# articles

feed_id: https://krebsonsecurity.com/?p=41365
title: 2nd Breach at Verticalscope Impacts Millions
uri: 2nd-Breach-at-Verticalscope-Impacts-Millions
url: https://krebsonsecurity.com/2017/11/2nd-breach-at-verticalscope-impacts/
content:
<p>For the second time in as many years, hackers have compromised <strong>Verticalscope.com</strong>, a Canadian company that manages hundreds of popular Web discussion forums totaling more than 45 million user accounts. Evidence of the breach was discovered just before someone began using that illicit access as a commercial for a new paid search service that indexes consumer information exposed in corporate data breaches.</p>
<p>Toronto-based Verticalscope runs a network of sites that cater to automotive, pets, sports and technology markets. Verticalscope <a href="https://www.scmagazine.com/leakedsourcecom-finds-45m-leaked-verticalscope-user-records/article/529437/">acknowledged in June 2016</a> that a hacking incident led to the siphoning of 45 million user accounts. Now, it appears the company may have been hit again, this time in a breach involving at least 2.7 million user accounts.</p>
<p>On Thursday, KrebsOnSecurity was contacted by <strong>Alex Holden</strong>, a security researcher and founder of <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>. Holden saw evidence of hackers selling access to Verticalscope.com and to a host of other sites operated by the company.</p>
<p>Holden said at first he suspected someone was merely trying to resell data stolen in the 2016 breach. But that was before he contacted one of the hackers selling the data and was given screen shots indicating that Verticalscope.com and several other properties were in fact compromised with a backdoor known as a &#8220;Web shell.&#8221;</p>
<div id="attachment_41369" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/d6c89d65.vertscope-shell.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/vertscope-shell.png"><img class="wp-image-41369" src="media/d6c89d65.vertscope-shell.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/vertscope-shell.png" alt="" width="599" height="380" /></a><p class="wp-caption-text">A backdoor &#8220;Web shell&#8221; discovered on Verticalscope.com this week.</p></div>
<p>With a Web shell installed on a site, anyone can remotely administer the site, upload and delete content at will, or dump entire databases of information &#8212; such as usernames, passwords, email addresses and Internet addresses associated with each account.</p>
<p>Holden said the intruders obfuscated certain details in the screenshots that gave away exactly where the Web shells were hidden on Verticalscope.com, but that they forgot to blur out a few critical details &#8212; allowing him to locate at least two backdoors on Veriticalscope&#8217;s Web site. He also was able to do the same with a second screen shot the hackers shared which showed a similar backdoor shell on <strong>Toyotanation.com</strong>, one of Verticalscope&#8217;s most-visited forums.</p>
<p>Reached for comment about the claims, Verticalscope said the company had detected an intrusion on six of its Web sites, including Toyotanation.com.</p>
<p>&#8220;The intrusion granted access to each individual website files,&#8221; reads a statement shared Verticalscope. &#8220;Out of an abundance of caution, we have removed the file manager, expired all passwords on the 6 websites in question, added the malicious file pattern and attack vector to our detection tools, and taken additional steps to lock down access.&#8221;</p>
<p>Verticalscope said the other forums impacted included <strong>Jeepforum.com</strong> &#8212; the company&#8217;s second most-popular site; and <strong>watchuseek.com</strong>, a forum for wristwatch enthusiasts.<span id="more-41365"></span></p>
<p>Verticalscope admitted a breach in 2016 after their forum users&#8217; data was <a href="https://web.archive.org/web/20170112160304/https://www.leakedsource.com/blog/verticalscope" target="_blank" rel="noopener">outed in a blog post</a> on <strong>Leakedsource.com</strong>, <a href="https://krebsonsecurity.com/2017/02/who-ran-leakedsource-com/" target="_blank" rel="noopener">a now-defunct service</a> that sold access to username and password details stolen in some of history&#8217;s largest data breaches.</p>
<p>An Internet search on one of the compromised Verticalscope domains leads to a series of now-deleted <strong>Pastebin</strong> posts suggesting that the individual(s) responsible for this hack may be trying to use it to advertise a legally dicey new online service called <strong>LuiDB</strong>.</p>
<p>Similar to Leakedsource, LuiDB allows registered users to search for account details associated with any data element compromised in a breach &#8212; such as login, password, email, first/last name and Internet address. The first search is free, but viewing results requires purchasing a subscription for between $5 and $400 in <strong>Bitcoin</strong>.</p>
<div id="attachment_41373" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/598368f5.luidbpayments.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/luidbpayments.png"><img class="wp-image-41373" src="media/598368f5.luidbpayments.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/luidbpayments.png" alt="" width="600" height="175" /></a><p class="wp-caption-text">The various subscription packages sold by LuiDB, payable in Bitcoin.</p></div>
<p>People who re-use passwords across multiple Web sites tend to be those hardest-hit by these breaches, and by these dodgy password lookup services. It may not seem like a big deal if someone chooses to re-use the same password across a range of sites that don&#8217;t ask for or store your personal data, such as discussion forums. The problem is that this encourages poor password habits, and for many folks this eventually results in using that forum password at more important sites that do store sensitive data.</p>
<p>In practice, there&#8217;s no reason people should ever re-use the same password. Password managers can help users pick and remember unique, strong passwords for all sites that require a login; all the user needs to do is remember a single &#8220;master password&#8221; to unlock all the others. Old schoolers like Yours Truly tend to stick to local password managers like <a href="https://keepass.info/" target="_blank" rel="noopener">Keepass</a> (or even <a href="https://pwsafe.org/" target="_blank" rel="noopener">PwdSafe</a>), although many folks I admire in the security industry rely heavily on cloud-based password managers like <a href="https://www.lastpass.com/" target="_blank" rel="noopener">LastPass</a> and <a href="https://www.dashlane.com" target="_blank" rel="noopener">Dashlane</a>.</p>
<p>While few online discussion forums offer two-factor or multi-factor authentication (requiring you to log in using a password and a one-time code, e.g.), a great many services do offer this very effective security measure. Check out <a href="https://www.twofactorauth.org" target="_blank" rel="noopener">twofactorauth.org</a> to see if there are online services you use that could be furthered hardened by turning on two-factor authentication.</p>


feed_id: https://krebsonsecurity.com/?p=40980
title: Simple Banking Security Tip: Verbal Passwords
uri: Simple-Banking-Security-Tip-Verbal-Passwords
url: https://krebsonsecurity.com/2017/11/simple-banking-security-tip-verbal-passwords/
content:
<p>There was a time when I was content to let my bank authenticate me over the phone by asking for some personal identifiers (SSN/DOB) that are broadly for sale in the cybercrime underground. At some point, however, I decided this wasn&#8217;t acceptable for institutions that held significant chunks of our money, and I began taking our business away from those that wouldn&#8217;t let me add a simple verbal passphrase that needed to be uttered before any account details could be discussed over the phone.</p>
<p><img class="alignright wp-image-41426" src="media/1bfe6194.vpwd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/vpwd.png" alt="" width="288" height="262" />Most financial institutions will let customers add verbal passwords or personal identification numbers (PINs) that are separate from any other PIN or online banking password you might use, although few will advertise this.</p>
<p>Even so, many institutions don&#8217;t properly train their customer support staff (or have high turnover in that department). This can allow clever and insistent crooks to coax customer service reps into validating the call with just the SSN and/or date of birth, or requiring the correct answers to so-called <strong>knowledge-based authentication</strong> (KBA) questions.</p>
<p>As noted in <a href="https://krebsonsecurity.com/?s=kba&amp;x=0&amp;y=0" target="_blank" rel="noopener">several stories here previously</a>, identity thieves can reliably work around KBA because it involves answering  questions about things like previous loans, addresses and co-residents &#8212; information that can often be gleaned from online services or social media.</p>
<p>A few years ago, I began testing financial institutions that held our personal assets. I was pleasantly surprised to discover that most of them were happy to add a PIN or pass phrase to the account. But many of the customer service personnel at those institutions failed in their responses when I called in and said I didn&#8217;t remember the phrase and was there any other way they could verify that I was me?</p>
<p>Ultimately, I ended up moving our investments to an institution that consistently adhered to my requirements. Namely, that failing to provide the pass phrase required an in-person visit to a bank branch to continue the transaction, at which time ID would be requested. Their customer service folks consistently asked the right questions, and weren&#8217;t interested in being much helpful otherwise (I&#8217;m not going to name the institution for obvious reasons).</p>
<p>Not sure whether your financial institution supports verbal passwords? Ask them. If they agree to set one up for you, take a moment or two over the next few days to call in and see if you can get the customer service folks at that institution to talk about your account without hearing that password.<span id="more-40980"></span></p>
<p>While a great many people are willing to trade security for more convenience, it&#8217;s nice when those of us who are paranoid can opt-in for <em>more</em> security. A great, recent example of this is <strong>Google</strong>&#8216;s optional &#8220;advanced protection&#8221; feature, which makes it much harder for password thieves to hack into your <strong>Gmail</strong>, <strong>Drive</strong> or other Google properties &#8212; even if the attackers already know your password.</p>
<p>&#8220;The opt-in, ultra-secure mode is intended for truly high-risk users, including those who face the threat of state-sponsored, highly resourced cyberespionage,&#8221; <a href="https://www.wired.com/story/google-advanced-protection-locks-down-accounts/" target="_blank" rel="noopener">writes</a> <strong>Andy Greenberg</strong> for <em>Wired</em>. &#8220;Think politicians and officials, high net-worth individuals, activists, dissidents, and journalists.&#8221;</p>
<p>Greenberg continues:</p>
<p>&#8220;As such, it&#8217;s a strict and unforgiving system, designed to reinforce every possible weak link that hackers could use to hijack your account. Logging in from a desktop will require a special USB key, while accessing your data from a mobile device will similarly require a Bluetooth dongle. All non-Google services and apps will be exiled from reaching into your Gmail or Google Drive. Google&#8217;s malware scanners will use a more intensive process to quarantine and analyze incoming documents. And if you forget your password, or lose your hardware login keys, you&#8217;ll have to jump through more hoops than ever to regain access, the better to foil any intruders who would abuse that process to circumvent all of Google&#8217;s other safeguards.&#8221;</p>
<p><strong>Gartner</strong> fraud analyst <a href="https://blogs.gartner.com/avivah-litan/" target="_blank" rel="noopener">Avivah Litan</a> says she has long relied on verbal passwords for her most important accounts.</p>
<p>&#8220;I think a verbal password is a good step and definitely adds more security than does KBA built on top of heavily compromised credit bureau and life history data,&#8221; Litan said. Plus it’s free and convenient.  It’s of course not perfect and consumers should try to use verbal passwords that are unique for them and which they don’t use for online passwords —  in case the latter have been compromised by hackers.&#8221;</p>
<p>Verbal passwords should not be confused with voice biometrics, a technology some financial institutions are now adopting that can help authenticate customers while profiling and blocking fraudsters who repeatedly call in to customer service representatives. Even if your institution offers voice biometrics, adding a verbal password/passphrase is still a good idea.</p>
<p><strong>Julie Conroy</strong>, research director at market research firm <strong>Aite Group</strong>, said financial institutions are still very concerned about putting up too many hurdles for good customers, so many are treading lightly on verbal passwords.</p>
<p>&#8220;Many FIs are moving in the direction of not just asking for the password, but also behind the scenes they are performing analysis of the call characteristics as well as the consumer’s voice print,&#8221; Conroy said.</p>
<p>Have you asked your financial institution(s) to add a unique verbal password/passphrase for your most important accounts? If so, sound off about your experience in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=41204
title: DDoS-for-Hire Service Launches Mobile App
uri: DDoS-for-Hire-Service-Launches-Mobile-App
url: https://krebsonsecurity.com/2017/11/ddos-for-hire-service-launches-mobile-app/
content:
<p>In May 2013 KrebsOnSecurity wrote about <strong>Ragebooter</strong>, a service that paying customers can use to launch powerful distributed denial-of-service (DDoS) attacks capable of knocking individuals and Web sites offline. The owner of Ragebooter subsequently was convicted in 2016 of possessing child pornography, but his business somehow lived on while he was in prison. Now just weeks after Poland made probation, a mobile version of the attack-for-hire service has gone up for sale on the <strong>Google Play</strong> store.</p>
<p>In the story <a href="https://krebsonsecurity.com/2013/05/ragebooter-legit-ddos-service-or-fed-backdoor/" target="_blank" rel="noopener">Ragebooter: &#8216;Legit&#8217; DDoS Service, or Fed Backdoor</a>, I profiled then 19-year-old <strong>Justin D. Poland</strong> from Memphis &#8212; who admitted to installing code on his Ragebooter service that allowed FBI investigators to snoop on his customers.</p>
<p>Last February, Poland was convicted of one felony count of possession of child pornography, after investigators reportedly found 2,600 child pornography images on one of his computers. Before his trial was over, Poland skipped town but his bondsman later located him at his mother&#8217;s house. He was sentenced to two years in jail.</p>
<p>Poland did not respond to multiple requests for comment, but <a href="https://www.facebook.com/PRIMALRAGE" target="_blank" rel="noopener">on his Facebook account</a> Poland said the images belonged to his former roommate &#8212; <strong>David Starliper</strong> &#8212; who&#8217;d allegedly used Poland&#8217;s computer. Starliper also was convicted of possessing child pornography and sentenced to two years in prison.</p>
<p>In September 2017, Poland began posting on his Facebook account that he had made parole and was getting ready to be released from prison. On Oct. 6, the first version of the Android edition of Ragebooter was <a href="https://play.google.com/store/apps/details?id=com.wRageBooterDDoSStressTestingTool_5756676" target="_blank" rel="noopener">put on sale at Google&#8217;s Play Store</a>.</p>
<div id="attachment_41469" style="width: 603px" class="wp-caption aligncenter"><img class="wp-image-41469 " src="media/421ded81.ragebooterplaystore.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/ragebooterplaystore.png" alt="" width="593" height="521" /><p class="wp-caption-text">The mobile version of Ragebooter.</p></div>
<p>Poland&#8217;s Facebook page says he is the owner of ragebooter[dot]com, ragebooter[dot]net, and another site called vmdeploy[net]. The advertisement for Ragebooter&#8217;s new mobile app on Google Play says the developer&#8217;s email address is <strong>contact@rageservices[dot]net</strong>. The registration details for rageservices[dot]net are hidden, but the Web site lists some useful contact details.</p>
<p>One of them is a phone number registered in Memphis &#8212; 901-219-3644 &#8212; that is tied to <a href="https://www.facebook.com/profile.php?id=100012337922494" target="_blank" rel="noopener">a Facebook account</a> for an <strong>Alex Slovak</strong> in Memphis. The other domain Poland mentions on his Facebook page &#8212; vmdeploy[dot]net &#8212; was registered to an <strong>Alex Czech</strong> from Memphis. It seems likely that Alex has been running Ragebooter while Poland was in prison. Mr. Slovak/Czech did not respond to requests for comment, but it is clear from his Facebook page that he is friends with Poland&#8217;s family.<span id="more-41204"></span></p>
<p>Rageservices[dot]net advertises itself as a store for custom programming and Web site development. Its content is identical to a site called <a href="http://52.15.210.163/index.php" target="_blank" rel="noopener">QuantumServices.</a> A small purchase through the rageservices[dot]net site for a simple program generated a response from Quantum Services and an email from quantumservicesweb@gmail.com. The person responding at that email address declined to give his or her name, but said they were not Justin Poland.</p>
<p>Figures posted to the home page of ragebooter[dot]net claim the service has been used to conduct more than 310,000 DDoS attacks. Memberships are sold in packages ranging from $3 per day to $300 a year for an &#8220;enterprise&#8221; plan. Ragebooter[dot]net includes a notice at the top of the site indicating that rageservices[dot]net is indeed affiliated with Ragebooter.</p>
<p>If Poland still is running Ragebooter, he may well be violating the terms of his parole. According to the <strong>FBI</strong>, the use of DDoS-for-hire services like Ragebooter is illegal.</p>
<p>In October the FBI released <a href="https://www.ic3.gov/media/2017/171017-2.aspx" target="_blank" rel="noopener">an advisory</a> warning that the use of booter services &#8212; also called &#8220;stressers&#8221; &#8212; is punishable under the <a href="https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act" target="_blank" rel="noopener">Computer Fraud and Abuse Act</a>, and may result in arrest and criminal prosecution.</p>
<p>&#8220;Booter and stresser services are a form of DDoS-for-hire&#8212; advertised in forum communications and available on Dark Web marketplaces&#8212; offering malicious actors the ability to anonymously attack any Internet-connected target. These services are obtained through a monetary transaction, usually in the form of online payment services and virtual currency. Criminal actors running booter and stresser services sell access to DDoS botnets, a network of malware-infected computers exploited to make a victim server or network resource unavailable by overloading the device with massive amounts of fake or illegitimate traffic.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=41451
title: Hack of Attack-for-Hire Service vDOS Snares New Mexico Man
uri: Hack-of-Attack-for-Hire-Service-vDOS-Snares-New-Mexico-Man
url: https://krebsonsecurity.com/2017/11/hack-of-attack-for-hire-service-vdos-snares-new-mexico-man/
content:
<p>A New Mexico man is facing federal hacking charges for allegedly using the now defunct attack-for-hire service <a href="https://krebsonsecurity.com/?s=vdos&amp;x=0&amp;y=0" target="_blank" rel="noopener">vDOS</a> to launch damaging digital assaults aimed at knocking his former employer&#8217;s Web site offline. Prosecutors were able to bring the case in part because vDOS got massively hacked last year, and its customer database of payments and targets leaked to this author and to the FBI.</p>
<p>Prosecutors in Minnesota have charged <strong>John Kelsey Gammell</strong>, 46, with using vDOS and other online attack services to hurl a year&#8217;s worth of attack traffic at the Web sites associated with<strong> Washburn Computer Group</strong>, a Minnesota-based company where Gammell used to work.</p>
<div id="attachment_36386" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36386" src="media/e9619cf7.vdosloggedin-580x405.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/09/vdosloggedin-580x405.png" alt="" width="580" height="405" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/09/vdosloggedin-580x405.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/09/vdosloggedin-768x536.png 768w, https://krebsonsecurity.com/wp-content/uploads/2016/09/vdosloggedin.png 877w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">vDOS as it existed on Sept. 8, 2016.</p></div>
<p>vDOS existed for nearly four years, and was known as one of the most powerful and effective pay-to-play tools for launching distributed denial-of-service (DDoS) attacks. The vDOS owners used a variety of methods to power their service, including at least one massive botnet consisting of tens of thousands of hacking Internet of Things (IoT) devices, such compromised Internet routers and security cameras. vDOS also was used in numerous DDoS attacks against this site.</p>
<p>Investigators allege that although Gammell used various methods to hide his identity, email addresses traced back to him were found in the hacked user and target databases from vDOS.</p>
<p>More importantly, prosecutors say, someone began taunting Washburn via Yahoo and Gmail messages while the attacks were underway, asking how everything was going at the company and whether the IT department needed any help.</p>
<p>&#8220;Also attached to this second email was an image of a mouse laughing,&#8221; the Justice Department <a href="media/e3a62e8c.gov.uscourts.mnd.165131.1.0.pdf" data-original-source="http://ia800808.us.archive.org/30/items/gov.uscourts.mnd.165131/gov.uscourts.mnd.165131.1.0.pdf" target="_blank" rel="noopener">indictment</a> (PDF) alleges. &#8220;Grand jury subpoenas for subscriber information were subsequently served on Google&#8230;and Yahoo. Analysis of the results showed information connecting both accounts to an individual named John Gammell. Both email addresses were created using the cell phone number 612-205-8609.&#8221;</p>
<p>The complaint notes that the government subpoenaed AT&amp;T for subscriber information and traced that back to Gammell as well, but phone number also is currently listed as the recovery number for a Facebook account tied to John K. Gammell.</p>
<p>That Facebook account features numerous references to the hacker collective known as Anonymous. This is notable because according to the government Gammell used two different accounts at vDOS: One named &#8220;AnonCunnilingus&#8221; and another called &#8220;anonrooster.&#8221; The email addresses this user supplied when signing up at vDOS (jkgammell@gmail.com and jkgammell@icloud.com) include other addresses quite clearly tied to multiple accounts for John K. Gammell.</p>
<div id="attachment_41484" style="width: 608px" class="wp-caption aligncenter"><img class=" wp-image-41484" src="media/274246fb.jkg.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/jkg.png" alt="" width="598" height="333" /><p class="wp-caption-text">John K. Gammell&#8217;s Facebook account.</p></div>
<p>Below is a snippet from a customer service ticket that the AnonCunnilingus account filed in Aug. 2015</p>
<blockquote><p>&#8220;Dear Colleagues, this is Mr. Cunnilingus. You underestimate your capabilities. Contrary to your statement of &#8220;Notice!&#8221; It appears from our review that you are trying to stress test a DDoS protected host, vDOS stresser is not capable of taking DDoS protected hosts down which means you will not be able to drop this hosting using vDOS stresser&#8230;As they do not have my consent to use my internet, after their site being down for two days, they changed their IP and used rackspace DDoS mitigation and must now be removed from cyberspace. Verified by downbyeveryone. We will do much business. Thank you for your outstanding product <img src="media/180db26c.1f642.png" data-original-source="https://s.w.org/images/core/emoji/2.3/72x72/1f642.png" alt="🙂" class="wp-smiley" style="height: 1em; max-height: 1em;" /> We Are Anonymous USA.&#8221;</p></blockquote>
<p>Gammell has pleaded not guilty to the charges. He has not responded to requests for comment. The indictment states that Gammell allegedly attacked at least a half-dozen other companies over a year-long period between mid-2015 and July 2016, including several banks and two other companies at which he either previously worked or with whom he&#8217;d interviewed for a job.<span id="more-41451"></span></p>
<p>In late July 2016, an anonymous security researcher reached out to KrebsOnSecurity <a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank" rel="noopener">to share a copy of the vDOS databases</a>. The databases showed that vDOS made more than $600,000 in just two of the four years it was in operation, helping to launch more than 150,000 DDoS attacks.</p>
<p>Since then, two alleged co-owners of vDOS &#8212; two 19-year-old Israeli men &#8212;  <a href="https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/" target="_blank" rel="noopener">have been arrested</a> and charged with operating an attack-for-hire service. Aside from Gammell&#8217;s case, I am not aware of any other public cases involving the prosecution of people who allegedly used vDOS to conduct attacks.</p>
<p>But that will hopefully change soon, as there are countless clues about the identities of other high-volume vDOS users and their targets. Identifying the perpetrators in those cases should not be difficult because at some point vDOS stopped allowing users to log in to the service using a VPN, meaning many users likely logged into vDOS using an Internet address that can be traced back to them either via a home Internet or wireless account.</p>
<p>According to a review of the vDOS database, both accounts allegedly tied to Gammell were banned by vDOS administrators &#8212; either because he shared his vDOS username and password with another person, or because he logged on to the accounts with a VPN. Here&#8217;s a copy of a notice vDOS sent to AnonCunnilingus on July 28, 2015:</p>
<blockquote><p>&#8220;Dear AnonCunnilingus , We have recently reviewed your account activity, and determined that you are in violation of vDos&#8217;s Terms of Service, It appears from our review that you have shared your account (or accessed vDos stresser from several locations and platforms) which is against our Terms of Services. Please refer to the following logs and terms:\n- AnonCunnilingus logged in using the following IPs: 64.145.76.110 (US), 85.10.210.199 (XX) date: 06-08-2015 18:05\n\n- 8) <em>You are not allowed to access vDos stresser using a VPN/VPS/Proxy/RDP/Server Tunnelling and such</em>.\n- 3) You may not share your account, if you will, your account will be closed without a warning or a refund!&#8221;</p></blockquote>
<p>What&#8217;s most likely limiting prosecutors from pursuing more vDOS users is a lack of DDoS victims coming forward. In <a href="https://www.ic3.gov/media/2017/171017-2.aspx" target="_blank" rel="noopener">an advisory</a> issued last month, the FBI urged DDoS victims to report the attacks.</p>
<p>The FBI requests DDoS victims contact their local FBI field office and/or file a complaint with the Internet Crime Complaint Center (IC3), regardless of dollar loss or timing of incident. Field office contacts can be identified at <a href="https://www.ic3.gov/media/2017/www.fbi.gov/contact-us/field" rel="ext" data-ss1510331619="1">www.fbi.gov/contact-us/field</a>. IC3 complaints should be filed at <a href="https://www.ic3.gov/" rel="pop" data-ss1510331619="1">www.ic3.gov</a>with the following details (if applicable):</p>
<ul>
<li>Traffic protocol used by the DDoS (DNS, NTP, SYN flood, etc)
<ul>
<li>Attempt to preserve netflow and/or packet capture of the attack</li>
</ul>
</li>
<li>Any extortion/threats pertaining to the DDoS attack
<ul>
<li>Save any such correspondence in its original, unforwarded format</li>
</ul>
</li>
<li>Victim information</li>
<li>Overall losses associated with the DDoS attack</li>
<li>If a ransom associated with the attack was paid, provide transaction details, the subject’s email address, and/or crypto currency wallet address</li>
<li>Victim impact statement (e.g., impacted services/operations)</li>
<li>IP addresses used in the DDoS attack</li>
</ul>
<p>Related reading:</p>
<p><a href="https://krebsonsecurity.com/2013/08/how-not-to-ddos-your-former-employer/" rel="noopener" target="_blank">How Not to DDoS Your Former Employer</a></p>


