/2015/12/dont-be-a-victim-of-tax-refund-fraud-in-16/" target="_blank">Don&#8217;t Be a Victim of Tax Fraud in &#8217;16</a>.</p>


feed_id: http://krebsonsecurity.com/?p=34196
title: Thieves Phish Moneytree Employee Tax Data
uri: Thieves-Phish-Moneytree-Employee-Tax-Data
url: http://krebsonsecurity.com/2016/03/thieves-phish-moneytree-employee-tax-data/
content:
<p>Payday lending firm <strong>Moneytree</strong> is the latest company to alert current and former employees that their tax data &#8212; including Social Security numbers, salary and address information &#8212; was accidentally handed over directly to scam artists.</p>
<p><img class="alignright size-full wp-image-34199" src="media/7b68dceb.moneytree.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/moneytree.png" alt="moneytree" width="195" height="198" />Seattle-based Moneytree sent an email to employees on March 4 stating that &#8220;one of our team members fell victim to a phishing scam and revealed payroll information to an external source.&#8221;</p>
<p>&#8220;Moneytree was apparently targeted by a scam in which the scammer impersonated me and asked for an emailed copy of certain information about the Company’s payroll including Team Member names, home addresses, social security numbers, birthdates and W2 information,&#8221; Moneytree co-founder <strong>Dennis Bassford</strong> wrote to employees.</p>
<p>The message continued:</p>
<blockquote><p>&#8220;Unfortunately, this request was not recognized as a scam, and the information about current and former Team Members who worked in the US at Moneytree in 2015 or were hired in early 2016 was disclosed. The good news is that our servers and security systems were not breached, and our millions of customer records were not affected. The bad news is that our Team Members’ information has been compromised.&#8221;</p></blockquote>
<p>A woman who answered a Moneytree phone number listed in the email confirmed the veracity of the co-founder&#8217;s message to employees, but would not say how many employees were notified. According to the company&#8217;s <a href="http://www.yellowpages.com/tukwila-wa/mip/moneytree-inc-459503993" target="_blank">profile</a> on <strong>Yellowpages.com</strong>, Moneytree Inc. maintains a staff of more than 1,200 employees. The company offers check cashing, payday loan, money order, wire transfer, mortgage, lending, prepaid gift cards, and copying and fax services.</p>
<p>Moneytree joins a growing list of companies disclosing to employees that they were duped by W2 phishing scams, which this author <a href="http://krebsonsecurity.com/2016/02/phishers-spoof-ceo-request-w2-forms/" target="_blank">first warned about in mid-February</a>.  Earlier this month, data storage giant <strong>Seagate</strong> <a href="http://krebsonsecurity.com/2016/03/seagate-phish-exposes-all-employee-w-2s/" target="_blank">acknowledged</a> that a similar phishing scam had compromised the tax and personal data on thousands of current and past employees.<span id="more-34196"></span></p>
<p>I&#8217;m working on a separate piece that examines the breadth of damage done this year by W2 phishing schemes. Just based on the number of emails I&#8217;ve been forwarded from readers who say they were similarly notified by current or former employers, I&#8217;d estimate there are hundreds &#8212; if not thousands &#8212; of companies that fell for these phishing scams and exposed their employees to all manner of identity theft.</p>
<p>W2 information is highly prized by fraudsters involved in <a href="http://krebsonsecurity.com/category/tax-refund-fraud/" target="_blank">tax refund fraud</a>, a multi-billion dollar problem in which thieves claim a large refund in the victim&#8217;s name, and ask for the funds to be electronically deposited into an account the crooks control.</p>
<p>Tax refund fraud victims usually first learn of the crime after having their returns rejected because scammers beat them to it. Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS. To learn more about tax refund scams and how best to avoid becoming the next victim, check out <a href="http://krebsonsecurity.com/2015/12/dont-be-a-victim-of-tax-refund-fraud-in-16/" target="_blank">this story</a>.</p>
<p>For better or worse, most companies that have notified employees about a W2 phish this year are offering employees the predictable free credit monitoring, which is of course useless to prevent tax fraud and many other types of identity theft. But in a refreshing departure from that tired playbook, Moneytree says it will be giving employees an extra $50 in their next paycheck to cover the initial cost of placing a credit freeze (for more information on the different between credit monitoring and a freeze and why a freeze might be a better idea, check out <a href="http://krebsonsecurity.com/2015/12/opm-breach-credit-monitoring-vs-freeze/" target="_blank">Credit Monitoring vs. Freeze</a> and <a href="http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">How I Learned to Stop Worrying and Embrace the Security Freeze</a>).</p>
<p>&#8220;When something like this happens, the right thing to do is to disclose what you know as soon as possible, take care of the people affected, and learn from what went wrong,&#8221; Bassford&#8217;s email concluded. &#8220;To make good on that last point, we will be ramping up our information security efforts company-wide, because we never want to have to write an email like this to you again.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=34074
title: From Stolen Wallet to ID Theft, Wrongful Arrest
uri: From-Stolen-Wallet-to-ID-Theft-Wrongful-Arrest
url: http://krebsonsecurity.com/2016/03/from-stolen-wallet-to-id-theft-wrongful-arrest/
content:
<p>It&#8217;s remarkable how quickly a stolen purse or wallet can morph into full-blown identity theft, and possibly even result in the victim&#8217;s wrongful arrest. All of the above was visited recently on a fellow infosec professional whose admitted lapse in physical security led to a mistaken early morning arrest in front of his kids.</p>
<div id="attachment_34185" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/ab1909f4.jtwaldorf.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/jtwaldorf.png"><img class="wp-image-34185 size-medium" src="media/833790fa.jtwaldorf-580x572.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/jtwaldorf-580x572.png" alt="The guy police say stole Miller's wallet and got him wrongfully arrested was himself apprehended earlier this month." width="580" height="572" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/03/jtwaldorf-580x572.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/03/jtwaldorf-768x757.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/03/jtwaldorf.png 867w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The guy police say stole Miller&#8217;s wallet and got him wrongfully arrested was himself apprehended earlier this month.</p></div>
<p>On the morning of Feb. 20, <strong>Lance Miller</strong> was arrested in front of his two children by local sheriffs in Golden, Colo. Miller, a managing partner at cybersecurity recruitment firm <a href="http://curitysec.com/" target="_blank">Curity</a>, had discovered his wallet was missing three days prior to his arrest, reported it to the local police and canceled his credit cards. In the meantime someone had drained his checking account of approximately $5,000, and maxed out his credit cards for almost another $5,000.</p>
<p>&#8220;I was standing there in front of my kids saying, &#8216;You guys are crazy. Do I look like a burglar?'&#8221; Miller recalled. &#8220;The cop goes, &#8216;Well, I don&#8217;t know what a burglar looks like,&#8217; and they put me in cuffs and in the car.&#8221;</p>
<p>Miller said it wasn&#8217;t until the 30-minute, handcuffed drive to police station that the local police and the local sheriff&#8217;s office began comparing notes, discovering in the process that they&#8217;d grabbed the wrong guy and removing the cuffs. Miller soon learned the thief who&#8217;d stolen his wallet had impersonated him during multiple traffic stops. A car the impostor was driving also was spotted speeding away from the scene of a burglary, but Miller said the police in that case didn&#8217;t give chase in that case because it wasn&#8217;t a violent crime.<span id="more-34074"></span></p>
<p>&#8220;He started doing all kinds of stuff, and when he got pulled over he gave them my ID,&#8221; Miller said. &#8220;The first time he got pulled over and gave them my ID he was riding shotgun in a car with stolen plates that hadn&#8217;t yet been reported stolen. They let the guy go that night but then came and arrested me the next morning.&#8221;</p>
<p>Miller&#8217;s arrest came less than 24 hours after the local Arvada Police Department called to alert him that someone had tried to use his credit card at a nearby bank. Not long after that, a fuel station owner called the cops after getting suspicious about a customer and writing down his license plates.</p>
<p>&#8220;When we got to the [police] station, the police chief met me in the parking lot and apologized, then brought me 3 cups of coffee,&#8221; Miller said.</p>
<p>According to Miller, the police <a href="http://denver.cbslocal.com/2016/03/03/serial-burglar-louisville-arrest-warrants/" target="_blank">eventually arrested the guy</a> suspected of stealing his wallet and other crimes that were previously pinned on Miller. The authorities now believe the man responsible is one <strong>John Tyler Waldorf</strong>, a 37-year-old suspect who had at least 16 warrants for his arrest pending in surrounding counties in connection with burglary and other alleged offenses.</p>
<p>Miller said investigators told him that Waldorf was suspected of associating with a white supremacist crime ring involved in identity theft, drug dealing and serial burglary.</p>
<p>&#8220;When these guys are not in prison, they&#8217;re expected to earn for the gang,&#8221; Miller said. &#8220;And apparently one of the best earning methods for these guys is ID theft.&#8221;</p>
<p>Louisville, Colo. police issued a bulletin explaining that Waldorf and his associates were known to have entered unlocked vehicles in the driveways of local residences and grabbed the garage door openers to the homes. &#8220;The suspect(s) entered the homes through the garage doors and stole items of value,&#8221; the police explained. &#8220;Both homes were occupied during the burglaries.&#8221;</p>
<p>Miller allows that the thieves in his case didn&#8217;t need to open the garage or enter his home: He&#8217;d absent-mindedly left his wallet in the car overnight while the vehicle was parked in the open garage. He now vows to tighten up his personal security habits.</p>
<p>&#8220;We live in a pretty nice area, and I got lulled into the idea that the garage was safe,&#8221; he said. &#8220;But in the end, it&#8217;s all on me. I&#8217;m an infosec guy, and if I can&#8217;t practice better operational security like that at my house, I should get the hell out of this industry.&#8221;</p>
<p>If your wallet or purse is lost or stolen, it&#8217;s a good idea to do most &#8211; if not all &#8212; of these things:</p>
<p>-File a police report as soon as possible to establish a record of the loss. If possible, get a physical copy of the police report at some point. You may be able to file a report and obtain a copy of it online, or you may have to go down to the local police station and pay a small administrative fee to get a copy. Either way, this report can be very useful in getting you a freeze on your credit file or an extended fraud alert at no cost if you decide to do that down the road.</p>
<p>-Contact your bank and report any checks or credit/debit cards lost or stolen. Most banks issue credit and debit cards with &#8220;zero liability&#8221; provisions, meaning you&#8217;re not on the hook for fraudulent charges or withdrawals &#8212; provided you report them promptly. <a href="http://en.wikipedia.org/wiki/Truth_in_Lending_Act" target="_blank" rel="noreferrer">The Truth In Lending Act</a> limits consumer liability to $50.00 once a credit card is reported lost or stolen, although many card issuers will waive that amount as well. Fraudulent debit card charges are a different story: The <a href="http://en.wikipedia.org/wiki/Electronic_Fund_Transfer_Act" target="_blank" rel="noreferrer">Electronic Fund Transfer Act</a> limits liability for unauthorized charges to $50.00, if you notify your financial institution within two business days of discovering that your debit card was “lost or stolen.” If you wait longer, but notify your bank within 60 days of the date your statement is mailed, you may be responsible for up to $500.00. Wait longer than that and you could lose all the money stolen from your account.</p>
<p>-Contact one of the major credit reporting bureaus (Equifax, Experian, Innovis and Trans Union) and at the very least ask to put a fraud alert on your file, to prevent identity theft in the future. By law, the one you alert has to share the alert with the other three. The initial fraud alert stays on for 90 days. If you have that police report handy, you can instead request an extended fraud alert, which stays in effect for seven years.</p>
<p>-Fraud alerts are okay, but consider placing a security freeze on your credit file with the major bureaus. For more on the importance of a security freeze, check out <a href="http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">How I Learned to Stop Worrying and Embrace the Security Freeze</a>.</p>
<p>-Order a free copy of your credit report from one of the major bureaus. By law, you are entitled to a free report from each of the bureaus once a year. The only real free place to get your report is via the site mandated by the federal government: annualcreditreport.com.</p>