feed_id: https://krebsonsecurity.com/?p=41495
title: How to Opt Out of Equifax Revealing Your Salary History
uri: How-to-Opt-Out-of-Equifax-Revealing-Your-Salary-History
url: https://krebsonsecurity.com/2017/11/how-to-opt-out-of-equifax-revealing-your-salary-history/
content:
<p>A KrebsOnSecurity <a href="https://krebsonsecurity.com/?s=talx&amp;x=0&amp;y=0" target="_blank" rel="noopener">series</a> on how easy big-three credit bureau <strong>Equifax</strong> makes it to get detailed salary history data on tens of millions of Americans apparently inspired a deeper dive on the subject by <em>Fast Company</em>, which examined how this Equifax division has been one of the company&#8217;s best investments. In this post, I&#8217;ll show you how to opt out of yet another Equifax service that makes money at the expense of your privacy.</p>
<p><img class="aligncenter size-medium wp-image-40776" src="media/5d917713.equifax-hq-580x384.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/09/equifax-hq-580x384.png" alt="" width="580" height="384" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/09/equifax-hq-580x384.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/09/equifax-hq-768x509.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/09/equifax-hq.png 770w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>My <a href="https://krebsonsecurity.com/2017/10/equifax-breach-fallout-your-salary-history/" target="_blank" rel="noopener">original report</a> showed how the salary history for tens of millions of employees at some of the world&#8217;s largest corporations was available to anyone armed with an employee&#8217;s Social Security number and date of birth &#8212; information that was stolen on 145.5 million Americans in the recent breach at Equifax.</p>
<p>Equifax took down their salary portal &#8212; a service from the company&#8217;s <strong>Workforce Solutions</strong> division known as <strong>The Work Number</strong> (formerly &#8220;<strong>TALX</strong>&#8220;) &#8212; just a few hours after my story went live on Oct. 8. The company explained that the site was being disabled for routine maintenance, but Equifax <a href="https://krebsonsecurity.com/2017/11/equifax-reopens-salary-lookup-service/">didn&#8217;t fully reopen the portal until Nov. 2</a>, following the addition of unspecified &#8220;security improvements.&#8221;</p>
<p><em>Fast Company</em> writer <a href="https://www.fastcompany.com/40485634/equifax-salary-data-and-the-work-number-database" target="_blank" rel="noopener">Joel Winston&#8217;s story</a> examines how some 70,000 companies &#8212; including <strong>Amazon</strong>, <strong>AT&amp;T</strong>, <strong>Facebook</strong>, <strong>Microsoft</strong>, <strong>Oracle</strong>, <strong>Twitter</strong> and <strong>Wal-Mart</strong> &#8212; actually pay Equifax to collect, organize, and re-sell their employees’ personal income information and work history.</p>
<p>&#8220;A typical employee at Facebook (which also owns Instagram and WhatsApp) may require verification of his employment through TALX when he leases an apartment, updates his immigration status, applies for a loan or public aid, or applies for a new job,&#8221; Winston writes. &#8220;If his new prospective employer is among the 70,000 approved entities in Equifax’s verifier network with a “permissible purpose,” that company can purchase his employment and income information for about $20.&#8221;</p>
<p>While this may sound like a nice and legitimate use of salary data, the point of my original report was that this salary data is also available to anyone who has the Social Security number and date of birth on virtually any person who once worked at a company that uses this Equifax service.</p>
<p>In May 2017, KrebsOnSecurity <a href="https://krebsonsecurity.com/2017/05/fraudsters-exploited-lax-security-at-equifaxs-talx-payroll-division/" target="_blank" rel="noopener">broke the story</a> of how this same Equifax Workforce portal was abused for an entire year by identity thieves involved in tax refund fraud with the <strong>Internal Revenue Service</strong>. Fraudsters used SSN and DOB data to reset the 4-digit PINs given to customer employees as a password, and then steal W-2 tax data after successfully answering personal questions about those employees.</p>
<p>Curiously, Equifax claims they have no evidence that anyone was harmed as a result of the year-long pattern of tax fraud related to how easy it was to coax salary and payroll data out of its systems.</p>
<p>“We do not know of any specific fraud incidents linked with the Work Number,” Equifax spokeswoman <strong>Marisa Salcines</strong> told <em>Fast Company</em>.</p>
<p>This statement sounds suspiciously like what big-three credit bureau <strong>Experian</strong> <a href="https://krebsonsecurity.com/2014/03/experian-lapse-allowed-id-theft-service-to-access-200-million-consumer-records/" target="_blank" rel="noopener">told lawmakers in 2014 after they were hauled up to Capitol Hill</a> to explain another breach that was scooped by KrebsOnSecurity: That <a href="https://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/" target="_blank" rel="noopener">a Vietnamese man who ran an identity theft service</a> which catered to tax refund fraudsters <a href="http://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/" target="_blank" rel="noopener">had access for nine months to more than 200 million consumer records maintained by Experian</a>.</p>
<p>Experian&#8217;s suits told lawmakers that no consumers were harmed even as the <strong>U.S. Secret Service</strong> was busy <a href="https://krebsonsecurity.com/2014/04/an-allegation-of-harm/" target="_blank" rel="noopener">arresting customers</a> of this identity theft service &#8212; nearly all of whom were involved in tax refund fraud and <a href="https://krebsonsecurity.com/2014/05/experian-breach-tied-to-ny-nj-id-theft-ring/" target="_blank" rel="noopener">other forms of consumer ID theft</a>.<span id="more-41495"></span></p>
<p>Loyal readers here will know I have long urged consumers to opt out of letting the big credit bureaus resell your credit file to potential lenders (and, by proxy, to ID thieves), by <a href="https://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank" rel="noopener">placing a freeze on their credit files</a> with the Equifax, Experian, <strong>Trans Union</strong> and <strong>Innovis</strong>.</p>
<p>In the wake of the Equifax breach, one thing I&#8217;ve heard from so many readers that was a big factor in their decision to finally freeze their credit was that the bureaus would no longer be able to profit by selling their credit files.</p>
<p>As it happens, it is possible to opt out of having your salary data sold through Equifax. According to Equifax, this involves placing a free &#8220;freeze&#8221; on your file with the Work Number. These instructions on how to do that come verbatim from Equifax:</p>
<p>To place a security freeze on your The Work Number employment report, send<br />
your request via mail to:</p>
<p>TALX Corporation<br />
ATTN: Employment Data Report Dept 19-10<br />
11432 Lackland Road<br />
St. Louis, Missouri 63146</p>
<p>Or, you may contact us on the web at http://www.theworknumber.com or call 800-996-7566.</p>
<p>It&#8217;s not clear what may be the potential consequences of freezing your file with The Work Number. Fast Company explains the service and its giant database &#8220;helps streamline various processes for employers and other agencies, and it helps employees too, Equifax wrote in an emailed statement. The Work Number provides prospective landlords a way to verify an applicant’s income, for instance, or makes it cheaper for human resources departments to examine an applicant’s background.&#8221;</p>
<p>Here&#8217;s Equifax explaining why consumers might want to leave their files alone:</p>
<blockquote>
<p dir="ltr">“Without the Work Number, a lender, property manager or pre-employment screener will call an employer and explain why they need to check on an employee or former employee’s employment or income. That individual has no control over who picks up the phone, whether the right information is actually given out, or if his or her privacy will be respected.”</p>
</blockquote>
<p>Neither does the consumer have any control over to whom Equifax gives this data. I for one am taking my chances and freezing my salary data at Equifax. I&#8217;ll let you know how it goes.</p>
<p dir="ltr">Before you opt out, you may wish to see which lenders, credit agencies and other entities may have received or attempted to pull your Work Number salary history.</p>
<p dir="ltr">To request a free Employment Data Report, you&#8217;ll need to fill out a form at <a href="http://www.theworknumber.com/Employees/DataReport/index.asp" rel="noreferrer" data-ss1510584801="1">the Work Number website,</a> or <a href="media/0e345b66.report_request.pdf" data-original-source="http://www.theworknumber.com/Employees/DataReport/report_request.pdf" target="_blank" rel="noopener">make a request</a> by mail, or through a toll-free phone number (1-866-222-5880).</p>


feed_id: https://krebsonsecurity.com/?p=41522
title: Adobe, Microsoft Patch Critical Cracks
uri: Adobe-Microsoft-Patch-Critical-Cracks
url: https://krebsonsecurity.com/2017/11/adobe-microsoft-patch-critical-cracks/
content:
<p>It&#8217;s Nov. 14 &#8212; the second Tuesday of the month (a.k.a. &#8220;Patch Tuesday) &#8212; and <strong>Adobe</strong> and <strong>Microsoft</strong> have issued gobs of security updates for their software. Microsoft&#8217;s 11 patch bundles fix more than four-dozen security holes in various <strong>Windows</strong> versions and <strong>Office</strong> products &#8212; including at least four serious flaws that were publicly disclosed prior to today. Meanwhile, Adobe&#8217;s got security updates available for a slew of titles, including <strong>Flash Player</strong>, <strong>Photoshop</strong>, <strong>Reader</strong> and <strong>Shockwave</strong>.</p>
<p><a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11848" target="_blank" rel="noopener"><img class="alignright wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="203" height="213" />Four</a> <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11848" target="_blank" rel="noopener">of</a> <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11883" target="_blank" rel="noopener">the</a> <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8700" target="_blank" rel="noopener">vulnerabilities</a> Microsoft fixed today have public exploits, but they do not appear to be used in any active malware campaigns, according to <strong>Gill Langston</strong> at security vendor <strong>Qualys</strong>. Perhaps the two most serious flaws likely to impact Windows end users involve vulnerabilities in Microsoft browsers <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11848" target="_blank" rel="noopener">Internet Explorer</a> and <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11827" target="_blank" rel="noopener">Edge</a>.</p>
<p>Qualys&#8217; Langston reminds us that on <a href="https://blog.qualys.com/laws-of-vulnerabilities/2017/10/10/october-patch-tuesday-28-critical-microsoft-vulnerabilities" data-ss1510698840="1">last Patch Tuesday</a>, Microsoft quietly released the fix for <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-13080" rel="noreferrer" data-ss1510698840="1">CVE-2017-13080</a>, widely known as <a href="https://krebsonsecurity.com/2017/10/what-you-should-know-about-the-krack-wifi-security-weakness/" target="_blank" rel="noopener">the KRACK vulnerability in WPA2 wireless protocol,</a> but did not make it known until a week later, when the vulnerability was publicly disclosed. Check out the <a href="https://blog.qualys.com/laws-of-vulnerabilities/2017/11/14/november-patch-tuesday-53-vulnerabilities-and-a-massive-adobe-update" target="_blank" rel="noopener">Qualys blog</a> and <a href="https://www.ivanti.com/blog/patch-tuesday-forecast-november/" target="_blank" rel="noopener">this post</a> from <strong>Ivanti</strong> for more on this month&#8217;s patches from Redmond. Otherwise, visit <strong>Windows Update</strong> sometime soon (click the <b>Start/Windows</b> button, then type <b>Windows Update</b>).<span id="more-41522"></span></p>
<p>Adobe issued patches to fix at least <a href="https://helpx.adobe.com/security/products/flash-player/apsb17-33.html" target="_blank" rel="noopener">62 security vulnerabilities in its products</a>, including several critical bugs in Adobe Flash Player and Reader/Acrobat.  The <a href="https://helpx.adobe.com/security/products/flash-player/apsb17-33.html" target="_blank" rel="noopener">Flash Player update</a> brings the browser plugin to <em>v. 27.0.0.187</em> on Windows, Mac, Linux and Chrome OS.</p>
<p>Windows users who browse the Web with anything other than Internet Explorer may need to apply the Flash patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>
<p><img class="alignleft size-full wp-image-18875" src="media/18bb50f1.brokenflash-a.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="" width="211" height="180" />Chrome and IE should auto-install the latest Flash version on browser restart (users may need to manually check for updates and/or restart the browser to get the latest Flash version). Chrome users may need to restart the browser to install or automatically download the latest version.</p>
<p>When in doubt, click the vertical three dot icon to the right of the URL bar, select “Help,” then “About Chrome”: If there is an update available, Chrome should install it then. Chrome will replace that three dot icon with an up-arrow inside of a circle when updates are waiting to be installed.</p>
<p>Standard disclaimer: Because Flash remains such a security risk, I continue to encourage readers to remove or hobble Flash Player unless and until it is needed for a specific site or purpose. More on that approach (as well as slightly less radical solutions ) can be found in <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank" rel="noopener">A Month Without Adobe Flash Player</a>. The short version is that you can probably get by without Flash installed and not miss it at all.</p>
<p>For readers still unwilling to cut the cord, there are half-measures that work almost as well. Fortunately, <a href="https://support.google.com/chrome/answer/108086?hl=en" target="_blank" rel="noopener">disabling Flash in Chrome</a> is simple enough. Paste “<a href="chrome://settings/content" target="_blank" rel="noopener">chrome://settings/content</a>” into a Chrome browser bar and then select “Flash” from the list of items. By default it should be set to “Ask first” before running Flash, although users also can disable Flash entirely here or whitelist and blacklist specific sites.</p>
<p>Another, perhaps less elegant, solution is to keep Flash installed in a browser that you don’t normally use, and then to only use that browser on sites that require it.</p>


feed_id: https://krebsonsecurity.com/?p=41516
title: R.I.P. root9B? We Hardly Knew Ya!
uri: R-I-P-root9B-We-Hardly-Knew-Ya
url: https://krebsonsecurity.com/2017/11/r-i-p-root9b-we-hardly-knew-ya/
content:
<p><strong>root9B Holdings</strong>, a company that many in the security industry consider little more than a big-name startup aimed at cashing in on the stock market&#8217;s insatiable appetite for cybersecurity firms, surprised no one this week when it announced it was ceasing operations at the end of the year.</p>
<p><img class="aligncenter wp-image-41567" src="media/0eb7a3b6.greatpress.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/greatpress.png" alt="" width="500" height="392" /></p>
<p>Founded in 2011 as <strong>root9B Technologies</strong>,<strong> </strong>the company touted itself as an IT security training firm staffed by an impressive list of ex-military leaders with many years of cybersecurity experience at the <strong>Department of Defense</strong> and <strong>National Security Agency</strong> (NSA). As it began to attract more attention from investors, root9B&#8217;s focus shifted to helping organizations hunt for cyber intruders within their networks.</p>
<p>By 2015, root9B was announcing lucrative cybersecurity contracts with government agencies and <a href="https://www.prnewswire.com/news-releases/root9b-technologies-acquires-ipsa-international-also-announces-73-million-investment-from-a-leading-financial-institution-300033448.html" target="_blank" rel="noopener">the infusion of millions from investors</a>. The company&#8217;s stock was ballooning in price, reaching an all-time high in mid-May 2015.</p>
<p>That was just days after root9B issued <a href="https://www.prnewswire.com/news-releases/root9b-uncovers-planned-sofacy-cyber-attack-targeting-several-international-and-domestic-financial-institutions-300081634.html" target="_blank" rel="noopener">a headline-grabbing report</a> about how its cyber intelligence had single-handedly derailed a planned Russian cyber attack on several U.S. financial institutions.</p>
<p>The report, released May 12, 2015, claimed root9B had uncovered plans by an infamous Russian hacking group to target several banks. The company said the thwarted operation was orchestrated by <a href="https://en.wikipedia.org/wiki/Fancy_Bear" target="_blank" rel="noopener">Fancy Bear/Sofacy</a>, a so-called &#8220;advanced persistent threat&#8221; (APT) hacking group known for launching sophisticated phishing attacks aimed at infiltrating some of the world&#8217;s biggest corporations.  root9B released its Q1 2015 earnings two days later, reporting record revenues.</p>
<p>On May 20, 2015, KrebsOnSecurity published a rather visceral dissection of that root9B report: <a href="https://krebsonsecurity.com/2015/05/security-firm-redefines-apt-african-phishing-threat/" target="_blank" rel="noopener">Security Firm Redefines APT; African Phishing Threat</a>. The story highlighted the thinness of the report&#8217;s claims, pointing to multiple contradictory findings by other security firms which suggested the company had merely detected several new phishing domains being erected by a comparatively low-skilled African phishing gang that was well-known to investigators and U.S. banks.</p>
<p>In mid-June 2015, an anonymous researcher who&#8217;d apparently done a rather detailed investigation into root9B&#8217;s finances said the company was &#8220;a worthless reverse-merger created by insiders with [a] long history of penny-stock wipeouts, fraud allegations, and disaster.&#8221;</p>
<p><a href="https://seekingalpha.com/article/3258735-root9-minus-82_5-percent-downside-on-management-fraud-allegations-cyber-failure-and-bankruptcy-strong-sell" target="_blank" rel="noopener">That report</a>, published by the crowd-sourced financial market research site <strong>SeekingAlpha.com</strong>, sought to debunk claims by root9B that it possessed &#8220;proprietary&#8221; cybersecurity hardware and software, noting that the company mainly acts as a reseller of a training module produced by a third party.</p>
<p>root9B&#8217;s stock price never recovered from those reports, and began a slow but steady decline after mid-2015. In Dec. 2016, root9B Technologies announced a reverse split of its issued and outstanding common stock, saying it would be moving to the <strong>NASDAQ</strong> market with the trading symbol <strong>RTNB</strong> and a new name &#8212; <strong>root9B Holdings</strong>. On January 18, 2017, a reshuffled root9B <a href="https://www.root9b.com/newsroom/root9b-holdings-inc-nasdaq-rtnb-ring-nasdaq-stock-market-opening-bell" target="_blank" rel="noopener">rang the market opening bell</a> at NASDAQ, and got a bounce when it said it&#8217;d been awarded a five-year training contract to support the U.S. Defense Department.<span id="more-41516"></span></p>
<p>The company&#8217;s founders remained upbeat even into mid-2017. On June 6, 2017 it announced that <strong>Michael Hayden</strong>, the four-star general who until recently served as director of the <strong>U.S. National Security Agency</strong>, had <a href="https://www.root9b.com/newsroom/general-michael-hayden-joins-root9b-advisory-board" target="_blank" rel="noopener">joined the company&#8217;s board</a>.</p>
<p>On June 23, 2017, root9B <a href="https://www.prnewswire.com/news-releases/root9b-remains-1-on-cybersecurity-500-for-6th-consecutive-quarter-300478860.html" target="_blank" rel="noopener">issued a press release</a> reminding everyone that the company had remained #1 on the Cybersecurity 500 for the 6th consecutive quarter. The Cybersecurity 500, by the way, rates cybersecurity firms based on their &#8220;<a href="https://www.root9b.com/newsroom/top-five-names-cybersecurity" target="_blank" rel="noopener">branding and marketing</a>.&#8221;</p>
<p>Nobody ever accused root9B of bad marketing. But all the press releases in the world couldn&#8217;t hide the fact that the company had never turned a profit. It <a href="https://www.prnewswire.com/news-releases/root9b-holdings-announces-2016-financial-results-300440663.html" target="_blank" rel="noopener">lost more than $18.3 million in 2016</a>, more than doubling a $8.03 million loss in 2015.</p>
<p>Since August 2017, shares of the company&#8217;s stock have fallen more than 90 percent. On Sept. 28, 2017, all of root9B Holdings&#8217; assets <a href="https://www.root9b.com/newsroom/root9b-llc-acquired-tracker-capital-management" target="_blank" rel="noopener">were acquired</a> by venture investment firm <strong>Tracker Capital Management LLC</strong>, and then sold at auction.</p>
<p>On Nov. 13, root9B Holdings issued <a href="https://www.prnewswire.com/news-releases/root9b-holdings-announces-discontinuation-of-operations-300555071.html" target="_blank" rel="noopener">a press release</a> saying NASDAQ was de-listing the firm on Nov. 15 and that it was ceasing operations at the end of this year.</p>
<p>&#8220;With the absence of any operating assets remaining after the Foreclosure, the Company will cease any and all operations effective, December 31, 2017,&#8221; the (final?) root9B press release concludes.</p>
<p>Several followers on Twitter say it&#8217;s too soon to sound the death knell for root9B as a whole, pointing out that while root9B Holdings may have been gutted and sold, for now it appears the security company root9B LLC is intact and is merely going back to being a private concern.</p>
<p>In any case, the demise of root9B Holdings resonates loudly with that of <strong>Norse Corp.,</strong> another <a href="https://krebsonsecurity.com/2016/01/sources-security-firm-norse-corp-imploding/" target="_blank" rel="noopener">flashy, imploded cybersecurity startup</a> that banked heavily on attracting and touting top talent, while managing to produce very little that was useful to or actionable by anybody.</p>
<p>Companies like these are a reminder that your success or failure in business as in life is directly tied to what you produce &#8212; not what you promise or represent. There is no shortcut to knowledge, success or mastery, and this goes for infosec students as well as active practitioners of the craft. Focus on consistently producing quality, unique content and/or services that are of real value to others, and the rest will take care of itself.</p>
<p>Update, 10:30 a.m.: Added perspective from Twitter readers.</p>


feed_id: https://krebsonsecurity.com/?p=41582
title: Fund Targets Victims Scammed Via Western Union
uri: Fund-Targets-Victims-Scammed-Via-Western-Union
url: https://krebsonsecurity.com/2017/11/fund-targets-victims-scammed-via-western-union/
content:
<p>If you, a friend or loved one lost money in a scam involving <strong>Western Union</strong>, some or all of those funds may be recoverable thanks to a more than half-billion dollar program set up by the <strong>U.S. Federal Trade Commission</strong>.</p>
<p>In January 2017, Englewood, Colo.-based Western Union <a href="https://www.ftc.gov/news-events/press-releases/2017/01/western-union-admits-anti-money-laundering-violations-settles" target="_blank" rel="noopener">settled a case</a> with the FTC and the <strong>Department of Justice</strong> wherein it admitted to multiple criminal violations, including willfully failing to maintain an effective anti-money laundering program and aiding and abetting wire fraud. As part of the settlement, the global money transfer business agreed to forfeit $586 million.</p>
<p>Last week, the FTC <a href="https://www.ftc.gov/news-events/press-releases/2017/11/ftc-alerts-consumers-if-scammers-had-you-pay-them-western-union?utm_source=slider" target="_blank" rel="noopener">announced</a> that individuals who lost money to scammers who told them to pay via Western Union’s money transfer system between January 1, 2004 and January 19, 2017 can now file a claim to get their money back by going to <a href="https://www.ftc.gov/WU" data-ss1511181957="1">FTC.gov/WU</a> <em>before February 12, 2018</em>.</p>
<p>Scammers tend to rely on money transfer businesses like Western Union and <strong>MoneyGram</strong> because once the money is sent and picked up by the recipient the transaction is generally irreversible. Such scams include transfers made for fraudulent <a href="https://www.consumer.ftc.gov/articles/0199-prize-scams" data-ss1511181957="1">lottery and prizes</a>, <a href="https://www.ftc.gov/imposters" data-ss1511181957="1">family emergencies</a>, <a href="https://www.consumer.ftc.gov/articles/0078-advance-fee-loans" data-ss1511181957="1">advance-fee loans</a>, and <a href="https://www.consumer.ftc.gov/articles/0004-online-dating-scams" data-ss1511181957="1">online dating</a>, among others.<span id="more-41582"></span></p>
<p>Affected consumers can visit <a href="https://www.ftc.gov/WU" data-ss1511183569="1">FTC.gov/WU</a> to file claims, learn more, or get updates on the claims process, which could take up to a year. The graphic below seeks to aid victims in filing claims.</p>
<p><img class="aligncenter wp-image-41587" src="media/d87033d9.ftcwu.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/ftcwu.png" alt="" width="563" height="754" /></p>
<p>The FTC says some people who have already reported their losses to Western Union, the FTC, or another government agency will receive a form in the mail from the claims administrator, <strong>Gilardi &amp; Co.</strong>, which has been hired by the DOJ to return victims&#8217; money as part of the settlement. The form will have a Claim ID and a PIN number to use when filing a claim online via FTC.gov/WU.</p>
<p>The agency emphasized that filing a claim is free, so consumers should not pay anyone to file a claim on their behalf. &#8220;No one associated with the claims process will call to ask for consumers’ bank account or credit card number,&#8221; the FTC advised.</p>
<p>This isn&#8217;t the first time a major money transfer business admitted to criminally facilitating wire fraud. In November 2012, <strong>MoneyGram International</strong> agreed to <a href="https://krebsonsecurity.com/2012/11/moneygram-fined-100-million-for-wire-fraud/" target="_blank" rel="noopener">pay a $100 million fine</a> and admit to criminally aiding and abetting wire fraud and failing to maintain an effective anti-money laundering program.</p>


feed_id: https://krebsonsecurity.com/?p=41584
title: Correcting the Record on vDOS Prosecutions
uri: Correcting-the-Record-on-vDOS-Prosecutions
url: https://krebsonsecurity.com/2017/11/correcting-the-record-on-vdos-prosecutions/
content:
<p>KrebsOnSecurity recently <a href="https://krebsonsecurity.com/2017/11/hack-of-attack-for-hire-service-vdos-snares-new-mexico-man/" target="_blank" rel="noopener">featured a story</a> about a New Mexico man who stands accused of using the now-defunct <strong>vDOS</strong> attack-for-hire service to hobble the Web sites of several former employers. That piece stated that I wasn&#8217;t aware of any other prosecutions related to vDOS customers, but as it happens there <em>was</em> a prosecution in the United Kingdom earlier this year of a man who&#8217;s admitted to both using and helping to administer vDOS. Here&#8217;s a look at some open-source clues that may have led to the U.K. man&#8217;s arrest.</p>
<div id="attachment_41606" style="width: 256px" class="wp-caption alignright"><img class=" wp-image-41606" src="media/71fb8ba8.jchappell.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/jchappell.png" alt="" width="246" height="165" /><p class="wp-caption-text">Jack Chappell, outside of a court hearing in the U.K. earlier this year.</p></div>
<p>In early July 2017, the West Midlands Police in the U.K. <a href="https://www.west-midlands.police.uk/news/3065/student-court-over-global-web-attack-business" target="_blank" rel="noopener">arrested</a> 19-year-old Stockport resident <strong>Jack Chappell</strong> and charged him with aiding the vDOS co-founders &#8212; two Israeli men who were <a href="https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/" target="_blank" rel="noopener">arrested late year</a> and charged with running the service.</p>
<p>Until its demise in September 2016, vDOS was by far the most popular and powerful attack-for-hire service, allowing even completely unskilled Internet users to launch crippling assaults capable of knocking most Web sites offline. vDOS made more than $600,000 in just two of the four years it was in operation, launching more than 150,000 attacks against thousands of victims (including this site).</p>
<p>For his part, Chappell was charged with assisting in attacks against Web sites for some of the world&#8217;s largest companies, including <strong>Amazon</strong>, <strong>BBC</strong>, <strong>BT</strong>, <strong>Netflix</strong>, <strong>T-Mobile</strong>, <strong>Virgin Media</strong>, and <strong>Vodafone</strong>, between May 1, 2015 and April 30, 2016.</p>
<p>At the end of July 2017, Chappell pleaded guilty to those allegations, as well as charges of helping vDOS launder money from customers wishing to pay for attacks with PayPal accounts.</p>
<p>A big factor in that plea was the leak of the vDOS attacks, customer support and payments databases to this author and <a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank" rel="noopener">to U.S. law enforcement officials in the fall of 2016</a>. Those databases provided extremely detailed information about co-conspirators, paying customers and victims.</p>
<p>But as with many other cybercrime investigations, the perpetrator in this case appears to have been caught thanks to a combination of several all-too-common factors, including password re-use, an active presence on the sprawling English-language hacking community <a href="https://krebsonsecurity.com/?s=hackforums&amp;x=0&amp;y=0" target="_blank" rel="noopener">Hackforums</a>, and domain names registered in his real name. In combination, these clues provide a crucial bridge between Chappell&#8217;s online and real-world identities.<span id="more-41584"></span></p>
<p>A simple search at <a href="https://www.domaintools.com" target="_blank" rel="noopener">domaintools.com</a> for the name Jack Chappell and &#8220;UK&#8221; returns a handful of results, including the domain <strong>fractal[dot]hf</strong>. That domain was registered in June 2015 to a Jack Chappell in Stockport, using the email address <strong>me@jackchappell.co[dot]uk </strong>[full disclosure: Domaintools is an advertiser on this site].</p>
<p>Neither domain is online anymore, but <a href="https://www.google.com/search?q=%22fractalhf.me%22&amp;filter=0&amp;biw=1536&amp;bih=855" target="_blank" rel="noopener">a Google search on fractal[dot]hf</a> reveals several mentions of this site on Hackforums &#8212; a sprawling English-language forum that until very recently hosted the most bustling open-air market for competing attack-for-hire services.</p>
<p>According to a review of those Hackforums postings, fractal[dot]hf was a free service that allowed users to test the size and impact of any DDoS attack tool &#8212; displaying detailed graphs showing how much data a given attack tool could hurl at an intended target. Multiple forum members told interested users that fractal[dot]hf was owned and operated by a friendly and helpful Hackforums user named <strong>Fractal</strong>.</p>
<div id="attachment_41609" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/3466bad4.fractaldstat.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/fractaldstat.png"><img class="wp-image-41609" src="media/3466bad4.fractaldstat.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/fractaldstat.png" alt="" width="600" height="345" /></a><p class="wp-caption-text">A screenshot of the user Fractal advertising his service for measuring the size of attacks. Fractal posted this graphic to illustrate the power of an IRC-based botnet that was being sold on Hackforums in mid-2015.</p></div>
<p>Perhaps unsurprisingly, there was a very active user on vDOS who went by the same Fractal nickname, using the password &#8220;<strong>HelloWorld1998</strong>&#8221; and email address <strong>smellyjelly01@gmail.com</strong>.</p>
<p>The above-mentioned domain Jackchappell.co[dot]uk appears in the leaked vDOS payments database, which states that a PayPal account tied to the email address &#8220;<strong>paypal@jackchappell.co[dot]uk</strong>&#8221; was one of several PayPal accounts used to launder customer payments for online attacks.</p>
<p>As noted in my June 2017 piece <a href="https://krebsonsecurity.com/2017/06/following-the-money-hobbled-vdos-attack-for-hire-service/" target="_blank" rel="noopener">Following the Money Hobbled vDOS Attack-for-Hire Service</a>, vDOS was forced to round-robin customer PayPal payments through a series of accounts after academic researchers began signing up for a variety of attack-for-hire services (including vDOS) and then reporting to PayPal the email addresses tied to accounts being used to receive payments.</p>
<p>The paypal@jackchappell.co[dot]uk address was linked to a vDOS user account called &#8220;<strong>portalKiller</strong>&#8221; which used the password &#8220;<strong>HelloWorld8991</strong>.&#8221; Note that this password is very similar to the one used by the vDOS user Fractal &#8212; only the numbers at the end of the password have been reversed (1998/8991).</p>
<p>Portalkiller changed his password several times during his time on vDOS, and one of the passwords he used was &#8220;Smith8991.&#8221; An Internet search on this password turns up an account in <a href="http://archive.is/59XCN" target="_blank" rel="noopener">the user database that was hacked and posted online</a> from a similar attack-for-hire service previously run by a hacker group known as the <a href="https://krebsonsecurity.com/?s=lizard+squad&amp;x=0&amp;y=0" target="_blank" rel="noopener">Lizard Squad</a>. The email address tied to that account? Smellyjelly01@gmail.com.</p>
<p>From reviewing Fractal&#8217;s posts and reputation on Hackforums it appears that on Dec. 28, 2015 his account received praise and positive reputation points (similar to eBay&#8217;s user &#8220;feedback&#8221; system) from <strong>M30w</strong> and <strong>AppleJ4ck</strong>, the nicknames used by the alleged co-founders of vDOS.</p>
<div id="attachment_41607" style="width: 483px" class="wp-caption aligncenter"><img class="size-full wp-image-41607" src="media/1fd41d64.fractal-hfthanks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/fractal-hfthanks.png" alt="" width="473" height="586" /><p class="wp-caption-text">Positive reputation points awarded to Chappell by the co-owners of vDOS, who used the aliases &#8220;M30W&#8221; and &#8220;AppleJ4ck.&#8221;</p></div>
<p>Comments in the leaked vDOS databases also suggest Chappell was for a time one of several trusted administrators and/or support personnel of the service. vDOS routinely banned accounts for members who shared their logins, or who logged on via virtual private network (VPN) services to anonymize their connections, but many members ignored this advice.</p>
<p>For example, in one support ticket dated March 13, 2016, a vDOS subscriber named &#8220;Bears&#8221; who had his account banned pleaded with the administrators to reactivate (or &#8220;unban&#8221;) his account.</p>
<p>&#8220;Hi jeremy pls unban hi p1st i love you hi AJ i love you hi fractal i love you hi whoever else is support is swagdaddy still support?&#8221; Bears pleads.</p>
<p>Ironically, both of Chappell&#8217;s accounts on vDOS &#8212; Fractal and portalKiller &#8212; were ultimately banned, the latter supposedly for flouting vDOS&#8217;s no-VPN restrictions. In one customer support ticket, portalKiller explains the reason for his use of a VPN: He routinely used a VPN so that he could tunnel his connection to the United States and watch the U.S. catalog of <strong>Netflix</strong> videos.</p>
<blockquote><p>&#8220;Account Banned&#8217;,85801,&#8217;portalKiller&#8217;,&#8217;Hi, My account was banned a couple of days ago for logging in from a VPN. Let me explain, the 82.132.234.244 IP is not a VPN it is my mobile provider (O2), which is not a proxy/VPN. The second IP was a mistake I made, I logged out and logged back in from my normal IP (81.103.71.50) after I noticed my VPN was on (I use it for Netflix). I really want you to re-consider my ban. Thanks, portalKiller.&#8221;</p></blockquote>
<p>Fractal also was eventually banned from using vDOS, although it&#8217;s less clear why that account was banished. Perhaps Chappell no longer offered the ability to help the other vDOS administrators launder funds, or maybe he had a falling out with M30W/p1st and AppleJ4ck.</p>
<p>Chappell did not respond to requests for comment. His sentencing has been delayed several times since his guilty plea; it is currently slated for December 2017.</p>
<p>Chappell&#8217;s guilty plea reminds me that there are many others who helped launder funds for vDOS that are in all likelihood similarly exposed. Stay tuned for more updates on that front.</p>


feed_id: https://krebsonsecurity.com/?p=41621
title: Name+DOB+SSN=FAFSA Data Gold Mine
uri: Name-DOB-SSN-FAFSA-Data-Gold-Mine
url: https://krebsonsecurity.com/2017/11/namedobssnfafsa-data-gold-mine/
content:
<p>KrebsOnSecurity has sought to call attention to online services which expose sensitive consumer data if the user knows a handful of static details about a person that are broadly for sale in the cybercrime underground, such as name, date of birth, and Social Security Number. Perhaps the most eye-opening example of this is on display at <strong>fafsa.ed.gov</strong>, the Web site set up by the <strong>U.S. Department of Education</strong> for anyone interested in applying for federal student financial aid.</p>
<p>Short for the <strong>Free Application for Federal Student Aid</strong>, FAFSA is an extremely lengthy and detailed form required at all colleges that accept and award federal aid to students.</p>
<p>Visitors to the login page for FAFSA have two options: Enter either the student&#8217;s FSA ID and password, or choose &#8220;enter the student&#8217;s information.&#8221; Selecting the latter brings up a prompt to enter the student&#8217;s first and last name, followed by their date of birth and Social Security Number.</p>
<p><img class="aligncenter wp-image-41638" src="media/3c75e5da.fafsa-ssn-dob.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/fafsa-ssn-dob.png" alt="" width="604" height="454" /></p>
<p>Anyone who successfully supplies that information on a student who has applied for financial aid through FAFSA then gets to see a virtual colonoscopy of personal information on that individual and their family&#8217;s finances &#8212; including almost 200 different data elements.</p>
<p>The information returned includes all of these data fields:</p>
<p>1. Student&#8217;s Last Name:<br />
2. Student&#8217;s First Name:<br />
3. Student&#8217;s Middle Initial:<br />
4. Student&#8217;s Permanent Mailing Address:<br />
5. Student&#8217;s Permanent City:<br />
6. Student&#8217;s Permanent State:<br />
7. Student&#8217;s Permanent ZIP Code:<br />
8. Student&#8217;s Social Security Number:<br />
9. Student&#8217;s Date of Birth:<br />
10. Student&#8217;s Telephone Number:<br />
11. Student&#8217;s Driver&#8217;s License Number:<br />
12. Student&#8217;s Driver&#8217;s License State:<br />
13. Student&#8217;s E-mail Address:<br />
14. Student&#8217;s Citizenship Status:<br />
15. Student&#8217;s Alien Registration Number:<br />
16. Student&#8217;s Marital Status:<br />
17. Student&#8217;s Marital Status Date:<br />
18. Student&#8217;s State of Legal Residence:<br />
19. Was Student a Legal Resident Before January 1, 2012?<br />
20. Student&#8217;s Legal Residence Date:<br />
21. Is the Student Male or Female?<br />
22. Register Student With Selective Service System?<br />
23. Drug Conviction Affecting Eligibility?<br />
24. Parent 1 Educational Level:<br />
25. Parent 2 Educational Level:<br />
26. High School or Equivalent Completed?<br />
27a. Student&#8217;s High School Name:<br />
27b. Student&#8217;s High School City:<br />
27c. Student&#8217;s High School State:<br />
28. First Bachelor&#8217;s Degree before 2017-2018 School Year?<br />
29. Student&#8217;s Grade Level in College in 2017-2018:<br />
30. Type of Degree/Certificate:<br />
31. Interested in Work-study?<br />
32. Student Filed 2015 Income Tax Return?<br />
33. Student&#8217;s Type of 2015 Tax Form Used:<br />
34. Student&#8217;s 2015 Tax Return Filing Status:<br />
35. Student Eligible to File a 1040A or 1040EZ?<br />
36. Student&#8217;s 2015 Adjusted Gross Income:<br />
37. Student&#8217;s 2015 U.S. Income Tax Paid:<br />
38. Student&#8217;s 2015 Exemptions Claimed:<br />
39. Student&#8217;s 2015 Income Earned from Work:<br />
40. Spouse&#8217;s 2015 Income Earned from Work:<br />
41. Student&#8217;s Total of Cash, Savings, and Checking Accounts:<br />
42. Student&#8217;s Net Worth of Current Investments:<br />
43. Student&#8217;s Net Worth of Businesses/Investment Farms:<br />
44a. Student&#8217;s Education Credits:<br />
44b. Student&#8217;s Child Support Paid:<br />
44c. Student&#8217;s Taxable Earnings from Need-Based Employment Programs:<br />
44d. Student&#8217;s College Grant and Scholarship Aid Reported in AGI:<br />
44e. Student&#8217;s Taxable Combat Pay Reported in AGI:<br />
44f. Student&#8217;s Cooperative Education Earnings:<br />
45a. Student&#8217;s Payments to Tax-Deferred Pensions &amp; Retirement Savings:<br />
45b. Student&#8217;s Deductible Payments to IRA/Keogh/Other:<br />
45c. Student&#8217;s Child Support Received:<br />
45d. Student&#8217;s Tax Exempt Interest Income:<br />
45e. Student&#8217;s Untaxed Portions of IRA Distributions:<br />
45f. Student&#8217;s Untaxed Portions of Pensions:<br />
45g. Student&#8217;s Housing, Food, &amp; Living Allowances:<br />
45h. Student&#8217;s Veterans Noneducation Benefits:<br />
45i. Student&#8217;s Other Untaxed Income or Benefits:<br />
45j. Money Received or Paid on Student&#8217;s Behalf:<br />
46. Student Born Before January 1, 1994?<br />
47. Is Student Married?<br />
48. Working on Master&#8217;s or Doctorate in 2017-2018?<br />
49. Is Student on Active Duty in U.S. Armed Forces?<br />
50. Is Student a Veteran?<br />
51. Does Student Have Children He/She Supports?<br />
52. Does Student Have Dependents Other than Children/Spouse?<br />
53. Parents Deceased?/Student Ward of Court?/In Foster Care?<br />
54. Is or Was Student an Emancipated Minor?<br />
55. Is or Was Student in Legal Guardianship?<br />
56. Is Student an Unaccompanied Homeless Youth as Determined by High School/Homeless Liaison?<br />
57. Is Student an Unaccompanied Homeless Youth as Determined by HUD?<br />
58. Is Student an Unaccompanied Homeless Youth as Determined by Director of Homeless Youth Center?<br />
59. Parents&#8217; Marital Status:<br />
60. Parents&#8217; Marital Status Date:<br />
61. Parent 1 (Father&#8217;s/Mother&#8217;s/Stepparent&#8217;s) Social Security Number:<br />
62. Parent 1 (Father&#8217;s/Mother&#8217;s/Stepparent&#8217;s) Last Name:<br />
63. Parent 1 (Father&#8217;s/Mother&#8217;s/Stepparent&#8217;s) First Name Initial:<br />
64. Parent 1 (Father&#8217;s/Mother&#8217;s/Stepparent&#8217;s) Date of Birth:<br />
65. Parent 2 (Father&#8217;s/Mother&#8217;s/Stepparent&#8217;s) Social Security Number:<br />
66. Parent 2 (Father&#8217;s/Mother&#8217;s/Stepparent&#8217;s) Last Name:<br />
67. Parent 2 (Father&#8217;s/Mother&#8217;s/Stepparent&#8217;s) First Name Initial:<br />
68. Parent 2 (Father&#8217;s/Mother&#8217;s/Stepparent&#8217;s) Date of Birth:<br />
69. Parents&#8217; E-mail Address:<br />
70. Parents&#8217; State of Legal Residence:<br />
71. Were Parents Legal Residents Before January 1, 2012?<br />
72. Parents&#8217; Legal Residence Date:<br />
73. Parents&#8217; Number of Family Members in 2017-2018:<br />
74. Parents&#8217; Number in College in 2017-2018 (Parents Excluded):<br />
75. Parents Received Medicaid or Supplemental Security Income?<br />
76. Parents Received SNAP?<br />
77. Parents Received Free/Reduced Price Lunch?<br />
78. Parents Received TANF?<br />
79. Parents Received WIC?<br />
80. Parents Filed 2015 Income Tax Return?<br />
81. Parents&#8217; Type of 2015 Tax Form Used:<br />
82. Parents&#8217; 2015 Tax Return Filing Status:<br />
83. Parents Eligible to File a 1040A or 1040EZ?<br />
84. Is Parent a Dislocated Worker?<br />
85. Parents&#8217; 2015 Adjusted Gross Income:<br />
86. Parents&#8217; 2015 U.S. Income Tax Paid:<br />
87. Parents&#8217; 2015 Exemptions Claimed:<br />
88. Parent 1 (Father&#8217;s/Mother&#8217;s/Stepparent&#8217;s) 2015 Income Earned from Work:<br />
89. Parent 2 (Father&#8217;s/Mother&#8217;s/Stepparent&#8217;s) 2015 Income Earned from Work:<br />
90. Parents&#8217; Total of Cash, Savings, and Checking Accounts:<br />
91. Parents&#8217; Net Worth of Current Investments:<br />
92. Parents&#8217; Net Worth of Businesses/Investment Farms:<br />
93a. Parents&#8217; Education Credits:<br />
93b. Parents&#8217; Child Support Paid:<br />
93c. Parents&#8217; Taxable Earnings from Need-Based Employment Programs:<br />
93d. Parents&#8217; College Grant and Scholarship Aid Reported in AGI:<br />
93e. Parents&#8217; Taxable Combat Pay Reported in AGI:<br />
93f. Parents&#8217; Cooperative Education Earnings:<br />
94a. Parents&#8217; Payments to Tax-Deferred Pensions &amp; Retirement Savings:<br />
94b. Parents&#8217; Deductible Payments to IRA/Keogh/Other:<br />
94c. Parents&#8217; Child Support Received:<br />
94d. Parents&#8217; Tax Exempt Interest Income:<br />
94e. Parents&#8217; Untaxed Portions of IRA Distributions:<br />
94f. Parents&#8217; Untaxed Portions of Pensions:<br />
94g. Parents&#8217; Housing, Food, &amp; Living Allowances:<br />
94h. Parents&#8217; Veterans Noneducation Benefits:<br />
94i. Parents&#8217; Other Untaxed Income or Benefits:<br />
95. Student&#8217;s Number of Family Members in 2017-2018:<br />
96. Student&#8217;s Number in College in 2017-2018:<br />
97. Student Received Medicaid or Supplemental Security Income?<br />
98. Student Received SNAP?<br />
99. Student Received Free/Reduced Price Lunch?<br />
100. Student Received TANF?<br />
101. Student Received WIC?<br />
102. Is Student or Spouse a Dislocated Worker?<br />
103a. First Federal School Code:<br />
103b. First Housing Plans:<br />
103c. Second Federal School Code:<br />
103d. Second Housing Plans:<br />
103e. Third Federal School Code:<br />
103f. Third Housing Plans:<br />
103g. Fourth Federal School Code:<br />
103h. Fourth Housing Plans:<br />
103i. Fifth Federal School Code:<br />
103j. Fifth Housing Plans:<br />
103k. Sixth Federal School Code:<br />
103l. Sixth Housing Plans:<br />
103m. Seventh Federal School Code:<br />
103n. Seventh Housing Plans:<br />
103o. Eighth Federal School Code:<br />
103p. Eighth Housing Plans:<br />
103q. Ninth Federal School Code:<br />
103r. Ninth Housing Plans:<br />
103s. Tenth Federal School Code:<br />
103t. Tenth Housing Plans:<br />
104. Date Completed:<br />
105. Signed By:<br />
106. Preparer&#8217;s Social Security Number:<br />
107. Preparer&#8217;s Employer Identification Number (EIN):<br />
108. Preparer&#8217;s Signature:</p>
<p>From an identity thief&#8217;s perspective, it seems like the only question missing from this list is, &#8220;What was the name of your first pet?&#8221; Seriously though, armed with this bounty of data identity thieves would likely have little trouble impersonating a student (or parents of a student) who had applied for federal financial aid.</p>
<p>According to the Education Department, nearly 20 million students filled out this form in <a href="https://studentaid.ed.gov/sa/about/data-center/student/application-volume/fafsa-school-state" target="_blank" rel="noopener">the 2015/2016 application cycle</a>.<span id="more-41621"></span></p>
<p>What indications are there that ID thieves might already be aware of this personal data treasure trove? In March 2017, the <strong>Internal Revenue Service</strong> (IRS) <a href="https://krebsonsecurity.com/2017/03/student-aid-tool-held-key-for-tax-fraudsters/" target="_blank" rel="noopener">disabled an automated tool on its Web site</a> that was used to help students and their families apply for federal financial aid &#8212; citing evidence that identity thieves were abusing it to siphon data used to commit <a href="https://krebsonsecurity.com/?s=tax+refund+fraud&amp;x=0&amp;y=0" target="_blank" rel="noopener">tax refund fraud</a> with the IRS.</p>
<p>The IRS found that identity thieves were abusing the automated tool &#8212; which pulled data directly from the FAFSA Web site &#8212; in order to learn the adjusted gross income (AGI) of applicant families. The AGI is crucial to successfully filing a tax refund request in someone&#8217;s name at the IRS.</p>
<p>While the IRS&#8217;s tool is no longer online, this post shows how easy it remains for identity thieves to gather this same information directly from the FAFSA Web site.</p>
<p>Think it&#8217;s hard to find someone&#8217;s SSN and DOB? Think again. There are a multitude of Web sites on the open Internet and Dark Web alike that sell access to SSN and DOB data on hundreds of millions of Americans &#8212; all for the price of about $4-5 worth of Bitcoin.</p>
<p>Somehow, we need to move away from allowing online access to such a deep vein of consumer data just by supplying static data points that are broadly compromised in a thousand breaches and on sale very cheaply in the cybercrime underground.</p>
<p>Until that happens, anyone who is applying for federal student aid or has a child who applied should strongly consider taking several steps:</p>
<p><strong>-Get on a schedule to request a free copy of your credit report.</strong> By law, consumers are entitled to a free copy of their report from each of the major bureaus once a year. Put it on your calendar to request a copy of your file every three to four months, each time from a different credit bureau. Dispute any unauthorized or suspicious activity. This is where credit monitoring services are useful: Part of their service is to help you sort this out with the credit bureaus, so if you’re signed up for credit monitoring make them do the hard work for you.</p>
<p>–<strong>Consider placing a “security freeze” on your credit files with the major credit bureaus.</strong> See <a href="http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank" rel="noopener">this tutorial</a> about why a security freeze — also known as a “credit freeze,” may be more effective than credit monitoring in blocking ID thieves from assuming your identity to open up new lines of credit. Keep in mind that having a security freeze on your credit file won’t stop thieves from committing tax refund fraud in your name; the only real defense against that is to file your taxes as early as possible &#8212; before the fraudsters can do it for you.</p>
<p>–<strong>Monitor, then freeze.</strong> Take advantage of any free credit monitoring available to you, and then freeze your credit file with the four major bureaus. <a href="http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank" rel="noopener">Instructions for doing that are here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=39787
title: Who Was the NSA Contractor Arrested for Leaking the ‘Shadow Brokers’ Hacking Tools?
url:
https://krebsonsecurity.com/2017/11/who-was-the-nsa-contractor-arrested-for-leaking-the-shadow-brokers-hacking-tools/

content:
<p>In August 2016, a mysterious entity calling itself &#8220;<strong>The Shadow Brokers</strong>&#8221; began releasing the first of several troves of classified documents and hacking tools purportedly stolen from &#8220;<strong>The Equation Group</strong>,&#8221; a highly advanced threat actor that is suspected of having ties to the <strong>U.S. National Security Agency</strong>. According to media reports, at least some of the information was stolen from the computer of an unidentified software developer and NSA contractor who was arrested in 2015 after taking the hacking tools home. In this post, we&#8217;ll examine clues left behind in the leaked Equation Group documents that may point to the identity of the mysterious software developer.</p>
<div id="attachment_41687" style="width: 609px" class="wp-caption aligncenter"><img class=" wp-image-41687" src="media/49191056.nsahq.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/nsahq.png" alt="" width="599" height="418" /><p class="wp-caption-text">The headquarters of the National Security Agency in Fort Meade, Md.</p></div>
<p>The existence of the Equation Group was <a href="https://www.kaspersky.com/about/press-releases/2015_equation-group-the-crown-creator-of-cyber-espionage" target="_blank" rel="noopener">first posited in Feb. 2015</a> by researchers at Russian security firm <strong>Kaspersky Lab</strong>, which described it as one of the most sophisticated cyber attack teams in the world.</p>
<p>According to Kaspersky, the Equation Group has more than 60 members and has been operating since at least 2001. Most of the Equation Group&#8217;s targets have been in Iran, Russia, Pakistan, Afghanistan, India, Syria, and Mali.</p>
<p>Although Kaspersky was the first to report on the existence of the Equation Group, it also has been implicated in the group&#8217;s compromise. Earlier this year, both <em>The New York Times</em> and <em><a href="https://www.wsj.com/articles/russian-hackers-stole-nsa-data-on-u-s-cyber-defense-1507222108" target="_blank" rel="noopener">The Wall Street Journal</a></em> cited unnamed U.S. intelligence officials saying Russian hackers were able to obtain the advanced Equation Group hacking tools after identifying the files through a contractor’s use of <strong>Kaspersky Antivirus</strong> on his personal computer. For its part, Kaspersky has denied any involvement in the theft.</p>
<p>The Times <a href="https://www.nytimes.com/2017/11/12/us/nsa-shadow-brokers.html?_r=0" target="_blank" rel="noopener">reports</a> that the NSA has active investigations into at least three former employees or contractors, including two who had worked for a specialized hacking division of NSA known as <strong>Tailored Access Operations</strong>, or TAO.</p>
<p>Thanks to documents leaked from former NSA contractor <strong>Edward Snowden</strong> we know that TAO is a cyber-warfare intelligence-gathering unit of NSA that has been active since at least 1998. According to those documents, TAO&#8217;s job is to identify, monitor, infiltrate and gather intelligence on computer systems being used by entities foreign to the United States.</p>
<p>The third person under investigation, The Times writes, is &#8220;a still publicly unidentified software developer secretly arrested after taking hacking tools home in 2015, only to have <a href="https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-israel-russia-hacking.html" data-ss1510771213="1">Russian hackers lift them from his home computer</a>.&#8221;</p>
<h4>JEEPFLEA &amp; EASTNETS</h4>
<p>So who are those two unnamed NSA employees and the contractor referenced in The Times&#8217; reporting? The hacking tools leaked by The Shadow Brokers are now in the public domain and can be accessed through <a href="https://github.com/x0rz/EQGRP_Lost_in_Translation" target="_blank" rel="noopener">this Github repository</a>. The toolset includes reams of documentation explaining how the cyber weapons work, as well as details about their use in highly classified intelligence operations abroad.</p>
<p>Several of those documents are <strong>Microsoft Powerpoint</strong> (.pptx) and PDF files. These files contain interesting <a href="https://en.wikipedia.org/wiki/Metadata" target="_blank" rel="noopener">metadata</a> that includes the names of at least two people who appear to be connected to the NSA&#8217;s TAO operations.</p>
<p>Inside the unzipped folder there are three directories: &#8220;oddjob,&#8221; &#8220;swift,&#8221; and &#8220;windows.&#8221; Looking at the &#8220;swift&#8221; folder, we can see a Powerpoint file called &#8220;<strong>JFM_Status.pptx</strong>.&#8221;</p>
<p>JFM stands for <strong>Operation Jeepflea Market</strong>, which appears to have been a clandestine operation aimed at siphoning confidential financial data from <a href="http://www.eastnets.com/Homepage.aspx" target="_blank" rel="noopener">EastNets</a> &#8212; a middle eastern partner in SWIFT. Short for the <b>Society for Worldwide Interbank Financial Telecommunication, </b>SWIFT provides a network that enables financial institutions worldwide to send and receive data about financial transactions.</p>
<div id="attachment_41630" style="width: 610px" class="wp-caption aligncenter"><img class=" wp-image-41630" src="media/8c9b7ef0.jeepfleamarket.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/jeepfleamarket.png" alt="" width="600" height="354" /><p class="wp-caption-text">A slide from a Powerpoint presentation on the top secret Jeepflea Market operation, in which hackers allegedly tied to the National Security Agency compromised EastNets, a middle eastern partner of the global SWIFT financial network.</p></div>
<p>Each of the Jeepflea Powerpoint slides contain two overlapping seals; one for the NSA and another for an organization called the <strong>Central Security Service</strong> (CSS). According to <a href="https://en.wikipedia.org/wiki/Central_Security_Service" target="_blank" rel="noopener">Wikipedia</a>, the CSS was formed in 1972 to integrate the NSA and the <strong>Service Cryptologic Elements</strong> (SCE) of the U.S. armed forces.</p>
<p>In Figure 10 of the Jeepflea Powerpoint document, we can see the seal of the <strong>Texas Cryptologic Center</strong>, a NSA/CSS entity that is based out of <strong>Lackland Air Force Base</strong> in San Antonio Texas.</p>
<p>The metadata contained in the Powerpoint document shows that the last person to modify it has the designation &#8220;<strong>NSA-FTS32 USA</strong>,&#8221; and that this leaked version is the 9<sup>th</sup> revision of the document. What does NSA-FTS32 mean? According to multiple sources on the internet it means <strong>Tailored Access Operations</strong>.</p>
<p><span id="more-39787"></span></p>
<p>We can also see that the creator of the Jeepflea document is the same person who last modified it. The metadata says it was last modified on 8/12/2013 at 6:52:27 PM and created on 7/1/2013 at 6:44:46 PM.</p>
<p><img class="aligncenter wp-image-41631" src="media/fb728173.nsa-tao-texas.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/nsa-tao-texas.png" alt="" width="602" height="292" /></p>
<p>The file <strong>JFMStatus.pptx</strong> contains metadata showing that the creator of the file is one <strong>Michael A. Pecoraro</strong>. Public record searches suggest Mr. Pecoraro is in his mid- to late 30s and is from San Antonio, Texas. Pecoraro&#8217;s name appears on multiple documents in The Shadow Brokers collection. Mr. Pecoraro could not be reached for comment.</p>
<div id="attachment_41654" style="width: 611px" class="wp-caption aligncenter"><a class="lightbox" href="media/b50fd125.metadata-pecoraro.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/metadata-pecoraro.png"><img class="wp-image-41654" src="media/b50fd125.metadata-pecoraro.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/metadata-pecoraro.png" alt="" width="601" height="181" /></a><p class="wp-caption-text">The metadata in a Microsoft Powerpoint presentation on Operation Jeepflea shows that the document was created and last modified in 2013 by a Michael A. Pecoraro.</p></div>
<p>Another person who earned the NSA-FTS32 designation in the document metadata was <strong>Nathan S. Heidbreder</strong>. Public record searches suggest that Mr. Heidbreder is approximately 30 years old and has lived in San Antonio and at <strong>Goodfellow Air Force Base</strong> in Texas, among other locations in the state.</p>
<p>According to <a href="https://en.wikipedia.org/wiki/Goodfellow_Air_Force_Base" target="_blank" rel="noopener">Goodfellow&#8217;s Wikipedia entry</a>, the base&#8217;s main mission is cryptologic and intelligence training for the Air Force, Army, Coast Guard, Navy, and Marine Corps. Mr. Heidbreder likewise could not be reached for comment.</p>
<div id="attachment_41653" style="width: 474px" class="wp-caption aligncenter"><img class="size-full wp-image-41653" src="media/abf5795f.jeepflea-heidbreder.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/jeepflea-heidbreder.png" alt="" width="464" height="440" /><p class="wp-caption-text">The metadata contained in one of the classified Jeepflea Market Microsoft Excel documents released in The Shadow Brokers trove states that a Nathan S. Heidbreder was the last person to edit the document.</p></div>
<p>Another file in the leaked Shadow Brokers trove related to this Jeepflea/EastNets operation is potentially far more revealing, mainly because it appears to have last been touched not by an NSA employee, but by an outside contractor.</p>
<p>That file, &#8220;Eastnets_UAE_BE_DEC2010.vsd,&#8221; is a <strong>Microsoft Visual Studio</strong> document created in Sept. 2013. The metadata inside of it says the last user to open the file was one <strong>Gennadiy Sidelnikov. </strong>Open records searches return several results for this name, including a young business analyst living in Moscow and a software developer based in Maryland.</p>
<p>As the NSA is based in Fort Meade, Md., this latter option seems far more likely. A brief Internet search turns up a 50-something database programmer named <strong>Gennadiy &#8220;Glen&#8221; Sidelnikov</strong> who works or worked for a company called <strong>Independent Software</strong> in Columbia, Md. (Columbia is just a few miles away from Ft. Meade).</p>
<div id="attachment_41678" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/522d15f8.SIDELNIKOV.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/SIDELNIKOV.png"><img class="wp-image-41678" src="media/522d15f8.SIDELNIKOV.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/SIDELNIKOV.png" alt="" width="600" height="305" /></a><p class="wp-caption-text">The metadata contained within Eastnets_UAE_BE_Dec2010.vsd says Gennadiy Sidelnikov is the last author of the document. Click to enlarge.</p></div>
<p>What is Independent Software? Their <a href="http://www.independentsoftware.com" target="_blank" rel="noopener">Web site</a> states that Independent Software is &#8220;a professional services company providing Information Technology products and services to mission-oriented Federal Civilian Agencies and the DoD. The company has focused on support to the Intelligence Community (IC) in Maryland, Florida, and North Carolina, as well as select commercial client markets outside of the IC.”</p>
<p>Indeed, <a href="https://www.indeed.com/viewjob?jk=2b5a5e799197a6f5&amp;from=api&amp;q=Job+Title+Software+Engineer+Level+1&amp;l=Fort+Meade,+MD&amp;atk=1bvd2qrus4o0lb2k&amp;sclk=1&amp;sjdu=QwrRXKrqZ3CNX5W-O9jEvXvB_tT-uIVWta9o2Y0FVBcve8kIXjdsGlael-HGpc2cVnBYO58530KPIdkVXNI7XbeGM8KD8EyVnXmYB3gqhS3wwovF6TQZw1MYQA-qoXKaC-VDpwRXR4WZL65wuvCtv1DDSsrzo_gVmnutbiDo3jFxA8WunuYXsBIoDb4BXyzfbj1XOkC44JTG4LjSeVzGYmZlF9ezzYJQVEF_xD0r1hLkQ6Eie4fpenhGUucHiAxs1WJi_3a9b75eeNNQVK4tdcrJyIq3nstpxAby9CMcs5JtFeh4tjitjRJ-Uj2N5HAoMMwmv0GD9yi56dtbgKEMcA&amp;acatk=1bvpo50tb534s8li&amp;pub=e4a4d947a13475e2eecaa0d5778db8340cace3277f6b99df" target="_blank" rel="noopener">this job advertisement</a> from August 2017 for a junior software engineer at Independent Software says a qualified applicant will need a TOP SECRET clearance and should be able to pass a polygraph test.</p>
<h4>WHO IS GLEN SIDELNIKOV?</h4>
<p>The two NSA employees are something of a known commodity, but the third individual &#8212; Mr. Sidelnikov &#8212; is more mysterious. Sidelnikov did not respond to repeated requests for comment. Independent Software also did not return calls and emails seeking comment.</p>
<p><a href="media/f5f3f07a.Glen-Sidelnikov-_-LinkedIn.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/Glen-Sidelnikov-_-LinkedIn.pdf" target="_blank" rel="noopener">Sidelnikov&#8217;s LinkedIn page</a> (PDF) says he began working for Independent Software in 2015, and that he speaks both English and Russian. In 1982, Sidelnikov earned his masters in information security from <strong>Kishinev University</strong>, a school located in Moldova &#8212; an Eastern European country that at the time was part of the Soviet Union.</p>
<p>Sildelnikov says he also earned a Bachelor of Science degree in &#8220;mathematical cybernetics&#8221; from the same university in 1981. Under &#8220;interests,&#8221; Mr. Sidelnikov lists on his LinkedIn profile Independent Software, Microsoft, and The National Security Agency.</p>
<p><img class="aligncenter wp-image-41663" src="media/3921bf1b.gs-linkedin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/gs-linkedin.png" alt="" width="600" height="372" /></p>
<p>Both The Times and The Journal have reported that the contractor suspected of leaking the classified documents was running Kaspersky Antivirus on his computer. It stands to reason that as a Russian native, Mr. Sildelnikov might be predisposed to using a Russian antivirus product.</p>
<p>Mr. Sidelnikov calls himself a senior consultant, but the many skills he self-described on his LinkedIn profile suggest that perhaps a better title for him would be &#8220;database administrator&#8221; or &#8220;database architect.&#8221;</p>
<p>A Google search for his name turns up numerous forums dedicated to discussions about administering databases. On the Web forum <strong>sqlservercentral.com</strong>, for example, a user named Glen Sidelnikov is listed as a &#8220;hall of fame&#8221; member for providing thousands of answers to questions that other users posted on the forum.</p>
<p>KrebsOnSecurity was first made aware of the metadata in the Shadow Brokers leak by <strong>Mike Poor</strong>, <strong>Rob Curtinseufert, </strong>and<strong> Larry Pesce. </strong>All three are security experts with <a href="https://www.inguardians.com" target="_blank" rel="noopener">InGuardians</a>, a Washington, D.C.-based penetration testing firm that gets paid to break into companies and test their cybersecurity defenses.</p>
<p>Poor, who serves as president and managing partner of InGuardians, said he and his co-workers initially almost overlooked Sidelnikov&#8217;s name in the metadata. But he said the more they looked into Sidelnikov the less sense it made that his name was included in the Shadow Brokers metadata at all.</p>
<p>&#8220;He&#8217;s a database programmer, and they typically don&#8217;t have access to operational data like this,&#8221; Poor said. &#8220;Even if he did have access to an operational production database, it would be highly suspect if he accessed classified operation documents.&#8221;</p>
<p>Poor said that as the data owner, the NSA likely would be reviewing file access of all classified documents and systems, and it would definitely have come up as a big red flag if a software developer accessed and opened classified files during some routine maintenance or other occasion.</p>
<p>&#8220;He&#8217;s the only one in there that is not Agency/TAO, and I think that poses important questions,&#8221; Poor said. &#8220;Such as why did a DB programmer for a software company have access to operational classified documents? If he is or isn&#8217;t a source or a tie to Shadow Brokers, it at least begets the question of why he accessed classified operational documents.&#8221;</p>
<p>Curtinseufert said it may be that Sidelnikov&#8217;s skills came in handy in the Jeepflea operations, which appear to have involved compromising large financial databases, and querying those for very specific transactions.</p>
<p>For example, Jeepflea apparently involved surreptitiously injecting database queries into the SWIFT Alliance servers, which are responsible for handling the messaging tied to SWIFT financial transactions.</p>
<p>&#8220;It looks like the SWIFT data the NSA was collecting relied heavily on databases, and they were apparently also using some exploits to gather data,&#8221; Curtinseufert said. &#8220;The SWIFT databases are all records of financial transactions, and in Jeepflea they were able to query those SWIFT databases and see who&#8217;s moving money where. They were looking to pull SWIFT data on who was moving money around the Middle East. They did this with EastNets, and they tried to do it down in Venezuela. And it looks like through EastNets they were able to hack individual banks.&#8221;</p>
<p>The NSA did not respond to requests for comment.</p>
<p>InGuardians president Poor said we may never know for sure who was responsible for the Shadow Brokers leak, an incident that has been called &#8220;one of the worst security debacles ever to befall American intelligence.&#8221;  But one thing seems certain.</p>
<p>&#8220;I think it&#8217;s time that we state what we all know,&#8221; Poor said. &#8220;The Equation Group is Tailored Access Operations. It is the NSA.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=41703
title: MacOS High Sierra Users: Change Root Password Now
uri: MacOS-High-Sierra-Users-Change-Root-Password-Now
url: https://krebsonsecurity.com/2017/11/macos-high-sierra-users-change-root-password-now/
content:
<p>A newly-discovered flaw in <a href="https://www.apple.com/macos/high-sierra/" target="_blank" rel="noopener">macOS High Sierra</a> &#8212; Apple&#8217;s latest iteration of its operating system &#8212; allows anyone with local (and, apparently in some cases, remote) access to the machine to log in as the all-powerful &#8220;root&#8221; user without supplying a password. Fortunately, there is a simple fix for this until Apple patches this inexplicable bug: Change the root account&#8217;s password <em>now</em>.</p>
<p><img class="aligncenter wp-image-41705" src="media/0c4cb3c2.macoshighsierra.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/macoshighsierra.png" alt="" width="600" height="341" /></p>
<p>For better or worse, this glaring vulnerability was first disclosed today on Twitter by Turkish software developer <strong>Lemi Orhan Ergin</strong>, who unleashed his findings onto the Internet with <a href="https://twitter.com/lemiorhan/status/935578694541770752" target="_blank" rel="noopener">a tweet</a> to @AppleSupport:</p>
<blockquote><p>&#8220;Dear @AppleSupport, we noticed a *HUGE* security issue at MacOS High Sierra. Anyone can login as &#8220;root&#8221; with empty password after clicking on login button several times. Are you aware of it @Apple?&#8221;</p></blockquote>
<p>High Sierra users should be able to replicate the exploit by accessing System Preferences, then Users &amp; Groups, and then click the lock to make changes. Type &#8220;root&#8221; with no password, and simply try that several times until the system relents and lets you in.</p>
<p>How does one change the root password? It&#8217;s simple enough. Open up a Terminal (in the Spotlight search box just type &#8220;terminal&#8221;) and type &#8220;sudo passwd root&#8221;.<span id="more-41703"></span></p>
<p>Many people responding to that tweet said they were relieved to learn that this extremely serious oversight by Apple does not appear to be exploitable remotely. However, sources who have tested the bug say it can be exploited remotely if a High Sierra user a) has not changed the root password yet and b) has enabled &#8220;screen sharing&#8221; on their Mac.</p>
<p>Likewise, multiple sources have now confirmed that <a href="https://support.apple.com/en-ie/HT204012#enable" target="_blank" rel="noopener">disabling the root account</a> does not fix the problem because the exploit actually causes the account to be re-enabled.</p>
<p>There may be other ways that this vulnerability can be exploited: I&#8217;ll update this post as more information becomes available. But for now, if you&#8217;re using macOS High Sierra, take a moment to change the root password now, please.</p>