feed_id: http://krebsonsecurity.com/?p=34214
title: Spammers Abusing Trust in US .Gov Domains
uri: Spammers-Abusing-Trust-in-US-Gov-Domains
url: http://krebsonsecurity.com/2016/03/spammers-abusing-trust-in-us-gov-domains/
content:
<p>Spammers are abusing ill-configured U.S. dot-gov domains and link shorteners to promote spammy sites that are hidden behind short links ending in&#8221;usa.gov&#8221;.</p>
<p><img class="alignright wp-image-34240" src="media/a10b7a31.shellgame.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/shellgame.png" alt="shellgame" width="234" height="235" />Spam purveyors are taking advantage of so-called &#8220;<a href="https://www.owasp.org/index.php/Open_redirect" target="_blank">open redirects</a>&#8221; on several U.S. state Web sites to hide the true destination to which users will be taken if they click the link.  Open redirects are potentially dangerous because they let spammers abuse the reputation of the site hosting the redirect to get users to visit malicious or spammy sites without realizing it.</p>
<p>For example, South Dakota has an open redirect:</p>
<p>http://dss.sd.gov/scripts/programredirect.asp?url=</p>
<p>&#8230;which spammers are abusing to insert the name of their site at the end of the script. <a href="http://dss.sd.gov/scripts/programredirect.asp?url=http://krebsonsecurity.com" target="_blank">Here&#8217; a link</a> that uses this redirect to route you through <strong>dss.sd.gov</strong> and then on to krebsonsecurity.com. But this same redirect could just as easily be altered to divert anyone clicking the link to a booby-trapped Web site that tries to foist malware.</p>
<p>The federal government&#8217;s stamp of approval comes into the picture when spammers take those open redirect links and use <strong><a href="http://bit.ly" target="_blank">bit.ly</a></strong> to shorten them. Bit.ly&#8217;s service <a href="https://github.com/usagov/1.USA.gov-Data" target="_blank">automatically</a> shortens any US dot-gov or dot-mil (military) site with a &#8220;1.usa.gov&#8221; shortlink. That allows me to convert the redirect link to krebsonsecurity.com from the ungainly&#8230;.</p>
<p>http://dss.sd.gov/scripts/programredirect.asp?url=http://krebsonsecurity.com</p>
<p>&#8230;into the far less ugly and perhaps even official-looking:</p>
<p>http://1.usa.gov/1pwtneQ.</p>
<p>Helpfully, Uncle Sam makes available a list of all the 1.usa.gov links being clicked at <a href="http://developer.usa.gov/1usagov" target="_blank">this page</a>. Keep an eye on that and you&#8217;re bound to see spammy links going by, as in <a href="media/be01ea3c.4-usagov-bitlyClicks.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/4-usagov-bitlyClicks.jpg" target="_blank">this screen shot</a>. One of the more recent examples I saw was this link &#8212; http:// 1.usa[dot]gov/1P8HfQJ# (please don&#8217;t visit this unless you know what you&#8217;re doing) &#8212; which was advertised via <a href="media/6f38e7fb.1-SkypeSpam.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/1-SkypeSpam.jpg" target="_blank">Skype instant message spam</a>, and takes clickers to a fake <strong>TMZ</strong> story allegedly about &#8220;Gwen Stefani Sharing Blake Shelton&#8217;s Secret to Rapid Weight Loss.&#8221;<span id="more-34214"></span></p>
<div id="attachment_34218" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-34218" src="media/bcd4ec2f.gwenweightloss-580x420.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/gwenweightloss-580x420.png" alt="Spammers are using open redirects on state sites and bit.ly to make spammy domains like this one look like .gov links. " width="580" height="420" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/03/gwenweightloss-580x420.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/03/gwenweightloss-768x556.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/03/gwenweightloss.png 911w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Spammers are using open redirects on state sites and bit.ly to make spammy domains like this one look like .gov links.</p></div>
<p>Unfortunately, a minute or so of research online shows that exact issue was highlighted almost four years ago by researchers at <strong>Symantec</strong>. In October 2012, Symantec said it found that <a href="http://www.symantec.com/connect/blogs/spam-gov-urls" target="_blank">about 15 percent of all 1.usa.gov URLS were used to promote spammy messages</a>. I&#8217;d be curious to know the current ratio, but I doubt it has changed much.</p>
<p>A story at the time about the Symantec research in <strong>Sophos</strong>&#8216;s <a href="https://nakedsecurity.sophos.com/2012/10/23/spammers-exploit-open-redirects-government/" target="_blank">Naked Security blog</a> noted that the curator of usa.gov &#8212; the <a href="http://www.gsa.gov/portal/category/25729" target="_blank">U.S. General Services Administration&#8217;s Office of Citizen Services and Innovative Technology</a> &#8212; was working with bit.ly to filter out malicious or spammy links &#8212; pointing to a interstitial warning that bit.ly pops up when it detects a suspicious link is being shortened.</p>
<p>KrebsOnSecurity requested comment from both bit.ly and the GSA, and will update this post in the event that they respond.</p>
<p>I wanted to get a sense of how well bit.ly&#8217;s system would block any .gov redirects that sent users to known malicious Web sites. So I created .gov shortlinks using the South Dakota redirect, bit.ly, and the first page of URLs listed at <a href="http://malwaredomainlist.com" target="_blank">malwaredomainlist.com</a><strong> &#8212; </strong>a site that tracks malicious links being used in active attacks.</p>
<p>The result? Bit.ly&#8217;s system allowed clicks on all of the shortened malicious links that didn&#8217;t end in &#8220;.exe,&#8221; which was most of them. It&#8217;s nice that bit.ly at least tries to filter out malicious links, but perhaps the better solution is for U.S. state and federal government sites to get rid of open redirects altogether.</p>
<div id="attachment_34225" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/c7a74c7d.bitlywarning.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/bitlywarning.png"><img class="wp-image-34225 size-medium" src="media/3d3f9bf7.bitlywarning-580x512.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/bitlywarning-580x512.png" alt="The warning that bit.ly sometimes pops up if you try to shorten known, malicious links." width="580" height="512" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/03/bitlywarning-580x512.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/03/bitlywarning-768x678.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/03/bitlywarning.png 812w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The warning that bit.ly sometimes pops up if you try to shorten known, malicious links.</p></div>
<p>I generally don&#8217;t trust shortened links, and have long relied on the <a href="http://unshorten.it/" target="_blank">Unshorten.it</a> extension for Google Chrome, which lets users unshorten any link by right clicking on it and selecting &#8220;unshorten this link&#8221;. Unshorten.it also pulls reputation data on each URL from <a href="https://www.mywot.com/" target="_blank">Web of Trust (WOT)</a>.</p>
<p>Fun fact: Adding a &#8220;+&#8221; to the end of any link shortened with bit.ly will take you to a page on bit.ly that displays the link actual link that was shortened.</p>
<p>How do you respond to shortened links? Sound off in the comments below.</p>


feed_id: http://krebsonsecurity.com/?p=34508
title: US-CERT to Windows Users: Dump Apple Quicktime
uri: US-CERT-to-Windows-Users-Dump-Apple-Quicktime
url: http://krebsonsecurity.com/2016/04/us-cert-to-windows-users-dump-apple-quicktime/
content:
<p><strong>Microsoft Windows</strong> users who still have <strong>Apple Quicktime</strong> installed should ditch the program now that Apple has stopped shipping security updates for it, warns the <strong>Department of Homeland Security</strong>&#8216;s <strong>U.S. Computer Emergency Readiness Team</strong> (US-CERT). The advice came just as researchers are reporting two new critical security holes in Quicktime that likely won&#8217;t be patched.</p>
<p><img class="alignright size-full wp-image-34515" src="media/37b82d6d.quicktime.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/quicktime.png" alt="quicktime" width="173" height="194" />US-CERT cited <a href="http://blog.trendmicro.com/urgent-call-action-uninstall-quicktime-windows-today/" target="_blank">an April 14 blog post</a> by <strong>Christopher Budd</strong> at <strong>Trend Micro</strong>, which runs a program called <strong>Zero Day Initiative</strong> (ZDI) that buys <a href="http://zerodayinitiative.com/advisories/ZDI-16-241/" target="_blank">security</a> <a href="http://www.zerodayinitiative.com/advisories/ZDI-16-242/" target="_blank">vulnerabilities</a> and helps researchers coordinate fixing the bugs with software vendors. Budd urged Windows users to junk Quicktime, citing two new, unpatched vulnerabilities that ZDI detailed which could be used to remotely compromise Windows computers.</p>
<p>&#8220;According to Trend Micro, Apple will no longer be providing security updates for QuickTime for Windows, leaving this software vulnerable to exploitation,&#8221; US-CERT wrote. <a href="https://www.us-cert.gov/ncas/alerts/TA16-105A" target="_blank">The advisory</a> continued:</p>
<blockquote><p>&#8220;Computers running QuickTime for Windows will continue to work after support ends. However, using unsupported software may increase the risks from viruses and other security threats. Potential negative consequences include loss of confidentiality, integrity, or availability of data, as well as damage to system resources or business assets. The only mitigation available is to uninstall QuickTime for Windows. Users can find instructions for uninstalling QuickTime for Windows on the Apple <a href="https://support.apple.com/en-us/HT205771" target="_blank">Uninstall QuickTime</a> page.&#8221;</p></blockquote>
<p>While the recommendations from US-CERT and others apparently came as a surprise to many, Apple has been distancing itself from QuickTime on Windows for some time now. In 2013, the Cupertino, Calif. tech giant deprecated all developer APIs for Quicktime on Windows.</p>
<p>Apple shipped <a href="https://support.apple.com/en-us/HT205638" target="_blank">an update</a> to Quicktime in January 2016 that <a href="https://discussions.apple.com/thread/7417145?start=0&amp;tstart=0" target="_blank">removed the Quicktime browser plugin</a> on Windows systems, meaning the threat from browser-based attacks on Quicktime flaws was largely mitigated over the past few months for Windows users who have been keeping up to date with the latest version. Nevertheless, if you have Quicktime on a Windows box &#8212; do yourself a favor and <a href="https://support.apple.com/en-us/HT205771" target="_blank">get rid of it</a>.</p>