feed_id: https://krebsonsecurity.com/?p=41725
title: Carding Kingpin Sentenced Again. Yahoo Hacker Pleads Guilty
uri: Carding-Kingpin-Sentenced-Again-Yahoo-Hacker-Pleads-Guilty
url: https://krebsonsecurity.com/2017/12/carding-kingpin-sentenced-again-yahoo-hacker-pleads-guilty/
content:
<p><strong>Roman Seleznev</strong>, a Russian man who is already serving a record 27-year sentence in the United States for cybercrime charges, was handed a 14-year sentence this week by a federal judge in Atlanta for his role in a credit card and identity theft conspiracy that prosecutors say netted more than $50 million. Separately, a Canadian national has pleaded guilty to charges of helping to steal more than a billion user account credentials from <strong>Yahoo</strong>.</p>
<p>Seleznev, 33, was given the <a href="https://www.justice.gov/opa/pr/russian-cyber-criminal-sentenced-14-years-prison-role-organized-cybercrime-ring-responsible" target="_blank" rel="noopener">14-year sentence</a> in connection with two prosecutions that were consolidated in Georgia: The <a href="http://voices.washingtonpost.com/securityfix/2009/11/eight_indicted_in_9m_rbs_world.html" target="_blank" rel="noopener">2008 heist</a> against Atlanta-based credit card processor <strong>RBS Worldpay</strong>; and a case out of Nevada where he was charged as a leading merchant of stolen credit cards at <strong>carder[dot]su</strong>, at one time perhaps the most bustling fraud forum where members openly marketed a variety of cybercrime-oriented services.</p>
<div id="attachment_41728" style="width: 595px" class="wp-caption aligncenter"><img class=" wp-image-41728" src="media/5319c7d9.seleznevcash.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/seleznevcash.png" alt="" width="585" height="353" /><p class="wp-caption-text">Roman Seleznev, pictured with bundles of cash. Image: US DOJ.</p></div>
<p>Seleznev&#8217;s conviction comes more than a year after he was convicted in a Seattle court on 38 counts of cybercrime charges, including wire fraud and aggravated identity theft. The Seattle conviction earned Seleznev a 27-year prison sentence &#8212; the most jail time ever given to an individual convicted of cybercrime charges in the United States.</p>
<p>This latest sentence will be served concurrently &#8212; meaning it will not add any time to his 27-year sentence. But it&#8217;s worth noting because Seleznev is appealing the Seattle verdict. In the event he prevails in Seattle and gets that conviction overturned, he will still serve out his 14-year sentence in the Georgia case because he pleaded guilty to those charges and waived his right to an appeal.</p>
<p>Prosecutors say Seleznev, known in the underworld by his hacker nicknames &#8220;nCux&#8221; and &#8220;Bulba,&#8221; enjoyed an extravagant lifestyle prior to his arrest, driving expensive sports cars and dropping tens of thousands of dollars at lavish island vacation spots. The son of an influential Russian politician, Seleznev made international headlines in 2014 after he was <a href="http://www.reuters.com/article/2014/07/08/us-usa-cybersecurity-arrest-idUSKBN0FD0Z020140708" target="_blank" rel="noopener">captured</a> while vacationing in <a href="https://en.wikipedia.org/wiki/Maldives" target="_blank" rel="noopener">The Maldives</a>, a popular destination for Russians and one that <a href="https://krebsonsecurity.com/2011/06/chronopay-co-founder-arrested/" target="_blank" rel="noopener">many Russian cybercriminals</a> previously <a href="media/63e648aa.GusevViagra.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2011/09/GusevViagra.jpg" target="_blank" rel="noopener">considered</a> to be out of reach for western law enforcement agencies.</p>
<p>However, U.S. authorities were able to negotiate a secret deal with the Maldivian government to apprehend Seleznev. Following his capture, Seleznev was whisked away to Guam for <a href="media/0f6c3a76.Seleznev-US-Atty-Sentencing-Memo.pdf" data-original-source="https://assets.documentcloud.org/documents/3673513/Seleznev-US-Atty-Sentencing-Memo.pdf" target="_blank" rel="noopener">more than a month</a> before being transported to Washington state to stand trial for computer hacking charges.</p>
<p>The U.S. Justice Department says the laptop found with him when he was arrested contained more than 1.7 million stolen credit card numbers, and that evidence presented at trial showed that Seleznev earned tens of millions of dollars defrauding more than 3,400 financial institutions.</p>
<p>Investigators also reportedly <a href="http://www.seattletimes.com/seattle-news/crime/seattle-jury-convicts-russian-man-of-massive-business-hacking-id-theft-scheme/" target="_blank" rel="noopener">found a smoking gun: a password cheat sheet</a> that linked Seleznev to a decade’s worth of criminal hacking. For more on Seleznev&#8217;s arrest and prosecution, see <a href="https://krebsonsecurity.com/2017/04/the-backstory-behind-carder-kingpin-roman-seleznevs-record-27-year-prison-sentence/" target="_blank" rel="noopener">The Backstory Behind Carder Kingpin Roman Seleznev&#8217;s Record 27-Year Sentence</a>, and <a href="https://krebsonsecurity.com/2014/07/feds-charge-carding-kingpin-in-retail-hacks/" target="_blank" rel="noopener">Feds Charge Carding Kingpin in Retail Hacks</a>.</p>
<p>In an unrelated case, federal prosecutors in California <a href="https://www.justice.gov/opa/pr/canadian-hacker-who-conspired-and-aided-russian-fsb-officers-pleads-guilty" target="_blank" rel="noopener">announced a guilty plea</a> from <strong>Karim Baratov</strong>, one of <a href="https://www.google.com/url?sa=t&amp;rct=j&amp;q=&amp;esrc=s&amp;source=web&amp;cd=2&amp;cad=rja&amp;uact=8&amp;ved=0ahUKEwiVqsD9menXAhUFm-AKHaqrD-8QFggwMAE&amp;url=https%3A%2F%2Fkrebsonsecurity.com%2F2017%2F03%2Ffour-men-charged-with-hacking-500m-yahoo-accounts%2F&amp;usg=AOvVaw1hNqWKX8MzjCGi0xNTx4T6" target="_blank" rel="noopener">four men indicted in March 2017</a> for hacking into Yahoo beginning in 2014. Yahoo initially said the intrusion exposed the usernames, passwords and account data for roughly 500 million Yahoo users, but in December 2016 Yahoo said the actual number of victims <a href="https://krebsonsecurity.com/2016/12/my-yahoo-account-was-hacked-now-what/" target="_blank" rel="noopener">was closer to one billion</a> (read: all of its users). <span id="more-41725"></span></p>
<p>Baratov, 22, is a Canadian and Kazakh national who lived in Canada (he&#8217;s now being held in California). He was charged with being hired by two <a href="https://en.wikipedia.org/wiki/Federal_Security_Service" target="_blank" rel="noopener">Russian FSB</a> officer defendants in this case — <strong>Dmitry Dokuchaev, </strong>33, and <strong>Igor Sushchin</strong>, 43 — to hack into the email accounts of thousands of individuals. According to prosecutors, Baratov’s role in the charged conspiracy was to hack webmail accounts of individuals of interest to the FSB and send those accounts’ passwords to Dokuchaev in exchange for money.</p>
<div id="attachment_38569" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-38569" src="media/467bcfb2.mrkarim-580x348.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/03/mrkarim-580x348.png" alt="" width="580" height="348" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/03/mrkarim-580x348.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/03/mrkarim-768x461.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/03/mrkarim-940x564.png 940w, https://krebsonsecurity.com/wp-content/uploads/2017/03/mrkarim.png 1256w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Karim Baratov, a.k.a. &#8220;Karim Taloverov,&#8221; as pictured in 2014 on his own site, mr-karim.com.</p></div>
<p>Baratov operated several business that he advertised openly online that could be hired to hack into email accounts at the world&#8217;s largest email providers, including Google, Yahoo and Yandex. As part of his plea agreement, Baratov not only admitted to agreeing and attempting to hack at least 80 webmail accounts on behalf of one of his FSB co-conspirators, but also to hacking more than 11,000 webmail accounts in total from in or around 2010 until his arrest by Canadian authorities.</p>
<p>Shortly after Baratov&#8217;s arrest and indictment, KrebsOnSecurity <a href="https://krebsonsecurity.com/2017/03/four-men-charged-with-hacking-500m-yahoo-accounts/" target="_blank" rel="noopener">examined many of the email hacking services he operated</a> and that were quite clearly tied to his name. One such business advertised the ability to steal email account passwords without actually changing the victim&#8217;s password. According to prosecutors, Baratov&#8217;s service relied on &#8220;spear phishing&#8221; emails that targeted individuals with custom content and enticed recipients to click a booby-trapped link.</p>
<p>For example, one popular email hacking business registered to Baratov was <strong>xssmail[dot]com</strong>, which for several years advertised the ability to break into email accounts of virtually all of the major Webmail providers. XSS is short for “cross-site-scripting.” XSS attacks rely on vulnerabilities in Web sites that don’t properly parse data submitted by visitors in things like search forms or anyplace one might enter data on a Web site.</p>
<div id="attachment_38567" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-38567" src="media/6dd9b906.xssmail-580x377.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/03/xssmail-580x377.png" alt="" width="580" height="377" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/03/xssmail-580x377.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/03/xssmail-768x499.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/03/xssmail-940x611.png 940w, https://krebsonsecurity.com/wp-content/uploads/2017/03/xssmail.png 1486w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Archive.org&#8217;s cache of xssmail.com</p></div>
<p>In the context of phishing links, the user clicks the link and is actually taken to the domain he or she thinks she is visiting (e.g., yahoo.com) but the vulnerability allows the attacker to inject malicious code into the page that the victim is visiting.</p>
<p>This can include fake login prompts that send any data the victim submits directly to the attacker. Alternatively, it could allow the attacker to steal “cookies,” text files that many sites place on visitors’ computers to validate whether they have visited the site previously, as well as if they have authenticated to the site already.</p>
<p>Baratov pleaded guilty to nine counts, including one count of aggravated identity theft and eight violations of the <a href="https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act" target="_blank" rel="noopener">Computer Fraud and Abuse Act</a>. His sentencing hearing is scheduled for Feb. 20, 2018. The aggravated identity theft charge carries a mandatory two-year sentence; each of the other counts is punishable by up to 10 years in jail and fines of $250,000, although any sentence he receives will likely be heavily tempered by <a href="https://en.wikipedia.org/wiki/United_States_Federal_Sentencing_Guidelines" target="_blank" rel="noopener">U.S. federal sentencing guidelines</a>.</p>
<p>Meanwhile, Baratov&#8217;s co-defendant Dokuchaev is embroiled in his own legal worries in Russia, charges that could carry a death sentence. He and his former boss <strong>Sergei Mikhailov </strong>&#8212; once deputy chief of the FSB&#8217;s Center for Information Security &#8212; were arrested in December 2016 by Russian authorities and charged with treason. Also charged with treason in connection with that case was <strong>Ruslan Stoyanov</strong>, a senior employee at Russian security firm <strong>Kaspersky Lab</strong>.</p>
<p>There are many competing theories for the reasons behind their treason charges, some of which are explored in <a href="https://www.washingtonpost.com/news/worldviews/wp/2017/03/16/the-fbi-just-indicted-a-russian-official-for-hacking-but-why-did-russia-charge-him-with-treason/" target="_blank" rel="noopener">this Washington Post story</a>. I have my own theory, detailed in my January 2017 piece, <a href="https://krebsonsecurity.com/2017/01/a-shakeup-in-russias-top-cybercrime-unit/" target="_blank" rel="noopener">A Shakeup in Russia&#8217;s Top Cybercrime Unit</a>.</p>


feed_id: https://krebsonsecurity.com/?p=41740
title: Former NSA Employee Pleads Guilty to Taking Classified Data
uri: Former-NSA-Employee-Pleads-Guilty-to-Taking-Classified-Data
url: https://krebsonsecurity.com/2017/12/former-nsa-employee-pleads-guilty-to-taking-classified-data/
content:
<p>A former employee for the <strong>National Security Agency</strong> pleaded guilty on Friday to taking classified data to his home computer in Maryland. According to published reports, U.S. intelligence officials believe the data was then stolen from his computer by hackers working for the Russian government.</p>
<p><strong>Nghia Hoang Pho</strong>, 67, of Ellicott City, Maryland, pleaded guilty today to &#8220;willful retention of national defense information.&#8221; The <strong>U.S. Justice Department </strong>says that beginning in April 2006 Pho was employed as a developer for the NSA&#8217;s <strong>Tailored Access Operations</strong> (TAO) unit, which develops specialized hacking tools to gather intelligence data from foreign targets and information systems.</p>
<p>According to Pho&#8217;s plea agreement, between 2010 and March 2015 he removed and retained highly sensitive classified &#8220;documents and writings that contained national defense information, including information classified as Top Secret.&#8221;</p>
<p>Pho is the third NSA worker to be charged in the past two years with mishandling classified data. His plea is the latest &#8212; and perhaps final &#8212; chapter in the NSA&#8217;s hunt for those responsible for leaking NSA hacking tools that have been published online over the past year by a shadowy group calling itself <a href="https://en.wikipedia.org/wiki/The_Shadow_Brokers" target="_blank" rel="noopener">The Shadow Brokers</a>.</p>
<p>Neither the government&#8217;s <a href="https://www.justice.gov/opa/pr/maryland-man-pleads-guilty-willful-retention-national-defense-information" target="_blank" rel="noopener">press release</a> about the plea nor <a href="https://www.justice.gov/opa/press-release/file/1015281/download" target="_blank" rel="noopener">the complaint</a> against Pho mention what happened to the classified documents after he took them home. But <a href="https://www.nytimes.com/2017/12/01/us/politics/nsa-nghia-pho-classified-information-stolen-guilty.html?hp&amp;action=click&amp;pgtype=Homepage&amp;clickSource=story-heading&amp;module=second-column-region&amp;region=top-news&amp;WT.nav=top-news&amp;_r=0" target="_blank" rel="noopener">a report</a> in <em>The New York Times</em> cites government officials speaking on condition of anonymity saying that Pho had installed on his home computer antivirus software made by a Russian security firm <strong>Kaspersky Lab</strong>, and that Russian hackers are believed to have exploited the software to steal the classified documents.<span id="more-41740"></span></p>
<p>On October 5, 2017, <em>The Wall Street Journal</em> <a href="https://www.wsj.com/articles/russian-hackers-stole-nsa-data-on-u-s-cyber-defense-1507222108?mg=prod/accounts-wsj" target="_blank" rel="noopener">reported</a> that Russian government hackers had lifted the hacking tools from an unnamed NSA contractor who&#8217;d taken them and examined them on his home computer, which happened to have Kaspersky Antivirus installed.</p>
<p>On October 10, The Times <a href="https://www.nytimes.com/2017/10/10/technology/kaspersky-lab-israel-russia-hacking.html" target="_blank" rel="noopener">reported</a> that Israeli intelligence officers looked on in real time as Russian government hackers used Kaspersky&#8217;s antivirus network as a kind of improvised search tool to scour computers around the world for the code names of American intelligence programs.</p>
<p>For its part, Kaspersky has said its software detected the NSA hacking tools on a customer&#8217;s computer and sent the files to the company&#8217;s anti-malware network for analysis. In <a href="https://securelist.com/investigation-report-for-the-september-2014-equation-malware-detection-incident-in-the-us/83210/" target="_blank" rel="noopener">a lengthy investigation report</a> published last month, Kaspersky said it found no evidence that the files left its network, and that the company deleted the files from its system after learning what they were.</p>
<p>Kaspersky also noted that the computer from which the files were taken was most likely already compromised by &#8220;unknown threat actors.&#8221; It based that conclusion on evidence indicating the user of that system installed a backdoored <strong>Microsoft Office 2013</strong> license activation tool, and that in order to run the tool the user must have disabled his antivirus protection.</p>
<p>The <strong>U.S. Department of Homeland Security</strong> (DHS) <a href="https://www.dhs.gov/news/2017/09/13/dhs-statement-issuance-binding-operational-directive-17-01" target="_blank" rel="noopener">issued a binding directive</a> in September ordering all federal agencies to cease using Kaspersky software by Dec. 12.</p>
<p>Pho faces up to 10 years in prison. He is scheduled to be sentenced April 6, 2018.</p>
<p>A note to readers: This author published a story earlier in the week that examined information in the metadata of Microsoft Office documents stolen from the NSA by The Shadow Brokers and leaked online. That story identified several individuals whose names were in the metadata from those documents. After the guilty plea entered this week and described above, KrebsOnSecurity has unpublished that earlier story.</p>