feed_id: http://krebsonsecurity.com/?p=34494
title: ‘Blackhole’ Exploit Kit Author Gets 7 Years
uri: Blackhole-Exploit-Kit-Author-Gets-7-Years
url: http://krebsonsecurity.com/2016/04/blackhole-exploit-kit-author-gets-8-years/
content:
<p>A Moscow court this week convicted and sentenced seven hackers for breaking into countless online bank accounts &#8212; including &#8220;<strong>Paunch</strong>,&#8221; the nickname used by the author of the infamous &#8220;<strong>Blackhole</strong>&#8221; exploit kit.  Once an extremely popular crimeware-as-a-service offering, Blackhole was for several years responsible for a large percentage of malware infections and stolen banking credentials, and likely contributed to tens of millions of dollars stolen from small to mid-sized businesses over several years.</p>
<div id="attachment_23775" style="width: 295px" class="wp-caption alignright"><a class="lightbox" href="media/e5b07f4f.PaunchPorche.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/12/PaunchPorche.png"><img class="wp-image-23775 size-medium" src="media/8aca14fd.PaunchPorche-285x350.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/12/PaunchPorche-285x350.png" alt="Paunch, the accused creator of the Blackhole Exploit Kit, stands in front of his Porche Cayenne." width="285" height="350" srcset="http://krebsonsecurity.com/wp-content/uploads/2013/12/PaunchPorche-285x350.png 285w, http://krebsonsecurity.com/wp-content/uploads/2013/12/PaunchPorche-600x738.png 600w, http://krebsonsecurity.com/wp-content/uploads/2013/12/PaunchPorche.png 682w" sizes="(max-width: 285px) 100vw, 285px" /></a><p class="wp-caption-text">Fedotov, the convicted creator of the Blackhole Exploit Kit, stands in front of his Porche Cayenne in an undated photo.</p></div>
<p>According to Russia&#8217;s <a href="http://tass.ru/proisshestviya/3198166">ITAR-TASS news network</a>, <strong>Dmitry &#8220;Paunch&#8221; Fedotov</strong> was sentenced on April 12 to seven years in a Russian penal colony. In October 2013, the then 27-year-old Fedotov was arrested along with an entire team of other cybercriminals who worked to sell, develop and profit from Blackhole.</p>
<p>According to Russian security firm <a href="http://www.group-ib.com/">Group-IB</a>, Paunch had more than 1,000 customers and was earning $50,000 per month from his illegal activity. The image at right shows Paunch standing in front of his personal car, a Porsche Cayenne.</p>
<p>First spotted in 2010, <a href="http://krebsonsecurity.com/?s=blackhole&amp;x=0&amp;y=0">BlackHole</a> is commercial crimeware designed to be stitched into hacked or malicious sites and exploit a variety of Web-browser vulnerabilities for the purposes of installing malware of the customer’s choosing.</p>
<p>The price of renting the kit ran from $500 to $700 each month. For an extra $50 a month, Paunch<a title="http://krebsonsecurity.com/2012/02/crimevertising-selling-into-the-malware-channel/" href="http://krebsonsecurity.com/2012/02/crimevertising-selling-into-the-malware-channel/" target="_blank"> also rented customers “crypting” services</a>; cryptors are designed to obfuscate malicious software so that it remains undetectable by antivirus software.</p>
<p>Paunch worked with several other cybercriminals to purchase new exploits and security vulnerabilities that could be rolled into Blackhole and help increase the success of the software. He eventually sought to buy the exploits from other cybercrooks directly to fund a pricier ($10,000/month) and <a href="http://krebsonsecurity.com/2013/01/crimeware-author-funds-exploit-buying-spree/">more exclusive exploit pack called “Cool Exploit Kit.”</a></p>
<div id="attachment_5385" style="width: 310px" class="wp-caption alignleft"><a class="lightbox" href="media/1cc7b4ac.blackholemain.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2010/09/blackholemain.jpg"><img class="wp-image-5385 size-medium" src="media/6c0cf50b.blackholemain-300x218.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2010/09/blackholemain-300x218.jpg" alt="The main page of the Blackhole exploit kit Web interface." width="300" height="218" srcset="http://krebsonsecurity.com/wp-content/uploads/2010/09/blackholemain-300x218.jpg 300w, http://krebsonsecurity.com/wp-content/uploads/2010/09/blackholemain-1024x744.jpg 1024w, http://krebsonsecurity.com/wp-content/uploads/2010/09/blackholemain.jpg 1055w" sizes="(max-width: 300px) 100vw, 300px" /></a><p class="wp-caption-text">The main page of the Blackhole exploit kit Web interface.</p></div>
<p>As documented on this blog in January 2013 (see <a title="http://krebsonsecurity.com/2013/01/crimeware-author-funds-exploit-buying-spree/" href="http://krebsonsecurity.com/2013/01/crimeware-author-funds-exploit-buying-spree/" target="_blank">Crimeware Author Funds Exploit Buying Spree</a>), Paunch contracted with a third-party exploit broker who announced that he had a $100,000 budget for buying new, previously undocumented <a title="http://krebsonsecurity.com/2013/12/how-many-zero-days-hit-you-today/" href="http://krebsonsecurity.com/2013/12/how-many-zero-days-hit-you-today/" target="_blank">“zero-day” vulnerabilities</a>.</p>
<p>Not long after that story, the individual with whom Paunch worked to purchase those exclusive exploits — a miscreant who uses the nickname “<strong>J.P. Morgan</strong>” — posted a message to <a title="http://krebsonsecurity.com/?s=darkode&amp;x=-1067&amp;y=-641" href="http://krebsonsecurity.com/?s=darkode&amp;x=-1067&amp;y=-641" target="_blank">the Darkode[dot]com crime forum</a>, stating that he was doubling his exploit-buying budget to $200,000.<span id="more-34494"></span></p>
<p>In October 2013, shortly after news of Paunch’s arrest leaked to the media, J.P. Morgan posted to Darkode again, this time more than doubling his previous budget — to $450,000.</p>
<p>“Dear ladies and gentlemen! In light of recent events, we look to build a new exploit kit framework. We have budgeted $450,000 to buy vulnerabilities of a browser and its plugins, which will be used only by us afterwards! ”</p>
<div id="attachment_23779" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/3a7bac19.JPM450K.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/12/JPM450K.png"><img class="wp-image-23779 size-large" src="media/95441737.JPM450K-600x396.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/12/JPM450K-600x396.png" alt="J.P. Morgan alludes to his former partner's arrest, and ups his monthly exploit buying budget to $450,000." width="600" height="396" srcset="http://krebsonsecurity.com/wp-content/uploads/2013/12/JPM450K-600x396.png 600w, http://krebsonsecurity.com/wp-content/uploads/2013/12/JPM450K-285x188.png 285w, http://krebsonsecurity.com/wp-content/uploads/2013/12/JPM450K.png 819w" sizes="(max-width: 600px) 100vw, 600px" /></a><p class="wp-caption-text">J.P. Morgan alludes to his former partner&#8217;s arrest, and ups his monthly exploit buying budget to $450,000.</p></div>
<p>The Russian Interior Ministry (MVD) estimates that Paunch and his gang earned more than 70 million rubles, or roughly USD $2.3 million. But this estimate is misleading because Blackhole was used as a means to perpetrate a vast array of cybercrimes. I would argue that Blackhole was perhaps the most important driving force behind an explosion of cyber fraud over the past three years. A majority of Paunch’s customers were using the kit to grow botnets powered by Zeus and Citadel, banking Trojans that are typically used in <a title="http://krebsonsecurity.com/category/smallbizvictims/" href="http://krebsonsecurity.com/category/smallbizvictims/" target="_blank">cyberheists targeting consumers and small businesses</a>.</p>
<p>For more about Paunch, check out <a href="http://krebsonsecurity.com/2013/12/who-is-paunch/" target="_blank">Who is Paunch?</a>, a profile I ran in 2013 shortly after Fedotov&#8217;s arrest that examines some of the clues that connected his online criminal persona with his personal social networking profiles.</p>
<p>Update, 1:42: Corrected headline.</p>


feed_id: http://krebsonsecurity.com/?p=34489
title: ‘Badlock’ Bug Tops Microsoft Patch Batch
uri: Badlock-Bug-Tops-Microsoft-Patch-Batch
url: http://krebsonsecurity.com/2016/04/badlock-bug-tops-microsoft-patch-batch/
content:
<p><strong>Microsoft</strong> released fixes on Tuesday to plug critical security holes in Windows and other software. The company issued 13 patches to tackle dozens of vulnerabilities, including a much-hyped &#8220;Badlock&#8221; file-sharing bug that appears ripe for exploitation. Also, Adobe updated its <strong>Flash Player</strong> release to address at least two-dozen flaws &#8212; in addition to the <a href="http://krebsonsecurity.com/2016/04/adobe-patches-flash-player-zero-day-threat/" target="_blank">zero-day vulnerability</a> Adobe patched last week.</p>
<div id="attachment_34490" style="width: 270px" class="wp-caption alignright"><img class=" wp-image-34490" src="media/bcbadaf3.badlock.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/badlock.png" alt="Source: badlock.org" width="260" height="231" /><p class="wp-caption-text">Source: badlock.org</p></div>
<p>The Windows patch that seems to be getting the most attention this month remedies <a href="https://www.samba.org/samba/security/CVE-2015-5370.html" target="_blank">seven vulnerabilities</a> in <a href="https://en.wikipedia.org/wiki/Samba_(software)" target="_blank">Samba</a>, a service used to manage file and print services across networks and multiple operating systems. This may sound innocuous enough, but attackers who gain access to private or corporate network could use these flaws to intercept traffic, view or modify user passwords, or shut down critical services.</p>
<p>According to <a href="http://badlock.org" target="_blank">badlock.org</a>, a Web site set up to disseminate information about the widespread nature of the threat that this vulnerability poses, we are likely to see active exploitation of the Samba vulnerabilities soon.</p>
<p>Two of the Microsoft patches address flaws that were disclosed prior to Patch Tuesday. One of them is included in a <a href="https://technet.microsoft.com/en-us/library/security/MS16-037" target="_blank">bundle of fixes</a> for <strong>Internet Explorer</strong>. A <a href="https://support.microsoft.com/en-us/kb/3148522" target="_blank">critical update</a> for the <strong>Microsoft Graphics Component</strong> targets four vulnerabilities, two of which have been detected already in exploits in the wild, according to <strong>Chris Goettl</strong> at security vendor <a href="http://blog.shavlik.com/april-patch-tuesday-2016/" target="_blank">Shavlik</a>.</p>
<p>Just a reminder: If you use Windows and haven&#8217;t yet taken advantage of the <strong>Enhanced Mitigation Experience Toolkit</strong>, a.k.a. &#8220;EMET,&#8221; you should definitely consider it. I describe the basic features and benefits of running EMET in <a href="http://krebsonsecurity.com/tag/enhanced-mitigation-experience-toolkit/" target="_blank">this blog post from 2014</a> (yes, it&#8217;s time to revisit EMET in a future post), but the gist of it is that EMET helps block or blunt exploits against known and unknown Windows vulnerabilities and flaws in third-party applications that run on top of Windows. The latest version, v. 5.5, is available <a href="https://www.microsoft.com/en-us/download/details.aspx?id=50766" target="_blank">here</a>. <span id="more-34489"></span></p>
<p><img class="alignleft size-full wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="211" height="180" />On Friday, Adobe <a href="http://krebsonsecurity.com/2016/04/adobe-patches-flash-player-zero-day-threat/" target="_blank">released an emergency update</a> for Flash Player to fix a vulnerability that is being actively exploited in the wild and used to foist malware (such as ransomware). Adobe <a href="https://helpx.adobe.com/security/products/flash-player/apsb16-10.html" target="_blank">updated its advisory</a> for that release to include fixes for 23 additional flaws.</p>
<p>As I noted in last week&#8217;s piece on the emergency Flash Patch, most users are better off hobbling or removing Flash altogether. I’ve got more on that approach (as well as slightly less radical solutions ) in <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">A Month Without Adobe Flash Player</a>.</p>
<p>If you choose to update, please do it today. The most recent version for Mac and Windows users is <em>21.0.0.213, </em>and should be available from the <a href="https://get.adobe.com/flashplayer/" target="_blank">Flash home page.</a> Windows users who browse the Web with anything other than <strong>Internet Explorer</strong> may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.). <strong>Chrome</strong> and IE should auto-install the latest Flash version on browser restart (I had to manually restart Chrome to get the latest Flash version).</p>