feed_id: https://krebsonsecurity.com/?p=41756
title: Hacked Password Service Leakbase Goes Dark
uri: Hacked-Password-Service-Leakbase-Goes-Dark
url: https://krebsonsecurity.com/2017/12/hacked-password-service-leakbase-goes-dark/
content:
<p><strong>Leakbase</strong>, a Web site that indexed and sold access to billions of usernames and passwords stolen in some of the world largest data breaches, has closed up shop. A source close to the matter says the service was taken down in a law enforcement sting that may be tied to the Dutch police raid of the <strong>Hansa</strong> dark web market earlier this year.</p>
<p><a class="lightbox" href="media/8824afd7.lbintro.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/lbintro.png"><img class="aligncenter wp-image-41768" src="media/8824afd7.lbintro.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/lbintro.png" alt="" width="598" height="230" /></a></p>
<p>Leakbase[dot]pw began selling memberships in September 2016, advertising more than two billion usernames and passwords that were stolen in high-profile breaches at sites like <strong>linkedin.com</strong>, <strong>myspace.com</strong> and <strong>dropbox.com</strong>.</p>
<p>But roughly two weeks ago KrebsOnSecurity began hearing from Leakbase users who were having trouble reaching the normally responsive and helpful support staff responsible for assisting customers with purchases and site issues.</p>
<p>Sometime this weekend, Leakbase began redirecting visitors to <a href="https://haveibeenpwned.com" target="_blank" rel="noopener">haveibeenpwned.com</a>, a legitimate breach alerting service run by security researcher <strong>Troy Hunt</strong> (Hunt&#8217;s site lets visitors check if their email address has shown up in any public database leaks, but it does not store corresponding account passwords).</p>
<p><span data-reactid=".5.2.$lazyPlaceholder_twitter_937541381916065796.2.2.0.0.0.4">Leakbase reportedly came under new ownership after its hack in April. According to a source with knowledge of the matter but who asked to remain anonymous, the new owners of Leakbase dabbled in dealing illicit drugs at <a href="https://krebsonsecurity.com/?s=hansa+alphabay&amp;x=0&amp;y=0" target="_blank" rel="noopener">Hansa</a>, a dark web marketplace that was dismantled in July by authorities in The Netherlands. </span><span id="more-41756"></span></p>
<p><span data-reactid=".5.2.$lazyPlaceholder_twitter_937541381916065796.2.2.0.0.0.4">The Dutch police had secretly seized Hansa and operated it for a time in order to gather more information about and ultimately arrest many of Hansa&#8217;s top drug sellers and buyers. </span></p>
<p><span data-reactid=".5.2.$lazyPlaceholder_twitter_937541381916065796.2.2.0.0.0.4">According to my source, information the Dutch cops gleaned from their Hansa takeover led authorities to identify and apprehend one of the owners of Leakbase. This information could not be confirmed, and the Dutch police have not yet responded to requests for comment. </span></p>
<p>A message posted Dec. 2 to Leakbase&#8217;s <a href="https://www.twitter.com/leakbasepw" target="_blank" rel="noopener">Twitter account</a> states that the service was being discontinued, and the final message posted to that account seems to offer paying customers some hope of recovering any unused balances stored with the site.</p>
<p><a class="lightbox" href="https://krebsonsecurity.com/?attachment_id=41765"><img class="aligncenter wp-image-41765" src="media/78e5964b.leakbasebye.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/leakbasebye.png" alt="" width="590" height="379" /></a></p>
<p>&#8220;We understand many of you may have lost some time, so in an effort to offer compensation please email, refund@leakbase.pw Send your LeakBase username and how much time you had left,&#8221; the message reads. &#8220;We will have a high influx of emails so be patient, this could take a while.&#8221;</p>
<p>My source noted that these last two messages are interesting because they are unlike every other update posted to the Leakbase Twitter account. Prior to the shutdown message on Dec. 2, all updates to that account were done via Twitter&#8217;s Web client; but the last two were sent via Mobile Web (M2).</p>
<p><span data-reactid=".5.2.$lazyPlaceholder_twitter_937541381916065796.2.2.0.0.0.0">Ironically, Leakbase was itself hacked back in April 2017 after a former administrator was found to be re-using a password from an account at <strong>x4b[dot]net</strong>, a service that Leakbase relied upon at the time to protect itself from distributed denial-of-service (DDoS) attacks intended to knock the site offline. </span></p>
<p><span data-reactid=".5.2.$lazyPlaceholder_twitter_937541381916065796.2.2.0.0.0.0"><a href="https://www.lowendtalk.com/discussion/111783/x4b-net-compromised" target="_blank" rel="noopener">X4B[dot]net was hacked</a> just days before the Leakbase intrusion, and soon after cleartext passwords and usernames from hundreds of Leakbase users were <a href="https://forums.money.team/deface/leakbase.html" target="_blank" rel="noopener">posted online</a> by the hacker group calling itself the <a href="https://krebsonsecurity.com/?s=%22money+team%22&amp;x=0&amp;y=0" target="_blank" rel="noopener">Money Team</a>.</span></p>
<p>Many readers have questioned how it could be illegal to resell passwords that were leaked online in the wake of major data breaches. The argument here is generally that in most cases this information is already in the public domain and thus it can&#8217;t be a crime to index and resell it.</p>
<p>However, many legal experts see things differently. In February 2017, I wrote about clues that tied back to a real-life identity for <a href="https://krebsonsecurity.com/2017/02/who-ran-leakedsource-com/" target="_blank" rel="noopener">one of the alleged administrators of Leakedsource</a>, a very similar service (it&#8217;s worth noting that the subject of that story also was found out because he re-used the same credentials across multiple sites).</p>
<p>In the Leakedsource story, I interviewed <strong>Orin Kerr</strong>, director of the <a href="https://www.law.gwu.edu/cybersecurity" target="_blank" rel="noopener">Cybersecurity Law Initiative</a> at <strong>The George Washington University. </strong>Kerr told me that owners of services like Leakbase and Leakedsource could face criminal charges if prosecutors could show these services intended for the passwords that are for sale on the site to be used in the furtherance of a crime.</p>
<p>Kerr said trafficking in passwords is clearly a crime under the <a href="https://www.law.cornell.edu/uscode/text/18/1030" target="_blank" rel="noopener">Computer Fraud and Abuse Act</a> (CFAA).</p>
<p>Specifically, Section A6 of the CFAA, which makes it a crime to “<span class="chapeau">knowingly and with intent to defraud traffic in any password or similar information through which a computer may be accessed without authorization, if…</span>such trafficking affects interstate or foreign commerce.”</p>
<p>“CFAA quite clearly punishes password trafficking,” Kerr said. “The statute says the [accused] must be trafficking in passwords knowingly and with intent to defraud, or trying to further unauthorized access.”</p>


feed_id: https://krebsonsecurity.com/?p=41737
title: Anti-Skimmer Detector for Skimmer Scammers
uri: Anti-Skimmer-Detector-for-Skimmer-Scammers
url: https://krebsonsecurity.com/2017/12/anti-skimmer-detector-for-skimmer-scammers/
content:
<p>Crooks who make and deploy ATM skimmers are constantly engaged in a cat-and-mouse game with financial institutions, which deploy a variety of technological measures designed to defeat skimming devices. The latest innovation aimed at tipping the scales in favor of skimmer thieves is a small, battery powered device that provides crooks a digital readout indicating whether an ATM likely includes digital anti-skimming technology.</p>
<p>A well-known skimmer thief is marketing a product called &#8220;Smart Shield Detector&#8221; that claims to be able to detect a variety of electronic methods used by banks to foil ATM skimmers.</p>
<div align="center"><iframe src="https://www.youtube.com/embed/caklX1dDB2U" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>The device, which sells for $200, is called a &#8220;Smart Shield Detector,&#8221; and promises to detect &#8220;all kinds of noise shields, hidden shields, delayed shields and others!&#8221;</p>
<p>It appears to be a relatively simple machine that gives a digital numeric indicator of whether an ATM uses any of a variety of anti-skimming methods. One of the most common is known as &#8220;frequency jamming,&#8221; which uses electronic signals to scramble both the clock (timing) and the card data itself in a bid to confuse skimming devices.</p>
<p>&#8220;You will see current level within seconds!,&#8221; the seller enthuses in an online ad for the product, a snippet of which is shown above. &#8220;Available for sale after November 1st, market price 200usd. Preorders available at price 150usd/device. 2+ devices for your team &#8211; will give discounts.&#8221;</p>
<p>According to the individual selling the Smart Shield Detector, a readout of 15 or higher indicates the presence of some type of electronic shield or jamming technology &#8212; warning the skimmer thief to consider leaving that ATM alone and to find a less protected machine. In contrast, a score between 3-5 is meant to indicate &#8220;no shield,&#8221; i.e., that the ATM is ripe for compromise.<span id="more-41737"></span></p>
<p>KrebsOnSecurity shared this video with <strong>Charlie Harrow</strong>, solutions manager for ATM maker <strong>NCR Corp</strong>. Harrow called the device &#8220;very interesting&#8221; but said NCR doesn&#8217;t try to hide which of is ATM include anti-skimming technologies &#8212; such as those that claim to be detectable by the Smart Shield Detector.</p>
<p>&#8220;We don’t hide the fact that our ATMs are protected against this type of external skimming attack,&#8221; Harrow said. &#8220;Our Anti-Skimming product uses a uniquely shaped bezel so you can tell just by looking at the ATM that it is protected (if you know what you are looking for).&#8221;</p>
<p>Harrow added that NCR doesn&#8217;t rely on secrecy of design to protect its ATMs.</p>
<p>&#8220;The bad guys are skilled, resourced and determined enough that sooner or later they will figure out exactly what we have done, so the ATM has to be safe against a knowledgeable attacker,&#8221; he said. &#8220;That said, a little secret sauce doesn’t hurt, and can often be very effective in stopping specific attack [methods] in the short term, but it can’t be relied on to provide any long term protection.&#8221;</p>
<p>The best method for protecting yourself against ATM skimmers doesn&#8217;t require any fancy gadgets or technology at all: It involves merely <a href="https://krebsonsecurity.com/2012/09/a-handy-way-to-foil-atm-skimmer-scams/" target="_blank" rel="noopener">covering the PIN pad with your hand while you enter your PIN!</a></p>
<p>That&#8217;s because the vast majority of skimming attacks involve two components: A device that fits over or <a href="http://krebsonsecurity.com/2016/05/crooks-go-deep-with-deep-insert-skimmers/" target="_blank" rel="noopener">inside the card reader</a> and steals data from the card&#8217;s magnetic stripe, and a tiny hidden camera aimed at the PIN pad. While thieves who have compromised an ATM you used can still replicate your ATM card, the real value rests in your PIN, without which the thieves cannot easily drain your checking or savings account of cash.</p>
<p>Also, be aware of your physical surroundings while using an ATM; you&#8217;re probably more apt to get mugged physically than virtually at a cash machine. Finally, try to stick to cash machines that are physically installed inside of banks, as these tend to be much more challenging for thieves to compromise than stand-alone machines like those commonly found at convenience stores.</p>
<p>KrebsOnSecurity would like to thank <strong>Alex Holden</strong>, founder of Milwaukee, Wisc. based <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>, for sharing the above video.</p>
<p>Are you fascinated by skimming devices? Then check out my series, <a href="https://krebsonsecurity.com/all-about-skimmers/" target="_blank" rel="noopener">All About Skimmers</a>, which looks at all manner of skimming scams, from <a href="https://krebsonsecurity.com/2013/12/the-biggest-skimmers-of-all-fake-atms/" target="_blank" rel="noopener">fake ATMs</a> and <a href="https://krebsonsecurity.com/2013/03/cash-claws-fake-fascias-tampered-tickets/" target="_blank" rel="noopener">cash claws</a> to <a href="https://krebsonsecurity.com/2010/12/why-gsm-based-atm-skimmers-rule/" target="_blank" rel="noopener">PIN pad overlays</a> and <a href="https://krebsonsecurity.com/?s=pump+skimmer&amp;x=0&amp;y=0" target="_blank" rel="noopener">gas pump skimmers</a>.</p>


feed_id: https://krebsonsecurity.com/?p=41787
title: Phishers Are Upping Their Game. So Should You.
uri: Phishers-Are-Upping-Their-Game-So-Should-You
url: https://krebsonsecurity.com/2017/12/phishers-are-upping-their-game-so-should-you/
content:
<p>Not long ago, phishing attacks were fairly easy for the average Internet user to spot: Full of grammatical and spelling errors, and linking to phony bank or email logins at unencrypted (http:// vs. https://) Web pages. Increasingly, however, phishers are upping their game, polishing their copy and hosting scam pages over https:// connections &#8212; complete with the green lock icon in the browser address bar to make the fake sites appear more legitimate.</p>
<div id="attachment_41802" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/399daf90.PAYPALhttpsphish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/PAYPALhttpsphish.png"><img class="wp-image-41802" src="media/399daf90.PAYPALhttpsphish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/PAYPALhttpsphish.png" alt="" width="599" height="320" /></a><p class="wp-caption-text">A brand new (and live) PayPal phishing page that uses SSL (https://) to appear more legitimate.</p></div>
<p>According to <a href="https://info.phishlabs.com/blog/quarter-phishing-attacks-hosted-https-domains" target="_blank" rel="noopener">stats released this week</a> by anti-phishing firm <strong>Phishlabs</strong>, nearly 25 percent of all phishing sites in the third quarter of this year were hosted on HTTPS domains &#8212; almost double the percentage seen in the previous quarter.</p>
<p>&#8220;A year ago, less than three percent of phish were hosted on websites using SSL certificates,&#8221; wrote <strong>Crane Hassold</strong>, the company&#8217;s threat intelligence manager. &#8220;Two years ago, this figure was less than one percent.&#8221;</p>
<div id="attachment_41803" style="width: 609px" class="wp-caption aligncenter"><img class=" wp-image-41803" src="media/2250a21c.facebook2https.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/facebook2https.png" alt="" width="599" height="321" /><p class="wp-caption-text">A currently live Facebook phishing page that uses https.</p></div>
<p>As shown in the examples above (which KrebsOnSecurity found in just a few minutes of searching via phish site reporting service <a href="https://www.phishtank.com/" target="_blank" rel="noopener">Phishtank.com</a>), the most successful phishing sites tend to include not only their own SSL certificates but also a portion of the phished domain in the fake address.</p>
<p>Why are phishers more aggressively adopting HTTPS Web sites? Traditionally, many phishing pages are hosted on hacked, legitimate Web sites, in which case the attackers can leverage both the site&#8217;s good reputation and its SSL certificate.</p>
<p>Yet this, too, is changing, says Phishlabs&#8217; Hassold.</p>
<p>&#8220;An analysis of Q3 HTTPS phishing attacks against PayPal and Apple, the two primary targets of these attacks, indicates that nearly three-quarters of HTTPS phishing sites targeting them were hosted on maliciously-registered domains rather than compromised websites, which is substantially higher than the overall global rate,&#8221; he wrote. &#8220;<a href="media/78d434f4.APWG_Global_Phishing_Report_2015-2016.pdf" data-original-source="https://docs.apwg.org/reports/APWG_Global_Phishing_Report_2015-2016.pdf" target="_blank" rel="noreferrer noopener" data-ss1512504894="1">Based on data from 2016</a>, slightly less than half of all phishing sites were hosted on domains registered by a threat actor.&#8221;</p>
<p>Hassold posits that more phishers are moving to HTTPS because it helps increase the likelihood that users will trust that the site is legitimate. After all, your average Internet user has been taught for years to simply &#8220;look for the lock icon&#8221; in the browser address bar as assurance that a site is safe.</p>
<p>Perhaps this once was useful advice, but if so its reliability has waned over the years. In November, Phishlabs conducted a poll to see how many people actually knew the meaning of the green padlock that is associated with HTTPS websites.</p>
<p>&#8220;More than 80% of the respondents believed the green lock indicated that a website was either legitimate and/or safe, neither of which is true,&#8221; he wrote.<span id="more-41787"></span></p>
<p>What the green lock icon indicates is that the communication between your browser and the Web site in question is encrypted; it does little to ensure that you really are communicating with the site you believe you are visiting.</p>
<p>At a higher level, another reason phishers are more broadly adopting HTTPS is because more sites in general are using encryption: <a href="https://letsencrypt.org/stats/" target="_blank" rel="noreferrer noopener" data-ss1512504894="1">According to Let’s Encrypt</a>, 65% of web pages loaded by <strong>Firefox</strong> in November used HTTPS, compared to 45% at the end of 2016.</p>
<p>Also, phishers no longer need to cough up a nominal fee each time they wish to obtain a new SSL certificate. Indeed, Let&#8217;s Encrypt <a href="https://letsencrypt.org/" target="_blank" rel="noopener">now gives them away for free</a>.</p>
<p>The major Web browser makers all work diligently to index and block known phishing sites, but you can&#8217;t count on the browser to save you:</p>
<p>So what can you do to make sure you&#8217;re not the next phishing victim?</p>
<p><strong>Don’t take the bait: </strong>Most phishing attacks try to convince you that you need to act quickly to avoid some kind of loss, cost or pain, usually by clicking a link and “verifying” your account information, user name, password, etc. at a fake site. Emails that emphasize urgency should be always considered extremely suspect, and under no circumstances should you do anything suggested in the email.</p>
<p>Phishers count on spooking people into acting rashly because they know their scam sites have a finite lifetime; they may be shuttered at any moment. The best approach is to bookmark the sites that store your sensitive information; that way, if you receive an urgent communication that you&#8217;re unsure about, you can visit the site in question manually and log in that way. In general, it&#8217;s a bad idea to click on links in email.</p>
<p><strong>Links Lie</strong>: You’re a sucker if you take links at face value. For example, this might look like a link to <a href="http://bankofamerica.com.someotherpagethatsnotbankofamericacombut.youprobablywouldntbeabletotellthatunlessyoucutandpastedthelinksomewhereandreadfromtherighttotheleftfromthefirstslashafterhttpslash.slashandthengo.backwardsfromtheretothesecond.dot/" target="_blank" rel="noopener">Bank of America</a>, but I assure you it is not. To get an idea of where a link goes, hover over it with your mouse and then look in the bottom left corner of the browser window.</p>
<p>Yet, even this information often tells only part of the story, and some links can be trickier to decipher. For instance, many banks like to send links that include ridiculously long URLs which stretch far beyond the browser’s ability to show the entire thing when you hover over the link.</p>
<p>The most important part of a link is the “root” domain. To find that, look for the first slash (/) after the “http://” part, and then work backwards through the link until you reach the second dot; the part immediately to the right is the real domain to which that link will take you.</p>
<p><span id="more-9055"></span><strong>“From” Fields can be forged: </strong>Just because the message says in the “From:” field that it was sent by your bank doesn’t mean that it’s true. This information can be and frequently is forged.</p>
<p>If you want to discover who (or what) sent a message, you’ll need to examine the email’s “headers,” important data included in all email.  The headers contain a lot of information that can be overwhelming for the untrained eye, so they are often hidden by your email client or service provider, each of which may have different methods for letting users view or enable headers.</p>
<p>Describing succinctly how to read email headers with an eye toward thwarting spammers would require a separate tutorial, so I will link to a decent one already written at <a href="http://email.about.com/cs/spamgeneral/a/spam_headers.htm" target="_blank" rel="noopener">About.com</a>. Just know that taking the time to learn how to read headers is a useful skill that is well worth the effort.</p>
<p><strong>Keep in mind that phishing can take many forms:</strong> Why steal one set of login credentials for a single brand when you can steal them all? Increasingly, attackers are opting for approaches that allow them to install a password-snarfing Trojan that steals all of the sensitive data on victim PCs.</p>
<p>So be careful about clicking links, and don’t open attachments in emails you weren’t expecting, even if they appear to come from someone you know. Send a note back to the sender to verify the contents and that they really meant to send it. This step can be a pain, but I’m a stickler for it; I’ve been known to lecture people who send me press releases and other items as unrequested attachments.</p>
<p><strong>If you didn’t go looking for it, don’t install it:</strong> Password stealing malware doesn’t only come via email; quite often, it is distributed as a Facebook video that claims you need a special “codec” to view the embedded content. There are tons of variations of this scam. The point to remember is: If it wasn’t your idea to install something from the get-go, don’t do it.</p>
<p><strong>Lay traps: </strong>When you’ve mastered the basics above, consider setting traps for phishers, scammers and unscrupulous marketers. Some email providers — most notably <strong>Gmail</strong> — make this especially easy.</p>
<p>When you sign up at a site that requires an email address, think of a word or phrase that represents that site for you, and then add that with a “+” sign just to the left of the “@” sign in your email address. For example, if I were signing up at example.com, I might give my email address as krebsonsecurity+example@gmail.com. Then, I simply go back to Gmail and create a folder called “Example,” along with a new filter that sends any email addressed to that variation of my address to the Example folder.</p>
<p>That way, if anyone other than the company I gave this custom address to starts spamming or phishing it, that may be a clue that example.com shared my address with others (or that it got hacked!). I should note two caveats here. First, although this functionality is part of the email standard, not all email providers will recognize address variations like these. Also, many commercial Web sites freak out if they see anything other than numerals or letters, and may not permit the inclusion of a “+” sign in the email address field.</p>


feed_id: https://krebsonsecurity.com/?p=41839
title: Patch Tuesday, December 2017 Edition
uri: Patch-Tuesday-December-2017-Edition
url: https://krebsonsecurity.com/2017/12/patch-tuesday-december-2017-edition/
content:
<p>The final Patch Tuesday of the year is upon us, with <strong>Adobe</strong> and <strong>Microsoft</strong> each issuing security updates for their software once again. Redmond fixed problems with various flavors of <strong>Windows</strong>, <strong>Microsoft Edge</strong>, <strong>Office</strong>, <strong>Exchange</strong> and its <strong>Malware Protection Engine</strong>. And of course Adobe&#8217;s got another security update available for its <strong>Flash Player </strong>software.</p>
<p><img class="alignright wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="202" height="212" />The December patch batch addresses more than 30 vulnerabilities in Windows and related software. As per usual, a huge chunk of the updates from Microsoft tackle security problems with the Web browsers built into Windows.</p>
<p>Also in the batch today is an <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11937" target="_blank" rel="noopener">out-of-band update</a> that Microsoft first issued last week to fix a critical issue in its <strong>Malware Protection Engine</strong>, the component that drives the <strong>Windows Defender/Microsoft Security Essentials</strong> embedded in most modern versions of Windows, as well as <strong>Microsoft Endpoint Protection</strong>, and the <strong>Windows Intune Endpoint Protection</strong> anti-malware system.</p>
<p>Microsoft was reportedly made aware of the malware protection engine <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11937" target="_blank" rel="noopener">bug</a> by the U.K.&#8217;s <strong>National Cyber Security Centre</strong> (NCSC), a division of the <strong>Government Communications Headquarters</strong> &#8212; the United Kingdom&#8217;s main intelligence and security agency. As spooky as that sounds, Microsoft said it is not aware of active attacks exploiting this flaw.<span id="more-41839"></span></p>
<p>Microsoft said the flaw could be exploited via a booby-trapped file that gets scanned by the Windows anti-malware engine, such as an email or document. The issue is fixed in <em>version 1.1.14405.2 </em>of the engine. According to Microsoft, Windows users should already have the latest version because the anti-malware engine updates itself constantly. In any case, for detailed instructions on how to check whether your system has this update installed, see <a href="https://support.microsoft.com/kb/2510781" target="_blank" rel="noopener">this link</a>.</p>
<p>The Microsoft updates released today are available in one big batch from <strong>Windows Update</strong>, or automagically via Automatic Updates. If you don&#8217;t have <a href="https://support.microsoft.com/en-us/help/12373/windows-update-faq" target="_blank" rel="noopener">Automatic Updates</a> enabled, please visit Windows Update sometime soon (click the Start/Windows button, then type Windows Update).</p>
<p><img class="alignleft size-full wp-image-18875" src="media/18bb50f1.brokenflash-a.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="" width="211" height="180" />The newest Flash update from Adobe brings the player to <em>v. 28.0.0.126</em> on Windows, Macintosh, Linux and Chrome OS. Windows users who browse the Web with anything other than Internet Explorer may need to apply the Flash patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>
<p>Chrome and IE should auto-install the latest Flash version on browser restart (users may need to manually check for updates and/or restart the browser to get the latest Flash version). Chrome users may need to restart the browser to install or automatically download the latest version.</p>
<p>When in doubt, click the vertical three dot icon to the right of the URL bar, select “Help,” then “About Chrome”: If there is an update available, Chrome should install it then. Chrome will replace that three dot icon with an up-arrow inside of a circle when updates are waiting to be installed.</p>
<p>Standard disclaimer: Because Flash remains such a security risk, I continue to encourage readers to remove or hobble Flash Player unless and until it is needed for a specific site or purpose. More on that approach (as well as slightly less radical solutions ) can be found in <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank" rel="noopener">A Month Without Adobe Flash Player</a>. The short version is that you can probably get by without Flash installed and not miss it at all.</p>
<p>For readers still unwilling to cut the cord, there are half-measures that work almost as well. Fortunately, <a href="https://support.google.com/chrome/answer/108086?hl=en" target="_blank" rel="noopener">disabling Flash in Chrome</a> is simple enough. Paste “<a href="chrome://settings/content" target="_blank" rel="noopener">chrome://settings/content</a>” into a Chrome browser bar and then select “Flash” from the list of items. By default it should be set to “Ask first” before running Flash, although users also can disable Flash entirely here or whitelist and blacklist specific sites.</p>
<p>Another, perhaps less elegant, solution is to keep Flash installed in a browser that you don’t normally use, and then to only use that browser on sites that require it.</p>