feed_id: http://krebsonsecurity.com/?p=34453
title: New Threat Can Auto-Brick Apple Devices
uri: New-Threat-Can-Auto-Brick-Apple-Devices
url: http://krebsonsecurity.com/2016/04/new-threat-can-auto-brick-apple-devices/
content:
<p>If you use an <strong>Apple iPhone,</strong> <strong>iPad</strong> or other iDevice, now would be an excellent time to ensure that the machine is running the latest version of Apple&#8217;s mobile operating system &#8212; <strong>version 9.3.1</strong>. Failing to do so could expose your devices to automated threats capable of rendering them unresponsive and perhaps forever useless.</p>
<div id="attachment_34478" style="width: 300px" class="wp-caption alignright"><img class=" wp-image-34478" src="media/b981573f.Jan1.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/Jan1.png" alt="Zach Straley demonstrating the fatal Jan. 1, 1970 bug. Don't try this at home!" width="290" height="376" /><p class="wp-caption-text">Zach Straley demonstrating the fatal Jan. 1, 1970 bug. Don&#8217;t try this at home!</p></div>
<p>On Feb. 11, 2016, researcher<strong> Zach Straley</strong> <a href="https://www.youtube.com/watch?v=fY-ahR1R6IE" target="_blank">posted a Youtube video</a> exposing his startling and bizarrely simple discovery: Manually setting the date of your iPhone or iPad all the back to January. 1, 1970 will permanently <a href="https://en.wikipedia.org/wiki/Brick_(electronics)" target="_blank">brick</a> the device (don&#8217;t try this at home, or against frenemies!).</p>
<p>Now that Apple has patched the flaw that Straley exploited with his fingers, researchers say they&#8217;ve proven how easy it would be to automate the attack over a network, so that potential victims would need only to wander within range of a hostile wireless network to have their pricey Apple devices turned into useless bricks.</p>
<p>Not long after Straley&#8217;s video began pulling in millions of views, security researchers <strong>Patrick Kelley</strong> and <strong>Matt Harrigan</strong> wondered: Could they automate the exploitation of this oddly severe and destructive date bug? The researchers discovered that indeed they could, armed with only $120 of electronics (not counting the cost of the bricked iDevices), a basic understanding of networking, and a familiarity with the way Apple devices connect to wireless networks.</p>
<p>Apple products like the iPad (and virtually all mass-market wireless devices) are designed to automatically connect to wireless networks they have seen before. They do this with a relatively weak level of authentication: If you connect to a network named &#8220;Hotspot&#8221; once, going forward your device may automatically connect to any open network that also happens to be called &#8220;Hotspot.&#8221;</p>
<p>For example, to use Starbuck&#8217;s free Wi-Fi service, you&#8217;ll have to connect to a network called &#8220;attwifi&#8221;. But once you&#8217;ve done that, you won&#8217;t ever have to manually connect to a network called &#8220;attwifi&#8221; ever again. The next time you visit a Starbucks, just pull out your iPad and the device automagically connects.</p>
<p>From an attacker&#8217;s perspective, this is a golden opportunity. Why? He only needs to advertise a fake open network called &#8220;attwifi&#8221; at a spot where large numbers of computer users are known to congregate. Using specialized hardware to amplify his Wi-Fi signal, he can force many users to connect to his (evil) &#8220;attwifi&#8221; hotspot. From there, he can attempt to inspect, modify or redirect any network traffic for any iPads or other devices that unwittingly connect to his evil network.</p>
<h4>TIME TO DIE</h4>
<p>And this is exactly what Kelley and Harrigan say they have done in real-life tests. They realized that iPads and other iDevices constantly check various &#8220;<a href="https://en.wikipedia.org/wiki/Network_Time_Protocol" target="_blank">network time protocol</a>&#8221; (NTP) servers around the globe to sync their internal date and time clocks.</p>
<p>The researchers said they discovered they could build a hostile Wi-Fi network that would force Apple devices to download time and date updates from their own (evil) NTP time server: And to set their internal clocks to one infernal date and time in particular: January 1, 1970.</p>
<div id="attachment_34480" style="width: 585px" class="wp-caption aligncenter"><img class="size-full wp-image-34480" src="media/29841023.phonebreaker.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/phonebreaker.png" alt="Harrigan and Kelley named their destructive Wi-Fi network &quot;Phonebreaker.&quot;" width="575" height="431" /><p class="wp-caption-text">Harrigan and Kelley named their destructive Wi-Fi test network &#8220;Phonebreaker.&#8221;</p></div>
<p>The result? The iPads that were brought within range of the test (evil) network rebooted, and began to slowly self-destruct. It&#8217;s not clear why they do this, but here&#8217;s one possible explanation: Most applications on an iPad are configured to use security certificates that encrypt data transmitted to and from the user&#8217;s device. Those encryption certificates stop working correctly if the system time and date on the user&#8217;s mobile is set to a year that predates the certificate&#8217;s issuance.</p>
<p>Harrigan and Kelley said this apparently creates havoc with most of the applications built into the iPad and iPhone, and that the ensuing bedlam as applications on the device compete for resources quickly overwhelms the iPad&#8217;s computer processing power. So much so that within minutes, they found their test iPad had reached 130 degrees Fahrenheit (54 Celsius), as the date and clock settings on the affected devices inexplicably and eerily began counting backwards.</p>
<p>&nbsp;</p>
<p><span id="more-34453"></span></p>
<p>Harrigan, president and CEO of San Diego-based security firm <a href="https://packetsled.com" target="_blank">PacketSled</a>, described the meltdown thusly:</p>
<p>&#8220;One thing we noticed was when we set the date on the iPad to 1970, the iPad display clock started counting backwards. While we were plugging in the second test iPad 15 minutes later, the first iPad said it was Dec. 15, 1968. I looked at Patrick and was like, &#8216;Did you mess with that thing?&#8217; He hadn&#8217;t. It finally stopped at 1965, and by that time [the iPad] was about the temperature I like my steak served at.&#8221;</p>
<p>Kelley, a senior penetration tester with <strong>CriticalAssets.com</strong>, said he and Harrigan worked with Apple to coordinate the release of their findings to ensure doing so didn&#8217;t predate Apple&#8217;s issuance of a fix for this vulnerability. The flaw is present in all Apple devices running anything lower than iOS 9.3.1.</p>
<p>Apple did not respond to requests for comment. But an email shared by the researchers apparently sent by Apple&#8217;s product security team suggests the company&#8217;s researchers were unable to force an affected device to heat to more than 45.8 degrees Celcisus (~114 degrees Fahrenheit). The note read:</p>
<blockquote><p>&#8220;1) We confirmed that iOS 9.3 a<wbr />ddresses the issue that left a<wbr /> device unresponsive when the <wbr />date is set to 1/1/1970.</p>
<p>2) A device affected by this i<wbr />ssue can be restored to iOS 9.<wbr />3 or later.  iTunes restored <wbr />the iPad Air you provided to <wbr />us for inspection.&#8217;</p>
<p>3) By examining the device, we<wbr /> determined that the battery <wbr />temperature did not exceed 45.<wbr />8 degrees centigrade.&#8221;</p></blockquote>
<h4>EVIL HARDWARE</h4>
<p>According to Harrigan and Kelley, the hardware needed to execute this attack is little more than a common <a href="https://www.raspberrypi.org/" target="_blank">Raspberry Pi</a> device with some custom software.</p>
<p>&#8220;By spoofing <strong>time.apple.com</strong>, we were able to roll back the time and have it hand out to all Apple clients on the network,&#8221; the researchers wrote in a paper shared with KrebsOnSecurity. &#8220;All test devices took the update without question and rolled back to 1970.&#8221;</p>
<div id="attachment_34479" style="width: 268px" class="wp-caption alignright"><img class=" wp-image-34479" src="media/4da9c730.rasp1970.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/rasp1970.png" alt="The hardware used to automated an attack against the 1970 bug, including a Raspberry Pi and an Alfa antenna." width="258" height="256" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/04/rasp1970.png 373w, http://krebsonsecurity.com/wp-content/uploads/2016/04/rasp1970-150x150.png 150w" sizes="(max-width: 258px) 100vw, 258px" /><p class="wp-caption-text">The hardware used to automated an attack against the 1970 bug, including a Raspberry Pi and an Alfa antenna.</p></div>
<p>The researchers continued: &#8220;An interesting side effect was that this caused almost all web browsing traffic to cease working due to time mismatch. Typically, this would prompt a typical user to reboot their device. So, we did that. At this point, we could confirm that the reboot caused all iPads in test to degrade gradually, beginning with the inability to unlock, and ultimately ending with the device overheating and not booting at all. Apple has confirmed this vulnerability to be present in 64 bit devices that are running any version less than 9.3.1.&#8221;</p>
<p>Harrigan and Kelley say exploiting this bug on an Apple iPhone device is slightly trickier because iPhones get their network time updates via GSM, the communications standard the devices use to receive and transmit cell phone signals. But they said it may be possible to poison the date and time on iPhones using updates fed to the devices via GSM.</p>
<p>They pointed to research by <strong>Brandon Creighton</strong>, a research architect at software testing firm Veracode who is perhaps best known for <a href="http://arstechnica.com/security/2012/07/ninja-tel-hacker-phone-network/" target="_blank">setting up the NinjaTel GSM mobile network</a> at the massive DefCon security conference in 2012. Creighton&#8217;s network relied on a technology called <a href="https://en.wikipedia.org/wiki/OpenBTS" target="_blank">OpenBTS</a> &#8212; a software based GSM access point. Harrigan and Kelley say an attacker could set up his own mobile (evil) network and push date and time updates to any phones that ping the evil tower.</p>
<p>&#8220;It is completely plausible that this vulnerability is exploitable over GSM using OpenBTS or OpenBSC to set the time,&#8221; Kelley said.</p>
<p>Creighton agreed, saying that his own experience testing and running the NinjaTel network shows that it&#8217;s theoretically possible, although he allows that he&#8217;s never tried it.</p>
<p>&#8220;Just from my experimentation, theoretically from a protocol level you can do it,&#8221; Creighton wrote in a note to KrebsOnSecurity. &#8220;But there are lots of factors (the carrier; the parameters on the SIM card; the phone&#8217;s locked status; the kind of phone; the baseband version; previously joined networks; neighboring towers; RF signal strength; and more).  If you&#8217;re just trying to cause general chaos, you don&#8217;t need to work very hard. But if, say, you were trying to target an individual device, it would require an additional amount of prep time/recon.&#8221;</p>
<p>Whether or not this attack could be used to remotely ruin iPhones or turn iPads into expensive skillets, it seems clear that failing to <a href="https://support.apple.com/en-us/HT205248" target="_blank">update to the latest version of Apple iOS</a> is a less-than-stellar idea. iPad users who have not updated their OS need to be extremely cautious with respect to joining networks that they don’t know or trust.</p>
<p>iOS and Mac OS X have a feature that allows users to prevent the devices from automatically joining wireless networks. Enabling this &#8220;ask to join networks&#8221; feature blocks Apple devices from automatically joining networks they have never seen before &#8212; but the side effect is that the device may frequently toss up prompts asking if you wish to join any one of several available wireless networks (this can be disabled by unselecting &#8220;Ask to Join Networks&#8221;). But enabling it doesn&#8217;t prevent the device from connecting to, say, &#8220;attwifi&#8221; if it has previously connected to a network of that name.</p>
<p>The researchers have <a href="https://www.youtube.com/watch?v=zivWTwOjEME" target="_blank">posted a video on Youtube</a> that explains their work in greater detail.</p>
<div align="center"><iframe src="https://www.youtube.com/embed/zivWTwOjEME" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p><strong>Update, 1:08 p.m. ET:</strong> Added link to video and clarified how Apple&#8217;s &#8220;ask to join networks&#8221; feature works.</p>


feed_id: http://krebsonsecurity.com/?p=34432
title: Adobe Patches Flash Player Zero-Day Threat
uri: Adobe-Patches-Flash-Player-Zero-Day-Threat
url: http://krebsonsecurity.com/2016/04/adobe-patches-flash-player-zero-day-threat/
content:
<p><strong>Adobe Systems</strong> this week rushed out an emergency patch to plug a security hole in its widely-installed <strong>Flash Player</strong> software, warning that the vulnerability is already being exploited in active attacks.</p>
<p><img class="alignright size-full wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="211" height="180" />Adobe said a &#8220;critical&#8221; bug exists in all versions of Flash including Flash versions <em>21.0.0.197</em> and lower (older) across a broad range of systems, including <strong>Windows</strong>, <strong>Mac</strong>, <strong>Linux</strong> and <strong>Chrome OS.</strong> Find out if you have Flash and if so what version by visiting <a href="http://www.adobe.com/software/flash/about/" target="_blank">this link</a>.</p>
<p>In a <a href="https://helpx.adobe.com/security/products/flash-player/apsa16-01.html" target="_blank">security advisory</a>, the software maker said it is aware of reports that <a href="http://vuldb.com/?id.81608" target="_blank">the vulnerability</a> is being actively exploited on systems running <strong>Windows 7</strong> and <strong>Windows XP</strong> with Flash Player version <em>20.0.0.306</em> and earlier. <span id="more-34432"></span></p>
<p>Adobe said additional security protections built into all versions of Flash including 21.0.0.182 and newer should block this flaw from being exploited. But even if you&#8217;re running one of the newer versions of Flash with the additional protections, you should update, hobble or remove Flash as soon as possible.</p>
<p>The smartest option is probably to ditch the program once and for all and significantly increase the security of your system in the process. I&#8217;ve got more on that approach (as well as slightly less radical solutions ) in <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">A Month Without Adobe Flash Player</a>.</p>
<p>If you choose to update, please do it today. The most recent versions of Flash should be available from the <a href="https://get.adobe.com/flashplayer/" target="_blank">Flash home page.</a> Windows users who browse the Web with anything other than <strong>Internet Explorer</strong> may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.). <strong>Chrome</strong> and IE should auto-install the latest Flash version on browser restart (I had to manually restart Chrome to get the latest Flash version).</p>
<p>By the way, I&#8217;m not the only one trying to make it easier for people to put a lasso on Flash: In a blog post today, <strong>Microsoft</strong> said <strong>Microsoft Edge</strong> users on Windows 10 will auto-pause Flash content that is not central to the Web page. The new feature will be available in <em>Windows 10 build 14316</em>.</p>
<p>&#8220;Peripheral content like animations or advertisements built with Flash will be displayed in a paused state unless the user explicitly clicks to play that content,&#8221; <a href="https://blogs.windows.com/msedgedev/2016/04/07/putting-users-in-control-of-flash/" target="_blank">wrote</a> the Microsoft Edge team. &#8220;This significantly reduces power consumption and improves performance while preserving the full fidelity of the page. Flash content that is central to the page, like video and games, will not be paused. We are planning for and look forward to a future where Flash is no longer necessary as a default experience in Microsoft Edge.&#8221;</p>
<p>Additional reading on this vulnerability:</p>
<p><strong>Kafeine</strong>&#8216;s <a href="http://malware.dontneedcoffee.com/2016/04/cve-2016-1019-flash-up-to-2100182187.html" target="_blank">Malware Don&#8217;t Need Coffee Blog</a> on active exploitation of the bug.</p>
<p><a href="http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2016-1019-zero-day-integrated-in-exploit-kit/" target="_blank">Trend Micro&#8217;s take</a> on evidence that thieves have been using this flaw in automated attacks since at least March 31, 2016.</p>


feed_id: http://krebsonsecurity.com/?p=34426
title: FBI: $2.3 Billion Lost to CEO Email Scams
uri: FBI-2-3-Billion-Lost-to-CEO-Email-Scams
url: http://krebsonsecurity.com/2016/04/fbi-2-3-billion-lost-to-ceo-email-scams/
content:
<p>The <strong>U.S. Federal Bureau of Investigation</strong> (FBI) this week warned about a &#8220;dramatic&#8221; increase in so-called &#8220;CEO fraud,&#8221; e-mail scams in which the attacker spoofs a message from the boss and tricks someone at the organization into wiring funds to the fraudsters. The FBI estimates these scams have cost organizations more than $2.3 billion in losses over the past three years.</p>
<p>In <a href="https://www.fbi.gov/phoenix/press-releases/2016/fbi-warns-of-dramatic-increase-in-business-e-mail-scams?utm_source=hs_email&amp;utm_medium=email&amp;utm_content=28140297&amp;_hsenc=p2ANqtz--f0buz9nDeHu9YAI5KYbMmCHIthkKaP7LIvZg0vaXQ0uUOCJWXPSxi1TSlz5gdZ_ZF9OVTPnVsL2mGryCnumjJvUj_GQ&amp;_hsmi=28140297" target="_blank">an alert</a> posted to its site, the FBI said that since January 2015, the agency has seen a 270 percent increase in identified victims and exposed losses from CEO scams. The alert noted that law enforcement globally has received complaints from victims in every U.S. state, and in at least 79 countries.</p>
<div id="attachment_34427" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/73f79177.pm1.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/pm1.jpg"><img class="wp-image-34427 size-medium" src="media/59c75f4e.pm1-580x259.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/pm1-580x259.jpg" alt="A typical CEO fraud attack. Image: Phishme" width="580" height="259" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/04/pm1-580x259.jpg 580w, http://krebsonsecurity.com/wp-content/uploads/2016/04/pm1-768x343.jpg 768w, http://krebsonsecurity.com/wp-content/uploads/2016/04/pm1-940x420.jpg 940w, http://krebsonsecurity.com/wp-content/uploads/2016/04/pm1.jpg 1024w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A typical CEO fraud attack. Image: Phishme</p></div>
<p>CEO fraud usually begins with the thieves either phishing an executive and gaining access to that individual’s inbox, or emailing employees from a look-alike domain name that is one or two letters off from the target company’s true domain name. For example, if the target company’s domain was “example.com” the thieves might register “examp1e.com” (substituting the letter “L” for the numeral 1) or “example.co,” and send messages from that domain.</p>
<p>Unlike traditional phishing scams, spoofed emails used in CEO fraud schemes rarely set off spam traps because these are targeted phishing scams that are not mass e-mailed. Also, the crooks behind them take the time to understand the target organization’s relationships, activities, interests and travel and/or purchasing plans.</p>
<p>They do this by scraping employee email addresses and other information from the target’s Web site to help make the missives more convincing. In the case where executives or employees have their inboxes compromised by the thieves, the crooks will scour the victim’s email correspondence for certain words that might reveal whether the company routinely deals with wire transfers — searching for messages with key words like “invoice,” “deposit” and “president.”</p>
<p>On the surface, business email compromise scams may seem unsophisticated relative to moneymaking schemes that involve complex malicious software, such as Dyre and ZeuS. But in many ways, CEO fraud is more versatile and adept at sidestepping basic security strategies used by banks and their customers to minimize risks associated with account takeovers. In traditional phishing scams, the attackers interact with the victim’s bank directly, but in the CEO scam the crooks trick the victim into doing that for them.</p>
<p>The FBI estimates that organizations victimized by CEO fraud attacks lose on average between $25,000 and $75,000. But some CEO fraud incidents over the past year have cost victim companies millions &#8212; if not tens of millions &#8212; of dollars. <span id="more-34426"></span></p>
<p>Last month, the Associated Press <a href="http://www.cbsnews.com/news/mattel-vs-chinese-cyberthieves-its-no-game/" target="_blank">wrote</a> that toy maker Mattel lost $3 million in 2015 thanks to a CEO fraud phishing scam. In 2015, tech firm <strong>Ubiquiti</strong> <a href="http://krebsonsecurity.com/2015/08/tech-firm-ubiquiti-suffers-46m-cyberheist/" target="_blank">disclosed</a> in a quarterly financial report that it suffered a whopping $46.7 million hit because of a CEO fraud scam. In February 2015, email con artists made off with $17.2 million from <strong>The Scoular Co.</strong>, an employee-owned commodities trader. More recently, I wrote about <a href="http://krebsonsecurity.com/2016/01/firm-sues-cyber-insurer-over-480k-loss/" target="_blank">a slightly more complex</a> CEO fraud scheme that incorporated a phony phone call from a phisher posing as an accountant at KPMG.</p>
<p>The FBI urges businesses to adopt two-step or two-factor authentication for email, where available, and to establish other communication channels — such as telephone calls — to verify significant transactions. Businesses are also advised to exercise restraint when publishing information about employee activities on their Web sites or through social media, as attackers perpetrating these schemes often will try to discover information about when executives at the targeted organization will be traveling or otherwise out of the office.</p>
<p>For an example of what some of these CEO fraud scams look like, check out <a href="http://phishme.com/wire-fraud-phisher-attempts-to-phish-phishme-instead-gets-phished-by-phishme/" target="_blank">this post</a> from security education and awareness firm <strong>Phishme</strong> about scam artists trying to target the company&#8217;s leadership.</p>
<p>I&#8217;m always amazed when I hear security professionals I know and respect make comments suggesting that phishing and spam are solved problems. The right mix of blacklisting and email validation regimes like <a href="https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail" target="_blank">DKIM</a> and <a href="https://en.wikipedia.org/wiki/Sender_Policy_Framework" target="_blank">SPF</a> can block the vast majority of this junk, these experts argue.</p>
<p>But CEO fraud attacks succeed because they rely almost entirely on tricking employees into ignoring or sidestepping some very basic security precautions. Educating employees so that they are less likely to fall for these scams won&#8217;t block all social engineering attacks, but it should help. Remember, the attackers are constantly testing users&#8217; security awareness. Organizations might as well be doing the same, using periodic tests to identify problematic users and to place additional security controls on those individuals.</p>


feed_id: http://krebsonsecurity.com/?p=34411
title: After Tax Fraud Spike, Payroll Firm Greenshades Ditches SSN/DOB Logins
uri: After-Tax-Fraud-Spike-Payroll-Firm-Greenshades-Ditches-SSN-DOB-Logins
url:
http://krebsonsecurity.com/2016/04/after-tax-fraud-spike-payroll-firm-greenshades-ditches-ssndob-logins/