feed_id: https://krebsonsecurity.com/?p=41717
title: Mirai IoT Botnet Co-Authors Plead Guilty
uri: Mirai-IoT-Botnet-Co-Authors-Plead-Guilty
url: https://krebsonsecurity.com/2017/12/mirai-iot-botnet-co-authors-plead-guilty/
content:
<p>The <strong>U.S. Justice Department</strong> on Tuesday unsealed the guilty pleas of <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank" rel="noopener">two men first identified in January 2017</a> by KrebsOnSecurity as the likely co-authors of <strong>Mirai</strong>, a malware strain that remotely enslaves so-called &#8220;Internet of Things&#8221; devices such as security cameras, routers, and digital video recorders for use in large scale attacks designed to knock Web sites and entire networks offline (including multiple major attacks against this site).</p>
<p>Entering guilty pleas for their roles in developing and using Mirai are 21-year-old <strong>Paras Jha</strong> from Fanwood, N.J. and <strong>Josiah White</strong>, 20, from Washington, Pennsylvania.<br />
<img class="aligncenter size-medium wp-image-41822" src="media/abff92d7.parasjhalinkedin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/parasjhalinkedin.png" alt="" width="580" height="295" /></p>
<p>Jha and White were co-founders of <strong>Protraf Solutions LLC</strong>, a company that specialized in mitigating large-scale DDoS attacks. Like firemen getting paid to put out the fires they started, Jha and White would target organizations with DDoS attacks and then either extort them for money to call off the attacks, or try to sell those companies services they claimed could uniquely help fend off the attacks.</p>
<h4>CLICK FRAUD BOTNET</h4>
<p>In addition, the Mirai co-creators pleaded guilty to charges of using their botnet to conduct <a href="https://en.wikipedia.org/wiki/Click_fraud" target="_blank" rel="noopener">click fraud</a> &#8212; a form of online advertising fraud that will cost Internet advertisers more than $16 billion this year, according to <a href="https://www.cnbc.com/2017/03/15/businesses-could-lose-164-billion-to-online-advert-fraud-in-2017.html" target="_blank" rel="noopener">estimates</a> from ad verification company <strong>Adloox. </strong></p>
<p>The plea agreements state that Jha, White and another person who also pleaded guilty to click fraud conspiracy charges &#8212; a New Orleans man named <strong>Dalton Norman</strong> &#8212; leased access to their botnet for the purposes of earning fraudulent advertising revenue through click fraud activity and renting out their botnet to other cybercriminals.</p>
<p>As part of this scheme, victim devices were used to transmit high volumes of requests to view web addresses associated with affiliate advertising content. Because the victim activity resembled legitimate views of these websites, the activity generated fraudulent profits through the sites hosting the advertising content, at the expense of online advertising companies.</p>
<p>Jha and his co-conspirators admitted receiving as part of the click fraud scheme approximately two hundred bitcoin, valued on January 29, 2017 at over $180,000.</p>
<p>Prosecutors say Norman personally earned over 30 bitcoin, valued on January 29, 2017 at approximately $27,000. The documents show that Norman helped Jha and White discover new, previously unknown vulnerabilities in IoT devices that could be used to beef up their Mirai botnet, which at its height grew to more than 300,000 hacked devices.</p>
<h4>MASSIVE ATTACKS</h4>
<p>The Mirai malware is responsible for coordinating some of the largest and most disruptive online attacks the Internet has ever witnessed. The biggest and first to gain widespread media attention <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank" rel="noopener">began on Sept. 20, 2016</a>, when KrebsOnSecurity came under a sustained distributed denial-of-service attack from more than 175,000 IoT devices (the size estimates come from <a href="media/0dcac5e1.sec17-antonakakis.pdf" data-original-source="https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-antonakakis.pdf" target="_blank" rel="noopener">this Usenix paper</a> (PDF) on the Mirai botnet evolution).</p>
<p>That September 2016 digital siege maxed out at 620 Gbps, almost twice the size of the next-largest attack that <strong>Akamai</strong> &#8212; my DDoS mitigation provider at the time &#8212; had ever seen.</p>
<p><span id="more-41717"></span></p>
<p>The attack continued for several days, prompting Akamai to <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank" rel="noopener">force my site off of their network</a> (they were providing the service pro bono, and the attack was starting to cause real problems for their paying customers). For several frustrating days this Web site went dark, until it was brought under the auspices of Google&#8217;s <a href="https://projectshield.withgoogle.com/public/" target="_blank" rel="noopener">Project Shield</a>, a program that protects journalists, dissidents and others who might face withering DDoS attacks and other forms of digital censorship because of their publications.</p>
<p>At the end of September 2016, just days after the attack on this site, the authors of Mirai &#8212; who collectively used the nickname &#8220;Anna Senpai&#8221; &#8212; <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank" rel="noopener">released the source code for their botnet</a>. Within days of its release there were multiple Mirai botnets all competing for the same pool of vulnerable IoT devices.</p>
<div id="attachment_36550" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36550" src="media/19f167bb.mirai-hf-580x232.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/10/mirai-hf-580x232.png" alt="" width="580" height="232" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/10/mirai-hf-580x232.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/10/mirai-hf-768x308.png 768w, https://krebsonsecurity.com/wp-content/uploads/2016/10/mirai-hf-940x377.png 940w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The Hackforums post that includes links to the Mirai source code.</p></div>
<p>Some of those Mirai botnets grew quite large and were used to launch hugely damaging attacks, including <a href="https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-reddit/" target="_blank" rel="noopener">the Oct. 21, 2016 assault against Internet infrastructure firm Dyn</a> that disrupted <strong>Twitter</strong>, <strong>Netflix</strong>, <strong>Reddit</strong> and a host of other sites for much of that day.</p>
<div id="attachment_36755" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36755" src="media/ba1a1d04.l3outage-580x330.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/10/l3outage-580x330.png" alt="" width="580" height="330" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/10/l3outage-580x330.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/10/l3outage-768x437.png 768w, https://krebsonsecurity.com/wp-content/uploads/2016/10/l3outage.png 778w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A depiction of the outages caused by the Mirai attacks on Dyn, an Internet infrastructure company. Source: Downdetector.com.</p></div>
<p>The leak of the Mirai source code led to the creation of dozens of copycat Mirai botnets, all of which were competing to commandeer the same finite number of vulnerable IoT devices. One particularly disruptive Mirai variant was used in extortion attacks against a number of banks and Internet service providers in the United Kingdom and Germany.</p>
<p>In July 2017, KrebsOnSecurity <a href="https://krebsonsecurity.com/2017/07/who-is-the-govrat-author-and-mirai-botmaster-bestbuy/" target="_blank" rel="noopener">published a story following digital clues</a> that pointed to a U.K. man named <strong>Daniel Kaye</strong> as the apparent perpetrator of those Mirai attacks. Kaye, who went by the hacker nickname &#8220;Bestbuy,&#8221; was <a href="https://krebsonsecurity.com/2017/07/suspended-sentence-for-mirai-botmaster-daniel-kaye/" target="_blank" rel="noopener">found guilty</a> in Germany of launching failed Mirai attacks that nevertheless knocked out Internet service for almost a million Deutsche Telekom customers, for which he was given a suspended sentence. Kaye is now on trial in the U.K. for allegedly extorting banks in exchange for calling off targeted DDoS attacks against them.</p>
<p>Not long after the Mirai source code was leaked, I began scouring cybercrime forums and interviewing people to see if there were any clues that might point to the real-life identities of Mirai&#8217;s creators.</p>
<p>On Jan 18, 2017, KrebsOnSecurity published the results of that four-month inquiry, <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank" rel="noopener">Who is Anna Senpai, the Mirai Worm Author?</a> The story is easily the longest in this site&#8217;s history, and it cited a bounty of clues pointing back to Jha and White &#8212; two of the men whose guilty pleas were announced today.</p>
<div id="attachment_37441" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-37441" src="media/b90e60aa.klabatweet-580x367.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/01/klabatweet-580x367.png" alt="" width="580" height="367" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/01/klabatweet-580x367.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/01/klabatweet-768x485.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/01/klabatweet-940x594.png 940w, https://krebsonsecurity.com/wp-content/uploads/2017/01/klabatweet.png 973w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A tweet from the founder and CTO of French hosting firm OVH, stating the intended target of the Sept. 2016 Mirai DDoS on his company.</p></div>
<p>According to my reporting, Jha and White primarily used their botnet to target online gaming servers &#8212; particularly those tied to the hugely popular game <strong>Minecraft</strong>. Around the same time as the attack on my site, French hosting provider OVH was hit with a much larger attack from the same Mirai botnet (see image above), and the CTO of OVH confirmed that the target of that attack was a Minecraft server hosted on his company&#8217;s network.</p>
<p>My January 2017 investigation also cited evidence and quotes from associates of Jha who said they suspected he was responsible for a series of DDoS attacks against <strong>Rutgers University</strong>:<strong> </strong>During the same year that Jha began studying at the university for a bachelor&#8217;s degree in computer science, the school&#8217;s servers came under repeated, massive attacks from Mirai.</p>
<p>With each DDoS against Rutgers, the attacker &#8212; using the nicknames “<a href="https://www.reddit.com/r/rutgers/comments/4qvc4g/ddos_on_rutgers/" target="_blank" rel="noopener">og_richard_stallman</a>,” “<strong>exfocus</strong>” and “<strong>ogexfocus</strong>,” &#8212; would taunt the university in online posts and media interviews, encouraging the school to spend the money to purchase some kind of DDoS mitigation service.</p>
<p>It remains unclear if Jha (and possibly others) may face separate charges in New Jersey related to his apparent Mirai attacks on Rutgers. According to a sparsely-detailed press release issued Tuesday afternoon, the Justice Department is slated to hold a media conference at 2 p.m. today with officials from Alaska (where these cases originate) to &#8220;discuss significant cybercrime cases.&#8221;</p>
<p><strong>Update: 11:43 a.m. ET:</strong> <em>The New Jersey Ledger</em> <a href="http://www.nj.com/education/2017/12/rutgers_student_charged_in_series_of_cyber_attacks.html#incart_river_mobile_home" target="_blank" rel="noopener">just published a story</a> confirming that Jha also has pleaded guilty to the Rutgers DDoS attacks, as part of a separate case lodged by prosecutors in New Jersey.</p>
<h4>PAYBACK</h4>
<p>Under the terms of his guilty plea in the click fraud conspiracy, Jha agreed to give up 13 bitcoin, which at current market value of bitcoin (~$17,000 apiece) is nearly USD $225,000.</p>
<p>Jha will also waive all rights to appeal the conviction and whatever sentence gets imposed as a result of the plea. For the click fraud conspiracy charges, Jha, White and Norman each face up to five years in prison and a $250,000 fine.</p>
<p>In connection with their roles in creating and ultimately unleashing the Mirai botnet code, Jha and White each pleaded guilty to one count of conspiracy to violate <a href="https://www.law.cornell.edu/uscode/text/18/1030" target="_blank" rel="noopener">18 U.S.C. 1030(a)(5)(A)</a>. That is, to &#8220;causing intentional damage to a protected computer, to knowingly causing the transmission of a program, code, or command to a computer with the intention of impairing without authorization the integrity or availability of data, a program, system, or information.&#8221;</p>
<p>For the conspiracy charges related to their authorship and use of Mirai, Jha and White likewise face up to five years in prison, a $250,000 fine, and three years of supervised release.</p>
<p>This is a developing story. Check back later in the day for updates from the DOJ press conference, and later in the week for a follow-up piece on some of the lesser-known details of these investigations.</p>
<p>The Justice Department unsealed the documents related to these cases late in the day on Tuesday. Here they are:</p>
<p><a href="media/3c7af7ec.Jha1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/Jha1.pdf" target="_blank" rel="noopener">Jha click fraud complaint</a> (PDF)<br />
<a href="media/f9e69ccb.jhacf-plea.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/jhacf-plea.pdf" target="_blank" rel="noopener">Jha click fraud plea</a> (PDF)<br />
<a href="media/797a9bd0.Jha-DDoS.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/Jha-DDoS.pdf" target="_blank" rel="noopener">Jha DDoS/Mirai complaint</a> (PDF)<br />
<a href="media/8c9ac966.Jha-DDoS-Plea.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/Jha-DDoS-Plea.pdf" target="_blank" rel="noopener">Jha DDoS/Mirai plea</a> (PDF)<br />
<a href="media/1e01573f.JWhite-DDoS.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/JWhite-DDoS.pdf" target="_blank" rel="noopener">White DDoS complaint</a> (PDF)<br />
<a href="media/d6598997.whiteddosplea.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/whiteddosplea.pdf" target="_blank" rel="noopener">White DDoS/Mirai Plea</a> (PDF)<br />
<a href="media/e609ac0d.Norman-Clickfraud.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/Norman-Clickfraud.pdf" target="_blank" rel="noopener">Norman click fraud complaint</a> (PDF)<br />
<a href="media/635ce683.NormanPlea.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/NormanPlea.pdf" target="_blank" rel="noopener">Norman click fraud plea</a> (PDF)</p>


feed_id: https://krebsonsecurity.com/?p=41892
title: Former Botmaster, ‘Darkode’ Founder is CTO of Hacked Bitcoin Mining Firm ‘NiceHash’
uri: Former-Botmaster-Darkode-Founder-is-CTO-of-Hacked-Bitcoin-Minin
url:
https://krebsonsecurity.com/2017/12/former-botmaster-darkode-founder-is-cto-of-hacked-bitcoin-mining-firm-nicehash/

content:
<p>On Dec. 6, 2017, approximately USD $52 million worth of Bitcoin mysteriously disappeared from the coffers of <strong>NiceHash</strong>, a Slovenian company that lets users sell their computing power to help others mine virtual currencies. As the investigation into the heist nears the end of its second week, many Nice-Hash users have expressed surprise to learn that the company&#8217;s chief technology officer recently served several years in prison for operating and reselling a massive botnet, and for creating and running &#8216;<strong>Darkode</strong>,&#8221; until recently the world&#8217;s most bustling English-language cybercrime forum.</p>
<p>In December 2013, NiceHash CTO <strong>Matjaž Škorjanc</strong> was sentenced to four years, ten months in prison for creating the malware that powered the &#8216;<strong>Mariposa</strong>&#8216; botnet. Spanish for &#8220;Butterfly,&#8221; Mariposa was a potent crime machine first spotted in 2008. Very soon after, Mariposa was estimated to have infected more than 1 million hacked computers &#8212; making it one of the largest botnets ever created.</p>
<div id="attachment_1451" style="width: 610px" class="wp-caption aligncenter"><img class=" wp-image-1451" src="media/93b3e31f.Screen-shot-2010-03-03-at-7.08.09-PM.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2010/03/Screen-shot-2010-03-03-at-7.08.09-PM.png" alt="" width="600" height="331" srcset="https://krebsonsecurity.com/wp-content/uploads/2010/03/Screen-shot-2010-03-03-at-7.08.09-PM.png 962w, https://krebsonsecurity.com/wp-content/uploads/2010/03/Screen-shot-2010-03-03-at-7.08.09-PM-300x165.png 300w" sizes="(max-width: 600px) 100vw, 600px" /><p class="wp-caption-text">An advertisement for the ButterFly Flooder, a crimeware product based on the ButterFly Bot.</p></div>
<p>ButterFly Bot, as it was more commonly known to users, was a plug-and-play malware strain that allowed even the most novice of would-be cybercriminals to set up a global operation capable of harvesting data from thousands of infected PCs, and using the enslaved systems for crippling attacks on Web sites. The ButterFly Bot kit sold for prices ranging from $500 to $2,000.</p>
<p>Prior to his initial arrest in Slovenia on cybercrime charges in 2010, Škorjanc was best known to his associates as &#8220;<strong>Iserdo</strong>,&#8221; the administrator and founder of the exclusive cybercrime forum Darkode.</p>
<div id="attachment_12535" style="width: 603px" class="wp-caption aligncenter"><img class=" wp-image-12535" src="media/9258dd4f.BFFsupportwarning.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2011/11/BFFsupportwarning.jpg" alt="" width="593" height="331" srcset="https://krebsonsecurity.com/wp-content/uploads/2011/11/BFFsupportwarning.jpg 906w, https://krebsonsecurity.com/wp-content/uploads/2011/11/BFFsupportwarning-300x167.jpg 300w" sizes="(max-width: 593px) 100vw, 593px" /><p class="wp-caption-text">A message from Iserdo warning Butterfly Bot subscribers not to try to reverse his code.</p></div>
<p>On Darkode, Iserdo sold his Butterfly Bot to dozens of other members, who used it for a variety of illicit purposes, from stealing passwords and credit card numbers from infected machines to blasting spam emails and hijacking victim search results. Microsoft Windows PCs infected with the bot would then try to spread the disease over MSN Instant Messenger and peer-to-peer file sharing networks.</p>
<p><img class="aligncenter size-medium wp-image-31625" src="media/316580af.dkhome-580x618.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/07/dkhome-580x618.png" alt="" width="580" height="618" srcset="https://krebsonsecurity.com/wp-content/uploads/2015/07/dkhome-580x618.png 580w, https://krebsonsecurity.com/wp-content/uploads/2015/07/dkhome.png 690w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>In July 2015, authorities in the United States and elsewhere <a href="https://krebsonsecurity.com/2015/07/the-darkode-cybercrime-forum-up-close/" target="_blank" rel="noopener">conducted a global takedown of the Darkode crime forum</a>, arresting several of its top members in the process. The U.S. Justice Department at the time <a href="https://www.justice.gov/opa/pr/major-computer-hacking-forum-dismantled" target="_blank" rel="noopener">said</a> that out of 800 or so crime forums worldwide, Darkode represented &#8220;one of the gravest threats to the integrity of data on computers in the United States and around the world and was the most sophisticated English-speaking forum for criminal computer hackers in the world.&#8221;</p>
<p>Following Škorjanc&#8217;s arrest, Slovenian media <a href="https://www.vecer.com/iserdova-mati-ni-prala-denarja-6261177" target="_blank" rel="noopener">reported</a> that his mother <strong>Zdenka Škorjanc</strong> was accused of money laundering; prosecutors found that several thousand euros were sent to her bank account by her son. That case was dismissed in May of this year after prosecutors conceded she probably didn&#8217;t know how her son had obtained the money.</p>
<p>Matjaž<strong> </strong>Škorjanc did not respond to requests for comment. But local media reports state that he has vehemently denied any involvement in the disappearance of the NiceHash stash of Bitcoins.</p>
<p>In <a href="http://www.delo.si/gospodarstvo/podjetja/ekskluzivno-matjaz-skorjanc-nicehash-o-kraji-bitcoinov.html" target="_blank" rel="noopener">an interview</a> with Slovenian news outlet <strong>Delo.si</strong>, the NiceHash CTO described the theft &#8220;as if his kid was kidnapped and his extremities would be cut off in front of his eyes.&#8221; A roughly-translated English version of that interview has been <a href="https://www.reddit.com/r/NiceHash/comments/7ilq73/exclusive_interview_with_matjaz_skorjanc_from/" target="_blank" rel="noopener">posted to Reddit</a>.<span id="more-41892"></span></p>
<p>According to media reports, the intruders were able to execute their heist after stealing the credentials of a user with administrator privileges at NiceHash. Less than an hour after breaking into the NiceHash servers, approximately 4,465 Bitcoins were transferred out of the company&#8217;s accounts.</p>
<div id="attachment_41897" style="width: 609px" class="wp-caption aligncenter"><img class="wp-image-41897" src="media/475eee20.matjaz-delo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/matjaz-delo.png" alt="" width="599" height="740" /><p class="wp-caption-text">NiceHash CTO Matjaž Škorjanc, as pictured on the front page of a recent edition of the Slovenian daily Delo.si</p></div>
<p>A source close to the investigation told KrebsOnSecurity that the NiceHash hackers used a virtual private network (VPN) connection with a Korean Internet address, although the source said Slovenian investigators were reluctant to say whether that meant South Korea or North Korea because they did not want to spook the perpetrators into further covering their tracks.</p>
<p><a href="http://money.cnn.com/2017/12/12/technology/north-korea-bitcoin-hoard/index.html" target="_blank" rel="noopener">CNN</a>, <a href="https://www.bloomberg.com/news/articles/2017-12-14/north-korea-s-bitcoin-play" target="_blank" rel="noopener">Bloomberg</a> and a number of other Western media outlets reported this week that North Korean hackers have recently doubled down on efforts to steal, phish and extort Bitcoins as the price of the currency has surged in recent weeks.</p>
<p>&#8220;North Korean hackers targeted four different exchanges that trade bitcoin and other digital currencies in South Korea in July and August, sending malicious emails to employees, according to police,&#8221; CNN reported.</p>
<p>Bitcoin&#8217;s blockchain ledger system makes it easy to see when funds are moved, and NiceHash customers who lost money in the theft have been keeping a close eye on the Bitcoin payment address that received the stolen funds ever since. On Dec. 13, someone in control of that account began transferring the stolen bitcoins to other accounts, according to <a href="https://bitinfocharts.com/bitcoin/address/1EnJHhq8Jq8vDuZA5ahVh6H4t6jh1mB4rq" target="_blank" rel="noopener">this transaction record</a>.</p>
<p>The NiceHash theft occurred as the price of Bitcoin was skyrocketing to new highs. On January 1, 2017, a single Bitcoin was worth approximately $976. On December 6, the day of the NiceHash hack, had ballooned to $11,831.</p>
<p>Today, a single Bitcoin can be sold for more than $17,700, meaning whoever is responsible for the NiceHash hack has seen their loot increase in value by roughly $27 million since the theft.</p>
<p>In a post on <a href="https://www.nicehash.com/" target="_blank" rel="noopener">its homepage</a>, NiceHash said it was in the final stages of re-launching the surrogate mining service.</p>
<blockquote><p>&#8220;Your bitcoins were stolen and we are working with international law enforcement agencies to identify the attackers and recover the stolen funds. We understand it may take some time and we are working on a solution for all users that were affected.</p>
<p>&#8220;If you have any information about the attack, please email us at <a href="https://www.nicehash.com/cdn-cgi/l/email-protection#0e7a677e4e60676d6b666f7d66206d6163" data-ss1513351555="1"><span class="__cf_email__" data-cfemail="04706d74446a6d67616c65776c2a676b69">[email protected]</span></a>. We are giving BTC rewards for the best information received. You can also join our community page about the attack on <a href="https://www.reddit.com/r/NiceHashHack/" target="_blank" rel="noreferrer noopener" data-ss1513351555="1">reddit.</a>&#8220;</p></blockquote>
<p>However, many followers of <a href="https://twitter.com/NiceHashMining/status/941670265146224642" target="_blank" rel="noopener">NiceHash&#8217;s Twitter account</a> said they would not be returning to the service unless and until their stolen Bitcoins were returned.</p>


feed_id: https://krebsonsecurity.com/?p=41921
title: The Market for Stolen Account Credentials
uri: The-Market-for-Stolen-Account-Credentials
url: https://krebsonsecurity.com/2017/12/the-market-for-stolen-account-credentials/
content:
<p>Past stories here have explored the myriad <a href="https://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hacked-pc-revisited/" target="_blank" rel="noopener">criminal uses of a hacked computer</a>, the various ways that <a href="https://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank" rel="noopener">your inbox can be spliced and diced</a> to help cybercrooks ply their trade, and <a href="https://krebsonsecurity.com/2016/07/the-value-of-a-hacked-company/" target="_blank" rel="noopener">the value of a hacked company</a>. Today&#8217;s post looks at the price of stolen credentials for just about any e-commerce, bank site or popular online service, and provides a glimpse into the fortunes that an enterprising credential thief can earn selling these accounts on consignment.</p>
<p>Not long ago in Internet time, your typical cybercriminal looking for access to a specific password-protected Web site would most likely visit an underground forum and ping one of several miscreants who routinely leased access to their &#8220;bot logs.&#8221;</p>
<p>These bot log sellers were essentially criminals who ran large botnets (collections of hacked PCs) powered by malware that can snarf any passwords stored in the victim&#8217;s Web browser or credentials submitted into a Web-based login form. For a few dollars in virtual currency, a ne&#8217;er-do-well could buy access to these logs, or else he and the botmaster would agree in advance upon a price for any specific account credentials sought by the buyer.</p>
<p>Back then, most of the stolen credentials that a botmaster might have in his possession typically went unused or unsold (aside from the occasional bank login that led to a juicy high-value account). Indeed, these plentiful commodities held by the botmaster for the most part were simply not a super profitable line of business and so went largely wasted, like bits of digital detritus left on the cutting room floor.</p>
<p>But oh, how times have changed! With dozens of sites in the underground now competing to purchase and resell credentials for a variety of online locations, it has never been easier for a botmaster to earn a handsome living based solely on the sale of stolen usernames and passwords alone.</p>
<p>If the old adage about a picture being worth a thousand words is true, the one directly below is priceless because it illustrates just how profitable the credential resale business has become.</p>
<div id="attachment_41932" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/fcb2f5fc.stufferpanel-Copy.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/stufferpanel-Copy.png"><img class="wp-image-41932" src="media/fcb2f5fc.stufferpanel-Copy.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/stufferpanel-Copy.png" alt="" width="599" height="379" /></a><p class="wp-caption-text">This screen shot shows the earnings panel of a crook who sells stolen credentials for hundreds of Web sites to a dark web service that resells them. This botmaster only gets paid when someone buys one of his credentials. So far this year, customers of this service have purchased more than 35,000 credentials he&#8217;s sold to this service, earning him more than $288,000 in just a few months.</p></div>
<p>The image shown above is the wholesaler division of &#8220;<strong>Carder&#8217;s Paradise</strong>,&#8221; a bustling dark web service that sells credentials for hundreds of popular Web destinations. The screen shot above is an earnings panel akin to what you would see if you were a seller of stolen credentials to this service &#8212; hence the designation &#8220;<strong>Seller&#8217;s Paradise</strong>&#8221; in the upper left hand corner of the screen shot.</p>
<p>This screen shot was taken from the logged-in account belonging to one of the more successful vendors at Carder&#8217;s Paradise. We can see that in just the first seven months of 2017, this botmaster sold approximately 35,000 credential pairs via the Carder&#8217;s Paradise market, earning him more than $288,000. That&#8217;s an average of $8.19 cents for each credential sold through the service.</p>
<p>Bear in mind that this botmaster <em>only makes money based on consignment</em>: Regardless of how much he uploads to Seller&#8217;s Paradise, he doesn&#8217;t get paid for any of it unless a Seller&#8217;s Paradise customer chooses to buy what he&#8217;s selling.</p>
<p>Fortunately for this guy, almost 9,000 different customers of Seller&#8217;s Paradise chose to purchase one or more of his username and password pairs. It was not possible to tell from this seller&#8217;s account how many credential pairs total that he has contributed to this service which went unsold, but it&#8217;s a safe bet that it was far more than 35,000.</p>
<p>[A side note is in order here because there is some delicious irony in the backstory behind the screenshot above: The only reason a source of mine was able to share it with me was because this particular seller re-used the same email address and password across multiple unrelated cybercrime services].<span id="more-41921"></span></p>
<p>Based on the prices advertised at Carder&#8217;s Paradise (again, Carder&#8217;s Paradise is the <em>retail/customer side of Seller&#8217;s Paradise) </em>we can see that the service on average pays its suppliers about half what it charges customers for each credential. The average price of a credential for more than 200 different e-commerce and banking sites sold through this service is approximately $15.</p>
<div id="attachment_41943" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/9bfb8727.cp-accounts.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/cp-accounts.png"><img class="wp-image-41943" src="media/9bfb8727.cp-accounts.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/cp-accounts.png" alt="" width="599" height="423" /></a><p class="wp-caption-text">Part of the price list for credentials sold at this dark web ID theft site.</p></div>
<p>Indeed, fifteen bucks is exactly what it costs to buy stolen logins for <strong>airbnb.com</strong>, <strong>comcast.com</strong>, <strong>creditkarma.com</strong>, <strong>logmein.com</strong> and <strong>uber.com</strong>. A credential pair from <strong>AT&amp;T Wireless</strong> &#8212; combined with access to the victim&#8217;s email inbox &#8212; sells for $30.</p>
<p>The most expensive credentials for sale via this service are those for the electronics store <strong>frys.com</strong> ($190). I&#8217;m not sure why these credentials are so much more expensive than the rest, but it may be because thieves have figured out a reliable and very profitable way to convert stolen frys.com customer credentials into cash.</p>
<p>Usernames and passwords to active accounts at military personnel-only credit union <strong>NavyFederal.com</strong> fetch $60 apiece, while credentials to various legal and data aggregation services from <strong>Thomson Reuters</strong> properties command a $50 price tag.</p>
<p>The full price list of credentials for sale by this dark web service is available in <a href="media/bf4ae98d.cardersparadise.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/cardersparadise.pdf" target="_blank" rel="noopener">this PDF</a>. For CSV format, <a href="https://krebsonsecurity.com/wp-content/uploads/2017/12/cardersparadise.csv" target="_blank" rel="noopener">see this link</a>. Both lists are sorted alphabetically by Web site name.</p>
<p>This service doesn&#8217;t just sell credentials: It also peddles entire identities &#8212; indexed and priced according to the unwitting victim&#8217;s <a href="https://www.investopedia.com/terms/f/ficoscore.asp" target="_blank" rel="noopener">FICO score</a>. An identity with a perfect credit score (850) can demand as much as $150.</p>
<div id="attachment_41940" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/1629df64.ssnwithreport.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/ssnwithreport.png"><img class="wp-image-41940" src="media/1629df64.ssnwithreport.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/ssnwithreport.png" alt="" width="596" height="272" /></a><p class="wp-caption-text">Stolen identities with high credit scores fetch higher prices.</p></div>
<p>And of course this service also offers the ability to pull full credit reports on virtually any American &#8212; from all three major credit bureaus &#8212; for just $35 per bureau.</p>
<div id="attachment_41939" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/693253e2.cp-pullcreditreport.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/cp-pullcreditreport.png"><img class="wp-image-41939" src="media/693253e2.cp-pullcreditreport.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/cp-pullcreditreport.png" alt="" width="600" height="258" /></a><p class="wp-caption-text">It costs $35 through this service to pull someone&#8217;s credit file from the three major credit bureaus.</p></div>
<p>Plenty of people began freaking out earlier this year after <a href="https://krebsonsecurity.com/?s=equifax+breach&amp;x=0&amp;y=0" target="_blank" rel="noopener">a breach at big-three credit bureau Equifax</a> jeopardized the Social Security Numbers, dates of birth and other sensitive date on more than 145 million Americans. But as I have been trying to tell readers for many years, this data is broadly available for sale in the cybercrime underground on a significant portion of the American populace.</p>
<p>If the threat of identity theft has you spooked, place a freeze on your credit file and on the file of your spouse (you may even be able to <a href="https://krebsonsecurity.com/2016/01/the-lowdown-on-freezing-your-kids-credit/" target="_blank" rel="noopener">do this for your kids</a>). Credit monitoring is useful for letting you know when someone has stolen your identity, but these services can&#8217;t be counted on to stop an ID thief from opening new lines of credit in your name.</p>
<p>They are, however, useful for helping to clean up identity theft after-the-fact. This story is already too long to go into the pros and cons of credit monitoring vs. freezes, so I&#8217;ll instead <a href="https://krebsonsecurity.com/2017/09/the-equifax-breach-what-you-should-know/" target="_blank" rel="noopener">point to a recent primer on the topic</a> and urge readers to check it out.</p>
<p>Finally, it&#8217;s a super bad idea to re-use passwords across multiple sites. KrebsOnSecurity this year has written about multiple, competing services that sell or sold access to billions of usernames and passwords exposed in high profile data breaches at places like Linkedin, Dropbox and Myspace. Crooks pay for access to these stolen credential services because they know that a decent percentage of Internet users recycle the same password at multiple sites.</p>
<p>One alternative to creating and remembering strong, lengthy and complex passwords for every important site you deal with is to outsource this headache to <a href="https://www.howtogeek.com/141500/why-you-should-use-a-password-manager-and-how-to-get-started/" target="_blank" rel="noopener">a password manager</a>.  If the online account in question allows <a href="https://twofactorauth.org/" target="_blank" rel="noopener">2-factor authentication (2FA)</a>, be sure to take advantage of that.</p>
<p>Two-factor authentication makes it much harder for password thieves (or their customers) to hack into your account just by stealing or buying your password: If you have 2FA enabled, they also would need to hack that second factor (usually your mobile device) before being able to access your account. For a list of sites that support 2FA, check out <a href="https://www.twofactorauth.org" target="_blank" rel="noopener">twofactorauth.org.</a></p>