content:
<p>Online payroll management firm <strong>Greenshades.com</strong> is an object lesson in how not to do authentication. Until very recently, the company allowed corporate payroll administrators to access employee payroll data online using nothing more than an employee&#8217;s date of birth and Social Security number. That is, until criminals discovered this and began mass-filing fraudulent tax refund requests with the IRS on large swaths of employees at firms that use the company&#8217;s services.</p>
<div id="attachment_34417" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-34417" src="media/a8ffd42b.greenshades-580x356.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/greenshades-580x356.png" alt="A notice on the Greenshades Web site." width="580" height="356" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/04/greenshades-580x356.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/04/greenshades.png 616w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A notice on the Greenshades Web site.</p></div>
<p class="p1"><span class="s1">Jacksonville, Fla.-based Greenshades posted <a href="http://greenshades.com/blog/?p=336?source=banner" target="_blank">an alert</a> on its homepage stating that the company &#8220;has seen an abnormal increase in identity thieves using personal information to fraudulently log into the company’s system to access personal tax information.&#8221;</span></p>
<p class="p1">Many online services blame these sorts of attacks on customers re-using the same password at multiple sites, but Greenshades set customers up for this by allowing access to payroll records just by supplying the employee&#8217;s Social Security number and date of birth.</p>
<p class="p1">As this author has sought repeatedly to demonstrate, SSN/DOB information is extremely easy and cheap to obtain via multiple criminal-run Web sites: <em>SSN/DOB</em> <em>data is reliably available for purchase from underground online crime shops for less than $4 per person (payable in Bitcoin only).</em></p>
<p class="p1">The spike in tax fraud against employees of companies that use Greenshades came to light earlier this month in various media stories. A number of employees at public high schools in Chicago <a href="http://www.chicagotribune.com/suburbs/highland-park/news/ct-hpn-d113-tax-identity-theft-tl-0317-20160315-story.html" target="_blank">discovered</a> that crooks beat them to the punch on filing tax returns. An investigation into that incident suggested security weaknesses at Greenshades were to blame.</p>
<p class="p1"><em>The Milwaukee Journal Sentinel</em> <a href="http://www.jsonline.com/news/ozwash/hackers-access-ozaukee-county-workers-personal-information-b99684801z1-371565671.html" target="_blank">wrote last month</a> about tax fraud perpetrated against local county workers, fraud that also was linked to compromised Greenshades accounts. In Nebraska, the <strong>Lower Platte North Natural Resources District</strong> and <strong>Fremont Health</strong> hospital had a number of employees with tax fraud linked to compromised Greenshades accounts, according to <a href="http://fremonttribune.com/lifestyles/health-med-fit/fremont-health-investigating-possible-employee-data-compromise/article_9a878a8c-37f6-5059-9ab5-2bd9a2631bda.html" target="_blank">a report</a> in the <em>Fremont Tribune</em>.</p>
<p class="p1"><span class="s1">Greenshades co-CEO <strong>Matthew Kane</strong> said the company allowed payroll administrators to access W2 information with nothing more than SSN and DOB for one simple reason: Many customers demanded it.</span></p>
<p class="p1">&#8220;T<span class="s1">here’s a valid reason to have what I call weak login credentials,&#8221; Kane told KrebsOnSecurity. &#8220;Some of our clients clamor for weaker login credentials, such as companies that have a large staff of temporary workers.&#8221;</span></p>
<p class="p1">Kane said customers have a &#8220;wide range of options&#8221; to select from in choosing how they will authenticate to Greenshades.com, but that the most secure option currently offered is a simple username and password.</p>
<p class="p1">When asked whether the company offers any sort of two-step or two-factor authentication, Kane argued that corporate email addresses assigned to company employees serve as a kind of second factor.<span id="more-34411"></span></p>
<p class="p1">&#8220;In this case, the second factor would be having access to that corporate inbox,&#8221; Kane reasoned. He added that Greenshades is working on rolling out a 2-factor authentication feature that may not be optional going forward.</p>
<p class="p1">Kane said that although Greenshades heard from a &#8220;significant number&#8221; of its customers about unauthorized access to employee records, the company believes the overall percentage of affected employees at individual customer organizations was low.</p>
<p class="p1"><span class="s1">However, in at least some of the reported incidents tied to this mess at Greenshades, the overall percentage has been quite high. In the case of the Lower Platt North NRD, for example, 90 percent of employees had their taxes filed fraudulently this year.</span></p>
<p class="p1">It&#8217;s remarkable that a company which specializes in helping firms manage sensitive tax and payroll data could be so lax with authentication. Unfortunately, <a href="http://krebsonsecurity.com/2015/12/2016-reality-lazy-authentication-still-the-norm/" target="_blank">shoddy authentication</a> is still quite common &#8212; even among banks. In February, Pittsburgh, Pa.-based <strong>First National Bank</strong> alerted customers gained through a recent merger with <strong>Metro Bank</strong> that they could access the company&#8217;s bill pay and electronic banking portal by supplying their Metro Bank username and the last four digits of their Social Security number.</p>
<div id="attachment_33805" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-33805" src="media/3f50e7dc.fnbletter-1-580x798.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/02/fnbletter-1-580x798.jpg" alt="A letter from First National Bank to its customers." width="580" height="798" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/02/fnbletter-1-580x798.jpg 580w, http://krebsonsecurity.com/wp-content/uploads/2016/02/fnbletter-1-768x1056.jpg 768w, http://krebsonsecurity.com/wp-content/uploads/2016/02/fnbletter-1-940x1293.jpg 940w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A letter from First National Bank to its customers.</p></div>
<p>Relying on static data elements like SSNs and birthdays for authentication is a horrible idea all around. These data points are no longer secret because they are broadly available for sale on most Americans, and companies have no business using them for authentication.</p>


feed_id: http://krebsonsecurity.com/?p=34378
title: Sources: Trump Hotels Breached Again
uri: Sources-Trump-Hotels-Breached-Again
url: http://krebsonsecurity.com/2016/04/sources-trump-hotels-breached-again/
content:
<p>Banking industry sources tell KrebsOnSecurity that the <strong>Trump Hotel Collection</strong> &#8212; a string of luxury properties tied to business magnate and Republican presidential candidate <strong>Donald Trump </strong>&#8212; appears to be dealing with another breach of its credit card systems. If confirmed, this would be the second such breach at the Trump properties in less than a year.</p>
<div id="attachment_34397" style="width: 277px" class="wp-caption alignright"><img class=" wp-image-34397" src="media/72a702c8.trumpny.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/trumpny.png" alt="Trump International Hotel in New York." width="267" height="374" /><p class="wp-caption-text">Trump International Hotel in New York.</p></div>
<p>A representative from Trump Hotels said the organization was investigating the claims.</p>
<p>&#8220;We are in the midst of a thorough investigation on this matter,&#8221; the company said in a written statement. &#8220;We are committed to safeguarding all guests’ personal information and will continue to do so vigilantly.”</p>
<p>KrebsOnSecurity reached out to the Trump organization after hearing from three sources in the financial sector who said they&#8217;ve noticed a pattern of fraud on customer credit cards which suggests that hackers have breached credit card systems at some &#8212; if not all &#8212; of the Trump Hotel Collection properties.</p>
<p>On July 1, 2015, this publication was the first to report that banks suspected a breach at Trump properties. After that story ran, Trump Hotel Collection <a href="http://krebsonsecurity.com/2015/07/banks-card-breach-at-trump-hotel-properties/" target="_blank">acknowledged</a> being alerted about suspicious activity tied to accounts that were recently used at its hotels. But it didn&#8217;t officially confirm that its payment systems had been infected with card-stealing malware <a href="http://krebsonsecurity.com/2015/10/trump-hotel-collection-confirms-card-breach/" target="_blank">until October 2015</a>.</p>
<p>The Trump Hotel Collection includes more than a dozen properties globally. Sources said they <span class="s1">noticed a pattern of fraud on cards that were all used at multiple Trump hotel locations in the past two to three months, including at <strong>Trump International Hotel New York</strong>, <strong>Trump Hotel Waikiki in Honolulu</strong>, and the <strong>Trump International Hotel &amp; Tower in Toronto</strong>.</span><span id="more-34378"></span></p>
<p>The hospitality industry has been hit hard by card breaches over the past two years. In April 2014, hotel franchising firm White Lodging <a href="http://krebsonsecurity.com/2015/04/white-lodging-confirms-second-breach/" target="_blank">confirmed its second card breach in a year</a>. Card thieves also have hit <a href="http://krebsonsecurity.com/2015/09/banks-card-breach-at-hilton-hotel-properties/" target="_blank">Hilton</a>, <a href="http://krebsonsecurity.com/2015/12/malware-driven-card-breach-at-hyatt-hotels/" target="_blank">Hyatt</a>, and <a href="http://krebsonsecurity.com/2015/11/starwood-hotels-warns-of-credit-card-breach/" target="_blank">Starwood</a> properties. In many of those breaches, the hacked systems were located inside of hotel restaurants and gift shops.</p>
<p>Like <a href="http://www.wired.com/2016/03/candidates-cybersecurity-privacy/" target="_blank">most other current presidential candidates</a>, Mr. Trump has offered little in the way of a policy playbook on cybersecurity. But in statements last month, Trump bashed the United States as &#8220;obsolete&#8221; on cybersecurity, and suggested the country is being “toyed with” by adversaries from China, Russia and elsewhere.</p>
<p>&#8220;We’re so obsolete in cyber,&#8221; Trump <a href="http://www.nytimes.com/2016/03/27/us/politics/donald-trump-transcript.html" target="_blank">told</a> <em>The New York Times</em>. &#8220;We’re the ones that sort of were very much involved with the creation, but we’re so obsolete.&#8221; Trump was critical of the US military’s cyber prowess, charging the Defense Department and the military are “going backwards” in cyber while “other countries are moving forward at a much more rapid pace.&#8221;</p>
<p>&#8220;We are frankly not being led very well in terms of the protection of this country,” Trump said.</p>


feed_id: http://krebsonsecurity.com/?p=34360
title: Crooks Steal, Sell Verizon Enterprise Customer Data
uri: Crooks-Steal-Sell-Verizon-Enterprise-Customer-Data
url: http://krebsonsecurity.com/2016/03/crooks-steal-sell-verizon-enterprise-customer-data/
content:
<p><strong>Verizon Enterprise Solutions</strong>, a B2B unit of the telecommunications giant that gets called in to help Fortune 500&#8217;s respond to some of the world&#8217;s largest data breaches, is reeling from its own data breach involving the theft and resale of customer data, KrebsOnSecurity has learned.</p>
<p><img class="alignright wp-image-34365" src="media/dea341c9.vzbz.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/vzbz.png" alt="vzbz" width="289" height="166" />Earlier this week, a prominent member of a closely guarded underground cybercrime forum posted a new thread advertising the sale of a database containing the contact information on some 1.5 million customers of Verizon Enterprise.</p>
<p>The seller priced the entire package at $100,000, but also offered to sell it off in chunks of 100,000 records for $10,000 apiece. Buyers also were offered the option to purchase information about security vulnerabilities in Verizon&#8217;s Web site.</p>
<p>Contacted about the posting, Verizon Enterprise told KrebsOnSecurity that the company recently identified a security  flaw in its site that permitted hackers to steal customer contact information, and that it is in the process of alerting affected customers.</p>
<p>&#8220;Verizon recently discovered and remediated a security vulnerability on our enterprise client portal,&#8221; the company said in an emailed statement. &#8220;Our investigation to date found an attacker obtained basic contact information on a number of our enterprise customers. No customer proprietary network information (CPNI) or other data was accessed or accessible.&#8221;</p>
<p>The seller of the Verizon Enterprise data offers the database in multiple formats, including the database platform <a href="https://www.mongodb.com/blog/post/how-and-why-verizon-wireless-chose-mongodb" target="_blank">MongoDB</a>, so it seems likely that the attackers somehow forced the MongoDB system to dump its contents. Verizon has not yet responded to questions about how the breach occurred, or exactly how many customers were being notified.<span id="more-34360"></span></p>
<p>The irony in this breach is that Verizon Enterprise is typically the one telling the rest of the world how these sorts of breaches take place.  I frequently recommend <a href="http://www.verizonenterprise.com/DBIR/2015/" target="_blank">Verizon&#8217;s annual Data Breach Investigations Report (DBIR)</a> because each year&#8217;s is chock full of interesting case studies from actual breaches, case studies that include hard lessons which mostly age very well (i.e., even a DBIR report from four years ago has a great deal of relevance to today&#8217;s security challenges).</p>
<p>According to the 2015 report, for example, Verizon Enterprise found that organized crime groups were the most frequently seen threat actor for Web application attacks of the sort likely exploited in this instance. &#8220;Virtually every attack in this data set (98 percent) was opportunistic in nature, all aimed at easy marks,&#8221; the company explained.</p>
<p>It&#8217;s a fair bet that if cyber thieves buy all or some of the Verizon Enterprise customer database, some of those customers may be easy marks for phishing and other targeted attacks. Even if it is limited to the contact data for technical managers at companies that use Verizon Enterprise Solutions, this is bound to be target-rich list: According to <a href="https://en.wikipedia.org/wiki/Verizon_Communications" target="_blank">Verizon&#8217;s page at Wikipedia</a>, some 99 percent of Fortune 500 companies are using Verizon Enterprise Solutions.</p>


feed_id: http://krebsonsecurity.com/?p=34035
title: Phishing Victims Muddle Tax Fraud Fight
uri: Phishing-Victims-Muddle-Tax-Fraud-Fight
url: http://krebsonsecurity.com/2016/03/phishing-victims-muddle-tax-fraud-fight/
content:
<p>Many U.S. citizens are bound to experience delays in getting their tax returns processed this year, thanks largely to more stringent controls enacted by Uncle Sam and the states to block fraudulent tax refund requests filed by identity thieves. A steady drip of corporate data breaches involving phished employee W-2 information is adding to the backlog, as is an apparent mass adoption by ID thieves of professional tax services for processing large numbers of phony refund requests.<br />
<img class="alignright wp-image-34353" src="media/830f3b11.runnerdudesd.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/03/runnerdudesd.png" alt="runnerdudesd" width="265" height="151" /></p>
<p>According to <a href="https://www.iovation.com/news/press-releases/irs-increases-review-time-for-2015-tax-returns" target="_blank">data released this week</a> by anti-fraud company <strong>iovation</strong>, the Internal Revenue Service is taking up to three times longer to review 2015 tax returns compared to past years.</p>
<p><strong>Julie Magee</strong>, commissioner of <strong>Alabama&#8217;s Department of Revenue, </strong> said much of the delay this year at the state level is likely due to new &#8220;fraud filters&#8221; the states have put in place with <strong>Gentax</strong>, a return processing and auditing system used by about half of U.S. state revenue departments. If the states can&#8217;t outright deny a suspicious refund request, they&#8217;ll very often deny the requested electronic bank deposit and issue a paper check to the taxpayer&#8217;s known address instead.</p>
<p>&#8220;Many states decided they weren&#8217;t going to start paying refunds until March 1, and on our side we&#8217;ve been using all our internal fraud resources and tools to analyze the tax return before we even put it in the queue,&#8221; Magee said. &#8220;That&#8217;s delaying refunds nationwide for the IRS and the states, and it&#8217;s pretty much going to also mean a helluva lot of paper checks are going out this year.&#8221;</p>
<p>The added fraud filters that states are employing take advantage of data elements shared for the first time this tax season by the major online tax preparation firms such as <strong>TurboTax</strong>. The filters look for patterns known to be associated with phony refund requests, such how quickly the return was filed, or whether the same Internet address was seen completing multiple returns.</p>
<p>Magee said some of the states have been adding new fraud filters nearly every time they learn of another big breach involving large numbers of stolen or phished employee W2 data, a huge problem this tax season that is forcing dozens of companies large and small to disclose data breaches over the past few weeks.</p>
<p>&#8220;Every time we turn around getting a phone call about another breach,&#8221; Magee said. &#8220;Because of all the different breaches, the states and the IRS have been taking extreme measures to filter, filter, filter. And each time we&#8217;d get news of an additional breach, we&#8217;d start over, reprogram our fraud filters, and re-assess those returns that were not processed fully yet and those waiting to be processed.&#8221;</p>
<p>Magee said the Gentax software assigns each tax return a score for &#8220;wage confidence&#8221; and &#8220;identity confidence,&#8221; and that usually fraudulent tax refund requests have high wage confidence but low &#8212; if any &#8212; identity confidence. That&#8217;s because the fraudsters are filing refund requests on taxpayers for whom they already have stolen W2 information. The identity confidence in these cases is low often because the fraudsters are asking to have the money electronically deposited into an account that can&#8217;t be directly tied to the taxpayer, or they have incorrectly supplied some of the victim&#8217;s data.</p>
<p>&#8220;I have zero confidence that filings which match this pattern are legitimate,&#8221; Magee said. &#8220;It’s early still, but our new filtering system seems to be working. But it’s still a big unknown about the percentage of fraudulent refunds we&#8217;re not stopping.&#8221;</p>
<h4>MORE W2 PHISHING VICTIMS</h4>
<p><img class="alignright size-full wp-image-30276" src="media/2cd86cff.athook.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/athook.png" alt="athook" width="194" height="375" />Most states didn&#8217;t start processing returns until after March 1, which is exactly when a flood of data breaches related to phished employee W2 data began washing up. As KrebsOnSecurity <a href="http://krebsonsecurity.com/2016/02/phishers-spoof-ceo-request-w2-forms/" target="_blank">first warned in mid-February</a>, thieves have been sending targeted phishing emails to human resources and finance employees at countless organizations, spoofing a message from the CEO requesting all employee W2&#8217;s in PDF format.</p>
<p>In Magee&#8217;s own state, W2 phishers hauled in tax data on an estimated 180 employees of <a href="http://www.isco-pipe.com/home/" target="_blank">ISCO Industries</a> in Huntsville, and some 425 employees at the <a href="http://www.ewtn.com/" target="_blank">EWTN Global Catholic Network</a> in Irondale, Ala. But those are just the ones that have been made public. Magee&#8217;s office only learned of those breaches after employees at the affected organizations reached out to journalists who then wrote about the compromises.</p>
<p>Over the past week, KrebsOnSecurity similarly has heard from employees at a broad range of organizations that appear to have fallen victim to W2 phishing scams, including some 28,000 employees of the market research giant <a href="http://www.kantar.com" target="_blank">Kantar Group</a>; 17,000+ employees of <a href="https://www.sprouts.com/" target="_blank">Sprouts Farmer&#8217;s Market</a>; call center software provider <a href="http://www.aspect.com/" target="_blank">Aspect</a>; computer backup software maker <a href="http://acronis.com" target="_blank">Acronis</a>; <a href="http://kidsdentalkare.com/contact-us/" target="_blank">Kids Dental Kare</a> in Los Angeles; <a href="http://centuryfence.com/" target="_blank">Century Fence</a>, a fencing company in Wisconsin; <a href="http://nlcloans.com" target="_blank">Nation&#8217;s Lending Corporation</a>, a mortgage lending firm in Independent, Ohio; <a href="http://www.qtigroup.com/" target="_blank">QTI Group</a>, a Wisconsin-based human resources consulting company; and the jousting-and-feasting entertainment company <a href="http://www.medievaltimes.com/purchase-tickets/index.html" target="_blank">Medieval Times</a>.<span id="more-34035"></span></p>
<h4>TAX FRAUDSTERS GOING PRO?</h4>
<p>Magee said Alabama and other states are dealing with a huge spike this year in fraudulent refund requests filed via criminals who use online software firms that specialize in selling e-filing services to tax professionals.</p>
<p>According to Magee, crooks first register with the IRS as &#8220;electronic return originators.&#8221; EROs are typically accountants or tax preparation firms authorized by the IRS to prepare and transmit tax returns for people and companies electronically.  Magee said thieves have been registering as EROs and then buying tax preparation software and services from firms like PETZ Enterprises to push through large numbers of phony refund requets.</p>
<p>&#8220;The biggest move [in refund fraud] this year is in the so-called &#8216;professional services applications,&#8217; which are being flagged in high rates this year for fraud,&#8221; Magee said. &#8220;And that’s not just Alabama. A great number of other states are seeing the same thing. We have always had fraud in that area, but we&#8217;re seeing significantly higher rates of fraud there now.&#8221;</p>
<p>Magee said tax software prep firms should be required to conduct more due diligence on their clients.</p>
<p><span class="pullquote pqleft">&#8220;In the state of Alabama, you need a license to cut someone&#8217;s hair, to be a barber or a cosmetologist, but anyone can become a tax preparation professional with no certification at all,&#8221; Magee said.</span> &#8220;The software firms are where all the fraud is going now. The criminal becomes an ERO, and then he can just sit there all day and file an unlimited number of fraudulent returns.&#8221;</p>
<p>PETZ did not respond to requests for comment. But <strong>Stephen Ryan</strong>, a <a href="http://www.opensecrets.org/lobby/lobbyist.php?id=Y0000036206L&amp;year=2015" target="_blank">lobbyist</a> for the industry group <a href="http://www.americancoalitionfortaxpayerrights.org/" target="_blank">American Coalition for Taxpayer Rights</a>, said states are free to regulate tax providers as they see fit.</p>
<p>&#8220;If there are facts that demonstrate there is a problem such as is being alleged about unscrupulous local preparers using professional software they license, the state certainly has the sovereign authority to prosecute or regulate this,&#8221; Ryan said. &#8220;If a specific source of fraud or crimes is being locally committed, that’s a pretty easy enforcement target to focus upon. And in the unlikely case a state doesn’t have that authority, they can seek it from their legislature.&#8221;</p>
<p>Look for additional stories in the coming days as part of a series on tax refund fraud in 2016. Next week, I&#8217;ll take a closer look at how thieves are exploiting know-your-customer weaknesses in the prepaid card industry to launder the proceeds from refund fraud and other schemes.</p>