feed_id: https://krebsonsecurity.com/?p=41963
title: Buyers Beware of Tampered Gift Cards
uri: Buyers-Beware-of-Tampered-Gift-Cards
url: https://krebsonsecurity.com/2017/12/buyers-beware-of-tampered-gift-cards/
content:
<p>Prepaid gift cards make popular presents and no-brainer stocking stuffers, but before you purchase one be on the lookout for signs that someone may have tampered with it. A perennial scam that picks up around the holidays involves thieves who pull back and then replace the decals that obscure the card&#8217;s redemption code, allowing them to redeem or transfer the card&#8217;s balance online after the card is purchased by an unwitting customer.</p>
<p>Last week KrebsOnSecurity heard from Colorado reader <strong>Flint Gatrell</strong>, who reached out after finding that a bunch of Sam&#8217;s Club gift cards he pulled off the display rack at Wal-Mart showed signs of compromise. The redemption code was obscured by a watermarked sticker that is supposed to make it obvious if it has been tampered with, and many of the cards he looked at clearly had stickers that had been peeled back and then replaced.</p>
<p>&#8220;I just identified five fraudulent gift cards on display at my local Wal-Mart,&#8221; Gatrell said. &#8220;They each had their stickers covering their codes peeled back and replaced. I can only guess that the thieves call the service number to monitor the balances, and try to consume them before the victims can.  I&#8217;m just glad I thought to check!&#8221;</p>
<div dir="auto">In the picture below, Gatrell is holding up three of the Sam&#8217;s Club cards. The top two showed signs of tampering, but the one on the bottom appeared to be intact.</div>
<div dir="auto"></div>
<div dir="auto">
<div id="attachment_41972" style="width: 610px" class="wp-caption aligncenter"><img class=" wp-image-41972" src="media/b40c7a50.giftcardtamper.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/giftcardtamper.png" alt="" width="600" height="593" /><p class="wp-caption-text">The top two gift cards show signs that someone previously peeled back the protective sticker covering the redemption code. Image: Flint Gatrell.</p></div>
</div>
<p><span id="more-41963"></span></p>
<p><strong>Kevin Morrison</strong>, a senior analyst on the retail banking and payments team at market analysis firm <a href="https://www.aitegroup.com/" target="_blank" rel="noopener">Aite Group</a>, said the gift card scheme is not new but that it does tend to increase in frequency around the holidays, when demand for the cards is far higher.</p>
<p>&#8220;Store employees are instructed to look for abnormalities at the [register] but this happens [more] around the holiday season as attention spans tend to shorten,&#8221; he said. &#8220;While <span class="il">gift</span> <span class="il">card </span>packaging has improved and some safe-guards put in place, fraudsters look for the weakest link and hit hard when they find one.&#8221;</p>
<p>Gift cards make great last-minute gifts, but don&#8217;t let your guard down in your haste to wrap up your holiday shopping. There are so many variations on the above-described scheme that many stores have taken to keeping gift cards at or behind the register, where cashiers can more easily spot customers trying to tamper with the cards. As a result, stores that take this basic precaution may be the safest place to purchase gift cards.</p>


feed_id: https://krebsonsecurity.com/?p=41980
title: U.K. Man Avoids Jail Time in vDOS Case
uri: U-K-Man-Avoids-Jail-Time-in-vDOS-Case
url: https://krebsonsecurity.com/2017/12/u-k-man-avoids-jail-time-in-vdos-case/
content:
<p>A U.K. man who pleaded guilty to launching more than 2,000 cyberattacks against some of the world&#8217;s largest companies has avoided jail time for his role in the attacks. The judge in the case reportedly was moved by pleas for leniency that cited the man&#8217;s youth at the time of the attacks and a diagnosis of autism.</p>
<p>In early July 2017, the West Midlands Police in the U.K. <a href="https://www.west-midlands.police.uk/news/3065/student-court-over-global-web-attack-business" target="_blank" rel="noopener">arrested</a> 19-year-old Stockport resident <strong>Jack Chappell</strong> and charged him with using a now-defunct attack-for-hire service called <strong>vDOS</strong> to launch attacks against the Web sites of <strong>Amazon</strong>, <strong>BBC</strong>, <strong>BT</strong>, <strong>Netflix</strong>, <strong>T-Mobile</strong>, <strong>Virgin Media</strong>, and <strong>Vodafone</strong>, between May 1, 2015 and April 30, 2016.</p>
<div id="attachment_41981" style="width: 609px" class="wp-caption aligncenter"><img class=" wp-image-41981" src="media/5ed62fcf.chappell.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/chappell.png" alt="" width="599" height="133" /><p class="wp-caption-text">One of several taunting tweets Chappell sent to his DDoS victims.</p></div>
<p>Chappell also helped launder money for vDOS, which until its demise in September 2016 was by far the most popular and powerful attack-for-hire service &#8212; allowing even completely unskilled Internet users to launch crippling assaults capable of knocking most Web sites offline.</p>
<p>Using the Twitter handle <strong>@fractal_warrior</strong>, Chappell would taunt his victims while  launching attacks against them. The tweet below was among several sent to the <a href="https://www.jisc.ac.uk/janet" target="_blank" rel="noopener">Jisc Janet educational support network</a> and Manchester College, where Chappell was a student. In total, Chappell attacked his school at least 21 times, prosecutors showed.</p>
<div id="attachment_41982" style="width: 608px" class="wp-caption aligncenter"><img class=" wp-image-41982" src="media/f2f93775.chapp2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/chapp2.png" alt="" width="598" height="245" /><p class="wp-caption-text">Another taunting Chappell tweet.</p></div>
<p>Chappell was arrested in April 2016 after investigators traced his Internet address to his home in the U.K. For more on the clues that likely led to his arrest, <a href="https://krebsonsecurity.com/2017/11/correcting-the-record-on-vdos-prosecutions/" target="_blank" rel="noopener">check out this story</a>.</p>
<p>Nevertheless, the judge in the case was moved by pleas from Chappell&#8217;s lawyer, who argued that his client was just an impressionable youth at the time who has <a href="https://www.autismspeaks.org/what-autism" target="_blank" rel="noopener">autism</a>, a range of conditions characterized by challenges with social skills, repetitive behaviors, speech and nonverbal communication.</p>
<p>The defense called on an expert who reportedly testified that Chappell was &#8220;one of the most talented people with a computer he had ever seen.&#8221;</p>
<p>&#8220;He is in some ways as much of a victim, he has been exploited and used,&#8221; Chappell&#8217;s attorney <strong>Stuart Kaufman</strong> told the court, according to the <a href="http://www.manchestereveningnews.co.uk/news/greater-manchester-news/cyber-attack-teenager-who-helped-14058060" target="_blank" rel="noopener">Manchester Evening News</a>. &#8220;He is not malicious, he is mischievous.&#8221;</p>
<p>The same publication quoted <strong>Judge Maurice Greene</strong> at Chappell&#8217;s sentencing this week, saying to the young man: “You were undoubtedly taken advantage of by those more criminally sophisticated than yourself. You would be extremely vulnerable in a custodial element.”</p>
<p>Judge Greene decided to suspend a sentence of 16 months at a young offenders institution; Chappell will instead &#8220;undertake 20 days rehabilitation activity,&#8221; although it&#8217;s unclear exactly what that will entail.</p>
<h4>ANALYSIS/RANT</h4>
<p>It&#8217;s remarkable when someone so willingly and gleefully involved in a crime spree such as this can emerge from it looking like the victim. &#8220;Autistic Hacker Had Been Exploited,&#8221; declared <a href="https://www.thetimes.co.uk/article/autistic-hacker-jack-chappell-had-been-exploited-kx8vwh829" target="_blank" rel="noopener">a headline</a> about the sentence in the U.K. newspaper <em>The Times</em>.</p>
<p>After reading the coverage of this case in the press, I half expected to see another story saying someone had pinned a medal on Chappell or offered him a job. <span id="more-41980"></span></p>
<div id="attachment_41606" style="width: 290px" class="wp-caption alignright"><img class=" wp-image-41606" src="media/71fb8ba8.jchappell.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/jchappell.png" alt="" width="280" height="188" /><p class="wp-caption-text">Jack Chappell, outside of a court hearing in the U.K. earlier this year.</p></div>
<p>Yes, Chappell will have the stain of a criminal conviction on his record, and yes autism can be a very serious and often debilitating illness. Let me be clear: I am not suggesting that offenders like this young man should be tossed in jail with violent criminals.</p>
<p>But courts around the world continue to send a clear message that young men essentially can do whatever they like when it comes to DDoS attacks and that there will be no serious consequences as a result.</p>
<p>Chappell launched his attacks via vDOS, which provided a simple, point-and-click service that allowed even completely unskilled Internet users to launch massive DDoS attacks. vDOS <a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank" rel="noopener">made more than $600,000 in just two of the four years it was in operation</a>, launching more than 150,000 attacks against thousands of victims (including this site).</p>
<p>In September 2016, vDOS was taken offline and its alleged co-creators &#8212; two Israeli man who created the business when they were 14 and 15 years old &#8212; were <a href="https://krebsonsecurity.com/2017/08/alleged-vdos-operators-arrested-charged/" target="_blank" rel="noopener">arrested and briefly detained</a> by Israeli authorities. But despite assurances that the men (now adults) would be tried for their crimes, neither has been prosecuted.</p>
<p>In July 2017, a court in Germany <a href="https://krebsonsecurity.com/2017/07/suspended-sentence-for-mirai-botmaster-daniel-kaye/" target="_blank" rel="noopener">issued a suspended sentence</a> for Daniel Kaye, a 29-year-old man who allegedly launched extortionist DDoS attacks against several bank Web sites. </p>
<p>After the source code for the Mirai botnet malware was released in September 2016, Kaye <a href="https://krebsonsecurity.com/2017/07/who-is-the-govrat-author-and-mirai-botmaster-bestbuy/" target="_blank" rel="noopener">built his own Mirai botnet and used it in several high-profile attacks</a>, including a fumbled assault that knocked out Internet service to more than 900,000 Deutsche Telekom customers.</p>
<p>In his trial, Kaye admitted that a customer of his paid him $10,000 to attack the Liberian ISP Lonestar. He&#8217;s also thought to have launched DDoS attacks on Lloyds Banking Group and Barclays banks in January 2017. Kaye is now <a href="http://www.bbc.co.uk/news/uk-england-surrey-41115800" target="_blank" rel="noopener">facing related cybercrime charges</a> in the U.K.</p>
<p>Last week, the U.S. Justice Department <a href="https://krebsonsecurity.com/2017/12/mirai-iot-botnet-co-authors-plead-guilty/" target="_blank" rel="noopener">unsealed the cases of two young men in the United States who have pleaded guilty to co-authoring Mirai</a>, an &#8220;Internet of Things&#8221; (IoT) malware strain that has been used to create dozens of copycat Mirai botnets responsible for countless DDoS attacks over the past 15 months. Jha and his co-defendants in that case launched highly disruptive and extortionist attacks against a number of Web sites and used their creation to conduct lucrative click fraud schemes.</p>
<p>Like Chappell, the core author of Mirai &#8212; 21-year-old Fanwood, N.J. resident <strong>Paras Jha</strong> &#8212; launched countless DDoS attacks against his school, costing Rutgers University between $3.5 million and $9 million to defend against and clean up after the assaults (the actual damages will be decided at Jha&#8217;s sentencing in March 2018).</p>
<p>Time will tell if Kaye or Jha and his co-defendants receive any real punishment for their crimes. But I would submit that if we don&#8217;t have the stomach to put these &#8220;talented young hackers&#8221; in jail when they&#8217;re ultimately found guilty, perhaps we should consider harnessing their skills in less draconian but still meaningfully punitive ways, such as requiring them to serve several years participating in programs designed to keep other kids from following in their footsteps.</p>
<p>Doing anything less smacks of a disservice to justice, glorifies DDoS as an essentially victimless crime, and serves little deterrent that might otherwise make it less likely that we will see fewer such cases going forward.</p>


feed_id: https://krebsonsecurity.com/?p=41997
title: Skyrocketing Bitcoin Fees Hit Carders in Wallet
uri: Skyrocketing-Bitcoin-Fees-Hit-Carders-in-Wallet
url: https://krebsonsecurity.com/2017/12/skyrocketing-bitcoin-fees-hit-carders-in-wallet/
content:
<p>Critics of unregulated virtual currencies like <strong>Bitcoin</strong> have long argued that the core utility of these payment systems lies in facilitating illicit commerce, such as buying drugs or stolen credit cards and identities. But recent spikes in the price of Bitcoin &#8212; and the fees associated with moving funds into and out of it &#8212; have conspired to make Bitcoin a less useful and desirable payment method for many crooks engaged in these activities.</p>
<p><img class="aligncenter wp-image-42013" src="media/cd09d7b8.ss-btc.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/ss-btc.jpg" alt="" width="601" height="396" /></p>
<p>Bitcoin&#8217;s creator(s) envisioned a currency that could far more quickly and cheaply facilitate payments, with tiny transaction fees compared to more established and regulated forms of payment (such as credit cards). And indeed, until the beginning of 2017 those fees were well below $1, frequently less than 10 cents per transaction.</p>
<p>But as the price of Bitcoin has soared over the past few months to more than $15,000 per coin, so have the Bitcoin fees per transaction. This has made Bitcoin far less attractive for conducting small-dollar transactions (for more on this shift, see <a href="https://arstechnica.com/tech-policy/2017/12/bitcoin-fees-rising-high/" target="_blank" rel="noopener">this Dec. 19 story</a> from <strong>Ars Technica</strong>).</p>
<p>As a result, several major underground markets that traffic in stolen digital goods are now urging customers to deposit funds in alternative virtual currencies, such as <a href="https://en.wikipedia.org/wiki/Litecoin" target="_blank" rel="noopener">Litecoin</a>. Those who continue to pay for these commodities in Bitcoin not only face far higher fees, but also are held to higher minimum deposit amounts.</p>
<p>&#8220;Due to the drastic increase in the Bitcoin price, we faced some difficulties,&#8221; reads the welcome message for customers after they log in to Carder&#8217;s Paradise, a <a href="https://krebsonsecurity.com/2017/12/the-market-for-stolen-account-credentials/" target="_blank" rel="noopener">Dark Web marketplace that KrebsOnSecurity featured in a story last week</a>.</p>
<p>&#8220;The problem is that we send all your deposited funds to our suppliers which attracts an additional Bitcoin transaction fee (the same fee you pay when you make a deposit),&#8221; Carder&#8217;s Paradise explains. &#8220;Sometimes we have to pay as much as 5$ from every 1$ you deposited.&#8221;</p>
<p><span id="more-41997"></span></p>
<p>The shop continues:</p>
<blockquote><p>&#8220;We have to take additionally a &#8216;Deposit fee&#8217; from all users who deposit in Bitcoins. This is the amount we spent on transferring your funds to our suppliers. To compensate your costs, we are going to reduce our prices, including credit cards for all users and offer you the better bitcoin exchange rate.&#8221;</p>
<p>&#8220;The amount of the Deposit Fee depends on the load on the Bitcoin network. However, it stays the same regardless of the amount deposited. Deposits of 10$ and 1000$ attract the same deposit fee.&#8221;</p>
<p>&#8220;If the Bitcoin price continues increasing, this business is not going to be profitable for us anymore because all our revenue is going to be spent on the Bitcoin fees. We are no longer in possession of additional funds to improve the store.&#8221;</p>
<p>&#8220;We urge you to start using Litecoin as much as possible. Litecoin is a very fast and cheap way of depositing funds into the store. We are not going to charge any additional fees if you deposit Litecoins.&#8221;</p></blockquote>
<p>On Carder&#8217;s Paradise, the current minimum deposit amount is 0.0066 BTCs, or approximately USD $100. The deposit fee for each transaction is $15.14. That means that anyone who deposits just the minimum amount into this shop is losing more than 15 percent of their deposit in transaction fees.</p>
<p>Incredibly, the administrators of Carder&#8217;s Paradise apparently received so much pushback from crooks using their service that they decided to lower the price of stolen credit cards to make potential buyers feel better about higher transaction fees.</p>
<p>&#8220;Our team made a decision to adjust the previous announcement and provide a fair solution for everyone by reducing the credit cards [sic] prices,&#8221; the message concludes.</p>
<p>Mainstream merchants that accept credit card payments have long griped about the high cost of transaction fees, which average $2.50 to $3.00 on a $100 charge. What&#8217;s fascinating about the spike in Bitcoin transaction fees is that crooks could end up paying five times as much in fees just to purchase the same amount in stolen credit card accounts!</p>


feed_id: https://krebsonsecurity.com/?p=42046
title: 4 Years After Target, the Little Guy is the Target
uri: 4-Years-After-Target-the-Little-Guy-is-the-Target
url: https://krebsonsecurity.com/2017/12/4-years-after-target-the-little-guy-is-the-target/
content:
<p>Dec. 18 marked the fourth anniversary of <a href="https://krebsonsecurity.com/2013/12/sources-target-investigating-data-breach/" target="_blank" rel="noopener">this site breaking the news about a breach at Target</a> involving some 40 million customer credit and debit cards. It has been fascinating in the years since that epic intrusion to see how organized cyber thieves have shifted from targeting big box retailers to hacking a broad swath of small to mid-sized merchants.</p>
<p>In many ways, not much has changed: The biggest underground shops that sell stolen cards still index most of their cards by ZIP code. Only, the ZIP code corresponds not to the legitimate cardholder&#8217;s billing address but to the address of the hacked store at which the card in question was physically swiped (the reason for this is that buyers of these cards tend to prefer cards used by people who live in their geographic area, as the subsequent fraudulent use of those cards tends to set off fewer alarm bells at the issuing bank).</p>
<p>Last week I was researching a story published here this week on how <a href="https://krebsonsecurity.com/2017/12/skyrocketing-bitcoin-fees-hit-carders-in-wallet/" target="_blank" rel="noopener">a steep increase in transaction fees associated with Bitcoin is causing many carding shops to recommend alternate virtual currencies like Litecoin</a>. And I noticed that popular carding store <a href="https://krebsonsecurity.com/2016/03/carders-park-piles-of-cash-at-jokers-stash/" target="_blank" rel="noopener">Joker&#8217;s Stash</a> had just posted a new batch of cards dubbed &#8220;<strong>Dynamittte</strong>,&#8221; which boasted some 7 million cards advertised as &#8220;100 percent&#8221; valid &#8212; meaning the cards were so fresh that even the major credit card issuers probably didn&#8217;t yet know which retail or restaurant breach caused this particular breach.</p>
<div id="attachment_42053" style="width: 608px" class="wp-caption aligncenter"><img class=" wp-image-42053" src="media/2694c570.dynamite-js.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/dynamite-js.png" alt="" width="598" height="418" /><p class="wp-caption-text">An advertisement for a large new batch of stolen credit card accounts for sale at the Joker&#8217;s Stash Dark Web market.</p></div>
<p>Translation: These stolen cards were far more likely to still be active and useable after fraudsters encode the account numbers onto fake plastic and use the counterfeits to go shopping in big box stores.</p>
<p>I pinged a couple of sources who track when huge new batches of stolen cards hit the market, and both said the test cards they&#8217;d purchased from the Joker&#8217;s Stash Dynamittte batch mapped back to customers who all had one thing in common: They&#8217;d all recently eaten at a <a href="https://en.wikipedia.org/wiki/Jason's_Deli" target="_blank" rel="noopener">Jason&#8217;s Deli location</a>.</p>
<p>Jason&#8217;s Deli is a fast casual restaurant chain based in Beaumont, Texas, with approximately 266 locations in 28 states. Seeking additional evidence as to the source of the breach, I turned to the Jason&#8217;s Deli Web site and scraped the ZIP codes for their various stores across the country. Then I began comparing those ZIPs with the ZIPs tied to this new Dynamittte batch of cards at Joker&#8217;s Stash.</p>
<p>Checking my work were the folks at <a href="https://www.mindwise.io" target="_blank" rel="noopener">Mindwise.io</a>, a threat intelligence startup in California that monitors Dark Web marketplaces and tries to extract useful information from them. Mindwise found a nearly 100 percent overlap between the ZIP codes on the &#8220;<strong>Blasttt-US</strong>&#8221; unit of the Dynamittte cards for sale and the ZIP codes for Jason&#8217;s Deli locations.</p>
<p>Reached for comment, Jason&#8217;s Deli released the following statement:</p>
<blockquote><p>&#8220;On Friday, Dec. 22, 2017, our company was notified by payment processors – the organizations that manage the electronic connections between Jason’s Deli locations and payment card issuers – that MasterCard security personnel had informed it that a large quantity of payment card information had appeared for sale on the &#8216;dark web,&#8217; and that an analysis of the data indicated that at least a portion of the data may have come from various Jason’s Deli locations.&#8221;</p>
<p>&#8220;Jason’s Deli’s management immediately activated our response plan, including engagement of a leading threat response team, involvement of other forensic experts, and cooperation with law enforcement. Among the questions that investigators are working to determine is whether in fact a breach took place, and if so, to determine its scope, the method employed, and whether there is any continuing breach or vulnerability.&#8221;</p>
<p>&#8220;The investigation is in its early stages and, as is typical in such situations, we expect it will take some time to determine exactly what happened. Jason’s Deli will provide as much information as possible as the inquiry progresses, bearing in mind that security and law enforcement considerations may limit the amount of detail we can provide.&#8221;</p></blockquote>
<p><span id="more-42046"></span>It&#8217;s important to note that the apparent breach at Jason&#8217;s Deli almost certainly does not correspond to 7 million cards; typically, carding shop owners will mix cards stolen from multiple breaches into one much larger batch (Dynamittte), and often further subdivide the cards by region (US vs. European cards).</p>
<p>As run-of-the-mill as these card breaches have become, it&#8217;s still remarkable even in smaller batches of cards like those apparently stolen from Jason&#8217;s Deli customers just how many financial institutions are impacted with each breach.</p>
<div id="attachment_42052" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/b2183663.exposedbybinjasons.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/exposedbybinjasons.png"><img class="wp-image-42052" src="media/b2183663.exposedbybinjasons.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/exposedbybinjasons.png" alt="" width="599" height="455" /></a><p class="wp-caption-text">Banks impacted by the apparent breach at Jason&#8217;s Deli, sorted by Bank ID Number (BIN) &#8212; i.e. the issuer identified by the first six digits in the card number.</p></div>
<p>Mindwise said it was comfortable concluding that at least 170,000 of the cards put up for sale this past week on Joker&#8217;s Stash map back to Jason&#8217;s Deli locations. That may seem like a drop in the bucket compared to the 40 million cards that thieves hauled away from Target four years ago, but the cards stolen from Jason&#8217;s Deli customers were issued by more than 250 banks and credit unions, most of which will adopt differing strategies on how to manage fraud on those cards.</p>
<p>In other words, by moving down the food chain to smaller but far more plentiful and probably less secure merchants (either by choice or because the larger stores became a harder target) &#8212; and by mixing cards stolen from multiple breaches &#8212; the fraudsters have made it less likely that breaches at chain stores will be detected and remediated quickly, thereby prolonging the value and use of the stolen cards put up for sale in underground marketplaces.</p>
<p>All that said, it&#8217;s really not worth it to spend time worrying about where your card number may have been breached, <a href="https://krebsonsecurity.com/2015/01/how-was-your-credit-card-stolen/" target="_blank" rel="noopener">since it&#8217;s almost always impossible to say for sure</a> and because it&#8217;s common for the same card to be breached at multiple establishments during the same time period.</p>
<p>Just remember that although consumers are not liable for fraudulent charges, it may still fall to you the consumer to spot and report any suspicious charges. So keep a close eye on your statements, and consider signing up for text message notifications of new charges if your card issuer offers this service. Most of these services also can be set to alert you if you’re about to miss an upcoming payment, so they can also be handy for avoiding late fees and other costly charges.</p>
<p>Related reading (i.e., other breach stories confirmed with ZIP code analysis):</p>
<p><a href="https://krebsonsecurity.com/2017/09/breach-at-sonic-drive-in-may-have-impacted-millions-of-credit-debit-cards/" target="_blank" rel="noopener">Breach at Sonic Drive-in May Have Impacted Millions of Credit, Debit Cards</a></p>
<p><a href="https://krebsonsecurity.com/2014/03/zip-codes-show-extent-of-sally-beauty-breach/" target="_blank" rel="noopener">Zip Codes Show Extent of Sally Beauty Breach</a></p>
<p><a href="https://krebsonsecurity.com/2014/09/data-nearly-all-u-s-home-depot-stores-hit/" target="_blank" rel="noopener">Data: Nearly All U.S. Home Depot Stores Hit</a></p>
<p><a href="https://krebsonsecurity.com/2013/12/cards-stolen-in-target-breach-flood-underground-markets/" target="_blank" rel="noopener">Cards Stolen in Target Breach Flood Underground Markets</a></p>


feed_id: https://krebsonsecurity.com/?p=42066
title: Happy 8th Birthday, KrebsOnSecurity!
uri: Happy-8th-Birthday-KrebsOnSecurity
url: https://krebsonsecurity.com/2017/12/happy-8th-birthday-krebsonsecurity/
content:
<p>Eight years ago today I set aside my Washington Post press badge and became an independent here at KrebsOnSecurity.com. What a wild ride it has been. Thank you all, Dear Readers, for sticking with me and for helping to build a terrific community.</p>
<p><img class="alignright wp-image-42070" src="media/16e3c080.smallereight.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/smallereight.png" alt="" width="229" height="252" />This past year KrebsOnSecurity published nearly 160 stories, generating more than 11,000 reader comments. The pace of publications here slowed down in 2017, but then again I have been trying to focus on quality over quantity, and many of these stories took weeks or months to report and write.</p>
<p>As always, a big Thank You to readers who sent in tips and personal experiences that helped spark stories here. For anyone who wishes to get in touch, I can always be reached via <a href="https://krebsonsecurity.com/about/" target="_blank" rel="noopener">this site&#8217;s contact form</a>, or via email at krebsonsecurity @ gmail dot com.</p>
<p>Here are some other ways to reach out:<span id="more-42066"></span></p>
<p><a href="https://www.twitter.com/briankrebs" target="_blank" rel="noopener">Twitter (open DMs)</a></p>
<p><a href="https://www.facebook.com/Brian-Krebs-119740914725557/" target="_blank" rel="noopener">Facebook</a></p>
<p>via <a href="https://www.wickr.com/" target="_blank" rel="noopener">Wickr</a> at &#8220;krebswickr&#8221;</p>
<p>Protonmail: krebsonsecurity at protonmail dot com</p>
<p><a href="https://keybase.io/briankrebs" target="_blank" rel="noopener">Keybase</a></p>
<p>Below are the Top 10 most-read stories of 2017, as decided by views and sorted in reverse chronological order:</p>
<p><a href="https://krebsonsecurity.com/2017/12/the-market-for-stolen-account-credentials/" target="_blank" rel="noopener">The Market for Stolen Account Credentials</a></p>
<p><a href="https://krebsonsecurity.com/2017/12/phishers-are-upping-their-game-so-should-you/" target="_blank" rel="noopener">Phishers are Upping Their Game: So Should You</a></p>
<p><a href="https://krebsonsecurity.com/2017/10/equifax-breach-fallout-your-salary-history/" target="_blank" rel="noopener">Equifax Breach Fallout: Your Salary History</a></p>
<p><a href="https://krebsonsecurity.com/2017/10/usps-informed-delivery-is-stalkers-dream/" target="_blank" rel="noopener">USPS&#8217; Informed Delivery is a Stalker&#8217;s Dream</a></p>
<p><a href="https://krebsonsecurity.com/2017/09/the-equifax-breach-what-you-should-know/" target="_blank" rel="noopener">The Equifax Breach: What You Should Know</a></p>
<p><a href="https://krebsonsecurity.com/2017/06/got-robocalled-dont-get-mad-get-busy/" target="_blank" rel="noopener">Got Robocalled? Don&#8217;t Get Mad, Get Busy</a></p>
<p><a href="https://krebsonsecurity.com/2017/06/why-so-many-top-hackers-hail-from-russia/" target="_blank" rel="noopener">Why So Many Top Hackers Hail from Russia</a></p>
<p><a href="https://krebsonsecurity.com/2017/03/post-fcc-privacy-rules-should-you-vpn/" target="_blank" rel="noopener">Post-FCC Privacy Rules: Should You VPN?</a></p>
<p><a href="https://krebsonsecurity.com/2017/03/if-your-iphone-is-stolen-these-guys-may-try-to-iphish-you/" target="_blank" rel="noopener">If Your iPhone is Stolen, These Guys May Try to iPhish You</a></p>
<p><a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank" rel="noopener">Who is Anna-Senpai, the Mirai Worm Author?</a></p>