feed_id: http://krebsonsecurity.com/?p=34447
title: Giant Food Sees Giant Card Fraud Spike
uri: Giant-Food-Sees-Giant-Card-Fraud-Spike
url: http://krebsonsecurity.com/2016/04/giant-food-sees-giant-card-fraud-spike/
content:
<p>Citing a recent and large increase in credit card fraud, Washington, DC-area grocer <strong>Giant Food</strong> says it will no longer allow customers to use credit cards when purchasing gift cards and reloadable or prepaid debit cards.</p>
<div id="attachment_34446" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-34446" src="media/72e70956.aggc-580x388.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/aggc-580x388.png" alt="A new warning sign at Giant Food checkout counters. Giant says the warning was prompted by a spike in credit card fraud." width="580" height="388" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/04/aggc-580x388.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/04/aggc-768x514.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/04/aggc-940x629.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/04/aggc.png 1129w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A new warning sign at Giant Food checkout counters. Giant says the warning was prompted by a spike in credit card fraud.</p></div>
<p>I had no idea this was a new thing at Landover, Md.-based Giant, which operates 169 supermarkets in the Washington, D.C. metro area.  That is, until I encountered a couple of large new &#8220;attention&#8221; stickers in the checkout line at a local Giant in Virginia recently. Next to the credit card terminal were big decals with the warning:</p>
<p>&#8220;Attention Gift Card Customers: Effective immediately, all purchases of Visa, MasterCard, American Express Gift Cards and all General Purpose Reloadable or Prepaid Cards may only be made with Cash or Bank Pin-based Debit.&#8221;</p>
<p>Asked for comment about the change, Giant Food released a brief statement about the policy change that went into effect in March 2016, but otherwise didn&#8217;t respond to requests for more details.</p>
<p>&#8220;Giant has recently made a change in procedures for purchasing gift cards because of a large increase of fraudulent gift card purchasing,&#8221; the company said. &#8220;Giant will now accept only a Bank PIN-based debit card or cash for all VISA, MasterCard, and American Express gift cards, as well as re-loadable and prepaid gift cards. This change has been made in order to mitigate potential fraud risk.&#8221;</p>
<p>It&#8217;s not clear why Giant is only just now taking this basic anti-fraud step. Card thieves love to pick on grocery and convenience stores. Street gangs involved in card fraud (and they&#8217;re <em>all</em> involved in card fraud now) often extract money from grocery, dollar and convenience stores using &#8220;runners&#8221; &#8212; low-level members who are assigned the occasionally risky business of physically &#8220;cashing out&#8221; counterfeit credit and debit cards.</p>
<p>One of the easiest ways thieves can cash out? Walk into a grocery or retail store and buy prepaid gift cards using stolen credit cards. Such transactions &#8212; if successful &#8212; effectively launder money by converting the stolen item (counterfeit/stolen card) into a good that is equivalent to cash or can be easily resold for cash (gift cards).</p>
<p>I witnessed this exact crime firsthand at a Giant in Maryland last year. As I noted in a <a href="http://krebsonsecurity.com/2015/12/the-role-of-phony-returns-in-gift-card-fraud/" target="_blank">Dec. 2015 post</a> about gift card fraud, the crooks caught in the process of these cashout schemes usually are found with dozens of counterfeit credit cards on their person or in their vehicle. From that post:<span id="more-34447"></span></p>
<p>&#8220;The man in front of me in line looked and smelled homeless. The only items he was trying to buy were several $200 gift cards that Giant had on sale for various retailers. When the first card he swiped was declined, the man fished two more cards out of his wallet. Each was similarly declined, but the man just shrugged and walked out of the store. I asked the cashier if this sort of thing happened often, and he just shook his head and said, &#8216;Man, you have no idea.'&#8221;</p>
<p>Meanwhile, every Giant I visit still asks me to swipe my chip-based card, effectively negating any added security the chip provides. Chip-based cards are far more expensive and difficult for thieves to counterfeit, and they can help mitigate the threat from most modern card-skimming methods that read the cardholder data in plain text from the card&#8217;s magnetic stripe. Those include malicious software at the point-of-sale terminal, as well as physical skimmers placed over card readers at self-checkout lanes &#8212; <a href="http://krebsonsecurity.com/2016/02/safeway-self-checkout-skimmer-close-up/" target="_blank">like this one found at a Maryland Safeway earlier this year</a>.</p>
<p>In a recent column &#8211; <a href="http://krebsonsecurity.com/2016/02/the-great-emv-fake-out-no-chip-for-you/" target="_blank">The Great EMV Fake-Out: No Chip for You!</a> &#8211; I explored why so few retailers currently allow or require chip transactions, even though many of them already have all the hardware in place to accept chip transactions. I suspect also that grocers are reluctant to introduce chip readers at self-checkout lanes, as more supermarket chains seem to be pushing customers in the self-checkout direction.</p>


feed_id: http://krebsonsecurity.com/?p=34114
title: SpyEye Makers Get 24 Years in Prison
uri: SpyEye-Makers-Get-24-Years-in-Prison
url: http://krebsonsecurity.com/2016/04/spyeye-makers-get-24-years-in-prison/
content:
<p>Two hackers convicted of making and selling the infamous <a href="http://krebsonsecurity.com/?s=spyeye&amp;x=0&amp;y=0" target="_blank">SpyEye botnet creation kit</a> were sentenced in Georgia today to a combined 24 years in prison for helping to infect hundreds of thousands of computers with malware and stealing millions from unsuspecting victims.</p>
<div id="attachment_24558" style="width: 295px" class="wp-caption alignright"><img class="size-medium wp-image-24558" src="media/6182e424.panin-285x153.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/01/panin-285x153.png" alt="The Justice Department alleges that 24-year-old Aleksander Panin was responsible for SpyEye. Image courtesy: RT." width="285" height="153" srcset="http://krebsonsecurity.com/wp-content/uploads/2014/01/panin-285x153.png 285w, http://krebsonsecurity.com/wp-content/uploads/2014/01/panin-600x322.png 600w, http://krebsonsecurity.com/wp-content/uploads/2014/01/panin.png 804w" sizes="(max-width: 285px) 100vw, 285px" /><p class="wp-caption-text">Aleksander Panin developed and sold SpyEye. Image courtesy: RT.</p></div>
<p><strong>Atlanta Judge Amy Totenberg</strong> handed down a sentence of nine years, six months for <strong>Aleksandr Andreevich Panin</strong>, a 27-year-old Russian national also known by the hacker aliases “Gribodemon” and “Harderman.”</p>
<p>Convicted of conspiracy to commit wire and bank fraud, Panin was the core developer and distributor of SpyEye, a botnet toolkit that made it easy for relatively unsophisticated cyber thieves to steal millions of dollars from victims.</p>
<p>Sentenced to 15 years in jail was Panin&#8217;s business partner &#8212;  27-year-old <strong>Hamza &#8220;Bx1&#8221; Bendelladj</strong>, an Algerian national who pleaded guilty in June 2015 to helping Panin develop and market the SpyEye kit. Bendelladj also admitting to running his own SpyEye botnet of hacked Windows computers, a crime machine that he used to harvest and steal 200,000 credit card numbers. By the government&#8217;s math (an assumed $500 loss per card) Bx1 was potentially responsible for $100 million in losses.</p>
<p>“It is difficult to over state the significance of this case, not only in terms of bringing two prolific computer hackers to justice, but also in disrupting and preventing immeasurable financial losses to individuals and the financial industry around the world,” said <strong>John Horn</strong>, U.S. Attorney for the Northern District of Georgia.</p>
<h4>THE HAPPY HACKER</h4>
<p>Bendelladj was <a href="http://krebsonsecurity.com/2013/01/police-arrest-alleged-zeus-botmaster-bx1/" target="_blank">arrested in Bangkok in January 2013</a> while in transit from Malaysia to Egypt. He quickly became known as the &#8220;happy hacker&#8221; after his arrest, in which he could be seen smiling broadly while in handcuffs and being paraded before the local news media.</p>
<div id="attachment_18371" style="width: 295px" class="wp-caption alignright"><img class="size-medium wp-image-18371" src="media/1ddc4589.bphamza-285x278.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/01/bphamza-285x278.png" alt="Photo: Hamza &quot;BX1&quot; Bendelladj, Bangkok Post" width="285" height="278" srcset="http://krebsonsecurity.com/wp-content/uploads/2013/01/bphamza-285x278.png 285w, http://krebsonsecurity.com/wp-content/uploads/2013/01/bphamza.png 291w" sizes="(max-width: 285px) 100vw, 285px" /><p class="wp-caption-text">Photo: Hamza &#8220;Bx1&#8221; Bendelladj, Bangkok Post</p></div>
<p>In its case against the pair of hackers, the government presented chat logs between Bendelladj and Panin and other hackers. The government says the chat logs reveal that although Bendelladj worked with Panin to fuel the rise of SpyEye by vouching for him on cybercrime forums such as “<a href="http://krebsonsecurity.com/2015/07/the-darkode-cybercrime-forum-up-close/" target="_blank">Darkode</a>,&#8221; the two had an antagonistic relationship.</p>
<p>Their business partnership imploded after Bx1 announced that he was publicly releasing the source code for SpyEye.</p>
<p>&#8220;Indeed, after Bendelladj &#8216;cracked&#8217; SpyEye and made it available to others without having to purchase it from Panin, the two had a falling out,&#8221; reads <a href="media/734ea7cd.bx1-gribboSM.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/bx1-gribboSM.pdf" target="_blank">the government&#8217;s sentencing memo</a> (PDF) to the judge in the case.</p>
<p>The government says that while Bendelladj maintained he was little more than a malware analyzer working for a security company, his own chat logs put the lie to that claim, noting in November 2012 Bx1 bluntly said: “if they pay me the whole money of the world . . . I wont work for security.”</p>
<p>Bx1 had a penchant for marketing to other thieves. He <a href="http://krebsonsecurity.com/2010/04/spyeye-vs-zeus-rivalry/" target="_blank">shrewdly cast SpyEye as a lower-cost, more powerful alternative</a> to the Zeus botnet creation kit, plastering cybercrime forums with animated ads pimping SpyEye as the &#8220;Zeuskiller&#8221; (in part because SpyEye was designed to remove Zeus from host computers before infecting them).</p>
<div id="attachment_34547" style="width: 585px" class="wp-caption aligncenter"><img class="size-full wp-image-34547" src="media/abf5da13.zeuskiller.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/zeuskiller.png" alt="Part of a video ad for SpyEye." width="575" height="79" /><p class="wp-caption-text">Part of a video ad for SpyEye.</p></div>
<p><span id="more-34114"></span>In Oct. 2010, KrebsOnSecurity was the first to report on rumors in the underground that the authors of Zeus and SpyEye were <a href="http://krebsonsecurity.com/2010/10/spyeye-v-zeus-rivalry-ends-in-quiet-merger/" target="_blank">ending their rivalry and merging the two crimeware products into one software stack</a> and support structure for existing clients.</p>
<p>&#8220;Panin developed SpyEye as a successor to the notorious Zeus malware that had, since 2009, wreaked havoc on financial institutions around the world,&#8221; the Justice Department said in its statement today. &#8220;In November 2010, Panin allegedly received the source code and rights to sell Zeus from Evginy Bogachev, a/k/a Slavik, and incorporated many components of Zeus into SpyEye.  Bogachev remains at large and is currently the FBI’s most wanted cybercriminal.&#8221;</p>
<div id="attachment_34554" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-34554" src="media/8f794a9e.bogachev-1-580x297.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/bogachev-1-580x297.png" alt="Bogachev, the alleged Zeus Trojan author, in undated photos." width="580" height="297" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/04/bogachev-1-580x297.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/04/bogachev-1.png 669w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Bogachev, the alleged Zeus Trojan author, in undated photos.</p></div>
<p>It&#8217;s not clear whether Bendelladj had any intention of honoring the sanctity of the merger agreement with <a href="http://krebsonsecurity.com/2015/02/fbi-3m-bounty-for-zeus-trojan-author/" target="_blank">the author of the Zeus Trojan</a>. Not long after the supposed merger, copies of the Zeus source code were available for sale online, and the code went fully public and free not long after that. My money is on Bendelladj for that leak as well.</p>
<p>Apparently Bx1 was not a big fan of KrebsOnSecurity, either. According to the government&#8217;s sentencing memo:</p>
<p>&#8220;At various points, [Bendelladj] has expressed contempt for Brian Krebs, the author of the “Krebs on Security,” and claims that he has credit cards (&#8216;ccs&#8217;) of Mr. Krebs’s family and that Bendelladj will be &#8216;after him until he die.&#8217; He even suggests inflicting a Distributed Denial of Service attack against Mr. Krebs.&#8221;</p>
<p>Maybe that antagonism had something to do with <a href="http://krebsonsecurity.com/2013/01/police-arrest-alleged-zeus-botmaster-bx1/" target="_blank">this story</a>, in which I repost chat logs from a conversation I had with Bx1 back in January 2012. In it, Bx1 brags about hacking one of his competitors and to getting the guy arrested.</p>