feed_id: https://krebsonsecurity.com/?p=42076
title: Kansas Man Killed In ‘SWATting’ Attack
uri: Kansas-Man-Killed-In-SWATting-Attack
url: https://krebsonsecurity.com/2017/12/kansas-man-killed-in-swatting-attack/
content:
<p>A 28-year-old Kansas man was shot and killed by police officers on the evening of Dec. 28 after someone fraudulently reported a hostage situation ongoing at his home. The false report was the latest in a dangerous hoax known as &#8220;<strong>swatting</strong>,&#8221; wherein the perpetrator falsely reports a dangerous situation at an address with the goal of prompting authorities to respond to that address with deadly force. This particular swatting reportedly originated over <a href="https://umggaming.com/m/4179723" target="_blank" rel="noopener">a $1.50 wagered match</a> in the online game <strong>Call of Duty</strong>. Compounding the tragedy is that the man killed was an innocent party who had no part in the dispute.</p>
<p>The following is an analysis of what is known so far about the incident, as well as a brief interview with the alleged and self-professed perpetrator of this crime.</p>
<p>It appears that the dispute and subsequent taunting originated on Twitter. One of the parties to that dispute &#8212; allegedly using the Twitter handle &#8220;<strong>SWauTistic</strong>&#8221; &#8212; threatened to swat another user who goes by the nickname &#8220;<strong>7aLeNT</strong>&#8220;. @7aLeNT dared someone to swat him, but then tweeted an address that was not his own.</p>
<p>Swautistic responded by falsely reporting to the Kansas police a domestic dispute at the address 7aLenT posted, telling the authorities that one person had already been murdered there and that several family members were being held hostage.</p>
<div id="attachment_42078" style="width: 578px" class="wp-caption aligncenter"><img class="wp-image-42078 size-full" src="media/d19d66ba.swatutistic.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/swatutistic.png" alt="" width="568" height="910" /><p class="wp-caption-text">Image courtesey @mattcarries</p></div>
<p>A <a href="http://www.kansas.com/news/local/crime/article192111974.html" target="_blank" rel="noopener">story</a> in the <em>Wichita Eagle</em> says officers responded the 1000 block of McCormick and got into position, preparing for a hostage situation.</p>
<blockquote><p>“A male came to the front door,” Livingston said. “As he came to the front door, one of our officers discharged his weapon.”</p>
<p>&#8220;Livingston didn’t say if the man, who was 28, had a weapon when he came to the door, or what caused the officer to shoot the man. Police don’t think the man fired at officers, but the incident is still under investigation, he said. The man, who has not been identified by police, died at a local hospital.</p>
<p>&#8220;A family member identified that man who was shot by police as Andrew Finch. One of Finch’s cousins said Finch didn’t play video games.&#8221;</p></blockquote>
<p>Not long after that, Swautistic was back on Twitter saying he could see on television that the police had fallen for his swatting attack. When it became apparent that a man had been killed as a result of the swatting, Swautistic tweeted that he didn&#8217;t get anyone killed because he didn&#8217;t pull the trigger (see image above).</p>
<p>Swautistic soon changed his Twitter handle to <strong>@GoredTutor36</strong>, but KrebsOnSecurity managed to obtain several weeks&#8217; worth of tweets from Swautistic before his account was renamed. Those tweets indicate that Swautistic is a serial swatter &#8212; meaning he has claimed responsibility for a number of other recent false reports to the police.</p>
<p>Among the recent hoaxes he&#8217;s taken credit for include a false report of a bomb threat at the <strong>U.S. Federal Communications Commission</strong> (FCC) that <a href="https://www.theverge.com/us-world/2017/12/14/16777178/fcc-net-neutrality-vote-evacuation" target="_blank" rel="noopener">disrupted a high-profile public meeting on the net neutrality debate</a>. Swautistic also has claimed responsibility for a <a href="https://www.nbcdfw.com/news/local/Downtown-Dallas-Convention-Center-Evacuated-Witnesses-462882893.html" target="_blank" rel="noopener">hoax bomb threat that forced the evacuation of the Dallas Convention Center</a>, and <a href="http://www.newsherald.com/news/20171128/students-evacuated-after-arnold-high-bomb-threat-with-audio" target="_blank" rel="noopener">another bomb threat at a high school in Panama City, Fla</a>, among others.</p>
<p>After <a href="http://twitter.com/briankrebs" target="_blank" rel="noopener">tweeting about the incident</a> extensively this afternoon, KrebsOnSecurity was contacted by someone in control of the @GoredTutor36 Twitter account. GoredTutor36 said he&#8217;s been the victim of swatting attempts himself, and that this was the reason he decided to start swatting others.</p>
<p>He said the thrill of it &#8220;comes from having to hide from police via net connections.&#8221; Asked about the FCC incident, @GoredTutor36 acknowledged it was his bomb threat. &#8220;Yep. Raped em,&#8221; he wrote.</p>
<p>&#8220;Bomb threats are more fun and cooler than swats in my opinion and I should have just stuck to that,&#8221; he wrote. &#8220;But I began making $ doing some swat requests.&#8221;</p>
<p>Asked whether he feels remorse about the Kansas man&#8217;s death, he responded &#8220;of course I do.&#8221;</p>
<p>But evidently not enough to make him turn himself in.</p>
<p>&#8220;I won&#8217;t disclose my identity until it happens on its own,&#8221; the user said in a long series of direct messages on Twitter. &#8220;People will eventually (most likely those who know me) tell me to turn myself in or something. I can&#8217;t do that; though I know its [sic] morally right. I&#8217;m too scared admittedly.&#8221;</p>
<p><strong>Update, 7:15 p.m.:</strong> A recording of the call to 911 operators that prompted this tragedy can be heard at <a href="https://www.pscp.tv/LJSNicholeManna/1lPKqponlzQxb?t=9m10s" target="_blank" rel="noopener">this link</a>. The playback of the recorded emergency calls starts around 10 minutes into the video.</p>
<p><span id="more-42076"></span></p>
<h4>ANALYSIS</h4>
<p>As a victim of <a href="https://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank" rel="noopener">my own swatting attack back in 2013</a>, I&#8217;ve been horrified to watch these crimes only increase in frequency ever since &#8212; usually with little or no repercussions for the person or persons involved in setting the schemes in motion. Given that the apparent perpetrator of this crime seems eager for media attention, it seems likely he will be apprehended soon. My guess is that he is a minor and will be treated with kid gloves as a result, although I hope I&#8217;m wrong on both counts.</p>
<p>Let me be crystal clear on a couple of points. First off, there is no question that police officers and first responders across the country need a great deal more training to bring the number of police shootings way down. That is undoubtedly a giant contributor to the swatting epidemic.</p>
<p>Also, all police officers and dispatchers need to be trained on what swatting is, how to spot the signs of a hoax, and how to minimize the risk of anyone getting harmed when responding to reports about hostage situations or bomb threats. Finally, officers of the peace who are sworn to protect and serve should use deadly force only in situations where there is a clear and immediate threat. Those who jump the gun need to be held accountable as well.</p>
<p>But that kind of reform isn&#8217;t going to happen overnight. Meanwhile, knowingly and falsely making a police report that results in a SWAT unit or else heavily armed police response at an address is an invitation for someone to get badly hurt or killed. These are high-pressure situations and in most cases &#8212; as in this incident &#8212; the person opening the door has no idea what&#8217;s going on. Heaven protect everyone at the scene if the object of the swatting attack is someone who is already heavily armed and confused enough about the situation to shoot anything that comes near his door.</p>
<p>In some states, filing a false police report is just a misdemeanor and is mainly punishable by fines. However, in other jurisdictions filing a false police report is a felony, and I&#8217;m afraid it&#8217;s long past time for these false reports about dangerous situations to become a felony offense in every state. Here&#8217;s why.</p>
<p>If making a fraudulent report about a hostage situation or bomb threat is a felony, then if anyone dies as a result of that phony report they can legally then be charged with felony murder. Under the <a href="https://www.justia.com/criminal/offenses/homicide/felony-murder/" target="_blank" rel="noopener">doctrine of felony murder</a>, when an offender causes the death of another (regardless of intent) in the commission of a dangerous crime, he or she is guilty of murder.</p>
<p>Too often, however, the perpetrators of these crimes are minors, and even when they&#8217;re caught they are frequently given a slap on the wrist. Swatting needs to stop, and unfortunately as long as there are few consequences for swatting someone, it will continue to be a potentially deadly means for gaining e-fame and for settling childish and pointless ego squabbles.</p>


feed_id: https://krebsonsecurity.com/?p=42098
title: Serial Swatter “SWAuTistic” Bragged He Hit 100 Schools, 10 Homes
uri: Serial-Swatter-SWAuTistic-Bragged-He-Hit-100-Schools-10-Homes
url: https://krebsonsecurity.com/2018/01/serial-swatter-swautistic-bragged-he-hit-100-schools-10-homes/
content:
<p>The individual who allegedly made a fake emergency call to Kansas police last week that summoned them to <a href="https://krebsonsecurity.com/2017/12/kansas-man-killed-in-swatting-attack/" target="_blank" rel="noopener">shoot and kill an unarmed local man</a> has claimed credit for raising dozens of these dangerous false alarms &#8212; calling in bogus hostage situations and bomb threats at roughly 100 schools and at least 10 residences.</p>
<div id="attachment_42104" style="width: 263px" class="wp-caption alignright"><img class=" wp-image-42104" src="media/e6e75b15.tylerrajbarriss.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/tylerrajbarriss.png" alt="" width="253" height="338" /><p class="wp-caption-text">Tyler Raj Barriss, in an undated selfie.</p></div>
<p>On Friday authorities in Los Angeles arrested 25-year-old <strong>Tyler Raj Barriss</strong>, who is thought to be known online as &#8220;<strong>SWAuTistic</strong>.&#8221; As noted in last week&#8217;s story, SWAuTistic is an admitted serial swatter, and was even convicted in 2016 for calling in a bomb threat to an ABC affiliate in Los Angeles. The Associated Press reports that Barriss was sentenced to two years in prison for that stunt, but was released in January 2017.</p>
<p>In his <a href="media/c266a256.swautistic-twitter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/swautistic-twitter.png" target="_blank" rel="noopener">public tweets</a> (most of which are no longer available but were collected by KrebsOnSecurity), SWAuTistic claimed credit for bomb threats against a <a href="https://www.nbcdfw.com/news/local/Downtown-Dallas-Convention-Center-Evacuated-Witnesses-462882893.html" target="_blank" rel="noopener">convention center in Dallas</a> and <a href="http://www.newsherald.com/news/20171128/students-evacuated-after-arnold-high-bomb-threat-with-audio" target="_blank" rel="noopener">a high school in Florida</a>, as well as <a href="https://www.theverge.com/us-world/2017/12/14/16777178/fcc-net-neutrality-vote-evacuation" target="_blank" rel="noopener">an incident</a> that disrupted a much-watched meeting at the <strong>U.S. Federal Communications Commission</strong> (FCC) in November.</p>
<p>But privately &#8212; to a small circle of friends and associates &#8212; SWAuTistic bragged about perpetrating dozens of swatting incidents and bomb threats over the years.</p>
<p>Within a few hours of the swatting incident in Kansas, investigators searching for clues about the person who made the phony emergency call may have gotten some unsolicited help from an unlikely source: <strong>Eric &#8220;<a href="https://twitter.com/CosmoTheGod" target="_blank" rel="noopener">Cosmo the God</a>&#8221; Taylor</strong>, a talented young hacker who <a href="https://krebsonsecurity.com/2017/02/men-who-sent-swat-team-heroin-to-my-home-sentenced/" target="_blank" rel="noopener">pleaded guilty</a> to being part of <a href="https://krebsonsecurity.com/2013/04/swatting-incidents-tied-to-id-theft-sites/" target="_blank" rel="noopener">a group that swatted multiple celebrities and public figures</a> &#8212; <a href="https://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank" rel="noopener">as well as my home in 2013</a>.</p>
<p>Taylor is now trying to turn his life around, and is in the process of starting his own cybersecurity consultancy. In a posting on Twitter at 6:21 p.m. ET Dec. 29, Taylor personally <a href="https://twitter.com/CosmoTheGod/status/946883868082053120" target="_blank" rel="noopener">offered a reward of $7,777 in Bitcoin</a> for information about the real-life identity of SWAuTistic.</p>
<p>In short order, several people who claimed to have known SWAuTistic responded by coming forward publicly and privately with Barriss&#8217;s name and approximate location, sharing copies of private messages and even selfies that were allegedly shared with them at one point by Barriss.</p>
<p>In one private online conversation, SWAuTistic can be seen bragging about his escapades, claiming to have called in fake emergencies at approximately 100 schools and 10 homes.</p>
<div id="attachment_42106" style="width: 594px" class="wp-caption aligncenter"><img class=" wp-image-42106" src="media/7028a0a8.100schools.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/100schools.png" alt="" width="584" height="311" /><p class="wp-caption-text">The serial swatter known as &#8220;SWAuTistic&#8221; claimed in private conversations to have carried out swattings or bomb threats against 100 schools and 10 homes.</p></div>
<p>SWAuTistic sought out an interview with KrebsOnSecurity on the afternoon of Dec. 29, in which he said he routinely faked hostage and bomb threat situations to emergency centers across the country in exchange for money.</p>
<p>“Bomb threats are more fun and cooler than swats in my opinion and I should have just stuck to that,” SWAuTistic said. “But I began making $ doing some swat requests.”</p>
<p>By approximately 8:30 p.m. ET that same day, Taylor&#8217;s bounty had turned up what looked like a positive ID on SWAuTistic. However, KrebsOnSecurity opted not to publish the information until Barriss was formally arrested and charged, which appears to have happened sometime between 10 p.m. ET Dec. 29 and 1 a.m. on Dec. 30.<span id="more-42098"></span></p>
<p>The arrest came just hours after SWAuTistic allegedly called the Wichita police claiming he was a local man who&#8217;d just shot his father in the head and was holding the rest of his family hostage. According to his acquaintances, SWAuTistic made the call after being taunted by a fellow gamer in the popular computer game <strong>Call of Duty</strong>. The taunter dared SWAuTistic to swat him, but then gave someone else&#8217;s address in Kansas as his own instead.</p>
<p>Wichita Police arrived at the address provided by SWAuTistic and surrounded the home. A young man emerged from the doorway and was ordered to put his hands up. Police said one of the officers on the scene fired a single shot &#8212; supposedly after the man reached toward his waist. Grainy bodycam footage of the shooting is available <a href="https://www.facebook.com/WichitaPolice/videos/10155490668424514/" target="_blank" rel="noopener">here</a> (the video is preceded by the emergency call that summoned the police).</p>
<div id="attachment_42117" style="width: 536px" class="wp-caption aligncenter"><img class="size-full wp-image-42117" src="media/a3f16302.infamyjail.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/infamyjail.png" alt="" width="526" height="201" /><p class="wp-caption-text">SWAuTistic telling another person in a Twitter direct message that he had already been to jail for swatting.</p></div>
<p>The man shot and killed by police was unarmed. He has been identified as 28-year-old <strong>Andrew Finch, </strong>a father of two. Family members say he was not involved in gaming, and had no party to the dispute that got him killed.</p>
<p>According to the <a href="http://www.kansas.com/news/local/crime/article192111974.html" target="_blank" rel="noopener">Wichita Eagle</a>, the officer who fired the fatal shot is a seven-year veteran with the Wichita department. He has been placed on administrative leave pending an internal investigation.</p>
<p>Earlier reporting here and elsewhere inadvertently mischaracterized SWAuTistic&#8217;s call to the Wichita police as a 911 call. We now know that the perpetrator called in to an emergency line for Wichita City Hall and spoke with someone there who took down the caller&#8217;s phone number. After that, 911 dispatch operators were alerted and called the number SWAuTistic had given.</p>
<p>This is notable because the lack of a 911 call in such a situation should have been a red flag indicating the caller was not phoning from a local number (otherwise the caller presumably would have just dialed 911).</p>
<div id="attachment_42124" style="width: 518px" class="wp-caption aligncenter"><img class="wp-image-42124 size-full" src="media/76cf57ef.singleshot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/singleshot.png" alt="" width="508" height="353" /><p class="wp-caption-text">The moment a police officer fired the shot that killed 28-year-old Wichita resident Andrew Finch (in doorway of home).</p></div>
<p>The FBI estimates that some 400 swatting incidents occur each year across the country. Each incident costs first responders approximately $10,000, and diverts important resources away from actual emergencies.</p>


feed_id: https://krebsonsecurity.com/?p=42139
title: Scary Chip Flaws Raise Spectre of Meltdown
uri: Scary-Chip-Flaws-Raise-Spectre-of-Meltdown
url: https://krebsonsecurity.com/2018/01/scary-chip-flaws-raise-spectre-of-meltdown/
content:
<p><strong>Apple,</strong> <strong>Google</strong>, <strong>Microsoft</strong> and other tech giants have released updates for a pair of serious security flaws present in most modern computers, smartphones, tablets and mobile devices. Here&#8217;s a brief rundown on the threat and what you can do to protect your devices.</p>
<p>At issue are two different vulnerabilities, dubbed &#8220;<strong>Meltdown</strong>&#8221; and &#8220;<strong>Spectre</strong>,&#8221; that were independently discovered and reported by security researchers at <strong>Cyberus Technology</strong>, <strong>Google</strong>, and the <strong>Graz University of Technology</strong>. The details behind these bugs are extraordinarily technical, but <a href="https://meltdownattack.com/" target="_blank" rel="noopener">a Web site</a> established to help explain the vulnerabilities sums them up well enough:</p>
<blockquote><p>&#8220;These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.&#8221;</p>
<p>&#8220;Meltdown and Spectre work on personal computers, mobile devices, and in the cloud. Depending on the cloud provider&#8217;s infrastructure, it might be possible to steal data from other customers.&#8221;</p></blockquote>
<p>The Meltdown bug affects every Intel processor shipped since 1995 (with the exception of <strong>Intel Itanium</strong> and <strong>Intel Atom</strong> before 2013), although researchers said the flaw could impact other chip makers. Spectre is a far more wide-ranging and troublesome flaw, impacting desktops, laptops, cloud servers and smartphones from a variety of vendors. However, according to Google researchers, Spectre also is considerably more difficult to exploit.</p>
<p>In short, if it has a computer chip in it, it&#8217;s likely affected by one or both of the flaws. For now, there don&#8217;t appear to be any signs that attackers are exploiting either to steal data from users. But researchers warn that the weaknesses could be exploited via Javascript &#8212; meaning it might not be long before we see attacks that leverage the vulnerabilities being stitched into hacked or malicious Web sites.</p>
<p>Microsoft this week released emergency updates to address Meltdown and Spectre in its various Windows operating systems. But the software giant <a href="https://support.microsoft.com/en-us/help/4072699/important-information-regarding-the-windows-security-updates-released" target="_blank" rel="noopener">reports</a> that the updates aren&#8217;t playing nice with many antivirus products; the fix apparently is causing the dreaded &#8220;<a href="https://krebsonsecurity.com/2010/03/secret-obsession-odd-windows-crash-alerts/" target="_blank" rel="noopener">blue screen of death</a>&#8221; (BSOD) for some antivirus users. In response, Microsoft has asked antivirus vendors who have updated their products to avoid the BSOD crash issue to install a special key in the Windows registry. That way, <a href="https://support.microsoft.com/en-us/help/12373/windows-update-faq" target="_blank" rel="noopener">Windows Update</a> can tell whether it&#8217;s safe to download and install the patch.<span id="more-42139"></span></p>
<p>But not all antivirus products have been able to do this yet, which means many Windows users likely will not be able to download this patch immediately. If you run Windows Update and it does not list a patch made available on Jan 3, 2018, it&#8217;s likely your antivirus software is not yet compatible with this patch.</p>
<p>Google <a href="https://source.android.com/security/bulletin/2018-01-01" target="_blank" rel="noopener">has issued updates</a> to address the vulnerabilities on devices powered by its <strong>Android</strong> operating system. Meanwhile, <strong>Apple</strong> <a href="https://support.apple.com/en-us/HT208394" target="_blank" rel="noopener">has said</a> that <em>all</em> <strong>iOS</strong> and <strong>Mac</strong> systems are vulnerable to Meltdown and Spectre, and that it has already released &#8220;mitigations&#8221; in <em>iOS 11.2</em>, <em>macOS 10.13.2</em>, and <em>tvOS 11.2</em> to help defend against Meltdown. The Apple Watch is not impacted. Patches to address this flaw in Linux systems were <a href="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=64a48099b3b31568ac45716b7fafcb74a0c2fcfe" target="_blank" rel="noopener">released last month</a>.</p>
<p>Many readers appear concerned about the potential performance impact that applying these fixes may have on their devices, but my sense is that most of these concerns are probably overblown for regular end users. Forgoing security fixes over possible performance concerns doesn&#8217;t seem like a great idea considering the seriousness of these bugs. What&#8217;s more, the good folks at benchmarking site <strong>Tom&#8217;s Hardware</strong> <a href="http://www.tomshardware.com/news/intel-cpu-bug-amd-performance,36213.html" target="_blank" rel="noopener">say their preliminary tests</a> indicate that there is &#8220;little to no performance regression in most desktop workloads&#8221; as a result of applying available fixes.</p>
<p><a href="https://meltdownattack.com/" target="_blank" rel="noopener">Meltdownattack.com</a> has a full list of vendor advisories. The academic paper on Meltdown is <a href="media/38eb3891.meltdown.pdf" data-original-source="https://meltdownattack.com/meltdown.pdf" target="_blank" rel="noopener">here</a> (PDF); the paper for Spectre can be found at <a href="media/b7799367.spectre.pdf" data-original-source="https://spectreattack.com/spectre.pdf" target="_blank" rel="noopener">this link</a> (PDF). Additionally, Google has published <a href="https://googleprojectzero.blogspot.co.at/2018/01/reading-privileged-memory-with-side.html" target="_blank" rel="noopener">a highly technical analysis</a> of both attacks. Cyberus Technology has <a href="http://blog.cyberus-technology.de/posts/2018-01-03-meltdown.html" target="_blank" rel="noopener">their own blog post</a> about the threats.</p>


feed_id: https://krebsonsecurity.com/?p=42151
title: Website Glitch Let Me Overstock My Coinbase
uri: Website-Glitch-Let-Me-Overstock-My-Coinbase
url: https://krebsonsecurity.com/2018/01/website-glitch-let-me-overstock-my-coinbase/
content:
<p><strong>Overstock.com</strong> (<a href="http://www.nasdaq.com/symbol/ostk" target="_blank" rel="noopener">NASDAQ:OSTK</a>) just fixed a serious glitch in the <strong>Coinbase</strong> bitcoin payment section of its site that allowed customers to buy any item at a tiny fraction of the listed price. Potentially more punishing, the flaw let anyone paying with bitcoin reap many times the authorized bitcoin refund amount on any canceled orders.</p>
<p>In January 2014, Overstock.com partnered with Coinbase to allow customers to pay for merchandise using bitcoin, making it among the first of the largest e-commerce vendors to accept the virtual currency.</p>
<p>On December 19, 2017, as the price of bitcoin soared to more than $17,000 per coin, Coinbase added support for <a href="https://en.wikipedia.org/wiki/Bitcoin_Cash" target="_blank" rel="noopener">Bitcoin Cash</a> &#8212; an offshoot (or &#8220;fork&#8221;) from bitcoin designed to address the cryptocurrency&#8217;s scalability challenges.</p>
<p>As a result of the change, Coinbase customers with balances of bitcoin at the time of the fork were given an equal amount of bitcoin cash stored by Coinbase. However, there is a significant price difference between the two currencies: A single bitcoin is worth almost $15,000 right now, whereas a unit of bitcoin cash is valued at around $2,400.</p>
<p>On Friday, Jan. 5, KrebsOnSecurity was contacted by <strong>JB Snyder</strong>, owner of North Carolina-based <a href="https://www.bancsec.com/" target="_blank" rel="noopener">Bancsec</a>, a company that gets paid to break into banks and test their security. An early adopter of bitcoin, Snyder said he was using some of his virtual currency to purchase an item at Overstock when he noticed something alarming.</p>
<p>During the checkout process for those paying by bitcoin, Overstock.com provides the customer a bitcoin wallet address that can be used to pay the invoice and complete the transaction. But Snyder discovered that Overstock&#8217;s site just as happily accepted <em>bitcoin cash</em> as payment, even though bitcoin cash is currently worth only about 15 percent of the value of bitcoin.</p>
<p>To confirm and replicate Snyder&#8217;s experience firsthand, KrebsOnSecurity purchased a set of three outdoor solar lamps from Overstock for a grand total of $78.27.</p>
<div id="attachment_42170" style="width: 556px" class="wp-caption aligncenter"><img class=" wp-image-42170" src="media/480c2980.solarlights.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/solarlights.png" alt="" width="546" height="116" /><p class="wp-caption-text">The solar lights I purchased from Overstock.com to test Snyder&#8217;s finding. They cost $78.27 in bitcoin, but because I was able to pay for them in bitcoin cash I only paid $12.02.</p></div>
<p>After indicating I wished to pay for the lamps in bitcoin, the site produced a payment invoice instructing me to send exactly 0.00475574 bitcoins to a specific address.</p>
<div id="attachment_42171" style="width: 535px" class="wp-caption aligncenter"><img class=" wp-image-42171" src="media/3bb22c02.overstocksend.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/overstocksend.png" alt="" width="525" height="659" /><p class="wp-caption-text">The payment invoice I received from Overstock.com.</p></div>
<p>Logging into Coinbase, I took the bitcoin address and pasted that into the &#8220;pay to:&#8221; field, and then told Coinbase to send 0.00475574 in bitcoin cash instead of bitcoin. The site responded that the payment was complete. Within a few seconds I received an email from Overstock congratulating me on my purchase and stating that the items would be shipped shortly.</p>
<p>I had just made a $78 purchase by sending approximately USD $12 worth of bitcoin cash. Crypto-currency alchemy at last!</p>
<p>But that wasn&#8217;t the worst part. I didn&#8217;t really want the solar lights, but also I had no interest in ripping off Overstock. So I cancelled the order. To my surprise, the system refunded my purchase in bitcoin, <em>not bitcoin cash</em>!</p>
<p><img class="aligncenter wp-image-42172" src="media/24dd0228.ostockrefund.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/ostockrefund.png" alt="" width="525" height="370" /></p>
<p>Consider the implications here: A dishonest customer could have used this bug to make ridiculous sums of bitcoin in a very short period of time. Let&#8217;s say I purchased one of the more expensive items for sale on Overstock, such as <a href="https://www.overstock.com/Jewelry-Watches/Auriya-GIA-Certified-Platinum-Gold-V-End-Prong-3-ct.-TDW/13938630/product.html?refccid=XJW5AOFLJE62MPSFL2GVGJPACA&amp;searchidx=37&amp;keywords=&amp;refinement=stone%3ADiamond" target="_blank" rel="noopener">this $100,000, 3-carat platinum diamond ring</a>. I then pay for it in Bitcoin cash, using an amount equivalent to approximately 1 bitcoin ($~15,000).</p>
<p>Then I simply cancel my order, and Overstock/Coinbase sends me almost $100,000 in bitcoin, netting me a tidy $85,000 profit. Rinse, wash, repeat.<span id="more-42151"></span></p>
<p>Neither Coinbase nor Overstock would say which company was responsible for the glitch &#8212; whether it was a flaw in Coinbase&#8217;s application programming interface (API) or an implementation problem on Overstock.com. Coinbase told me the bug only existed for approximately three weeks.</p>
<p>“After being made aware of an issue in our joint refund processing code <span class="aBn" tabindex="0" data-term="goog_1034824068"><span class="aQJ">on Saturday</span></span>, <span class="il">Coinbase</span> and Overstock worked together to deploy a fix within hours,&#8221; Coinbase wrote in a statement shared with KrebsOnSecurity. &#8220;While a patch was being developed and tested, orders were proactively disabled to protect customers. To our knowledge, a very small number of transactions were impacted by this issue. <span class="il">Coinbase</span> actively works with merchant partners to identify and solve issues like this in an ongoing, collaborative manner and since being made aware of this have ensured that no other partners are affected.”</p>
<p>For its part, Overstock said in a statement:</p>
<p>&#8220;We were made aware of an issue affecting cryptocurrency transactions and refunds by an independent researcher. After working with the researcher to confirm the finding, that method of payment was disabled while we worked with our cryptocurrency integration partner, Coinbase, to ensure they resolved the issue. We have since confirmed that the issue described in the finding has been resolved, and the cryptocurrency payment option has been re-enabled.&#8221;</p>
<p>Bancsec&#8217;s Snyder and I both checked for the presence of this glitch at multiple other merchants that work directly with Coinbase in their checkout process, but we found no other examples of this flaw.</p>
<p>The snafu comes as many businesses that have long accepted bitcoin are now distancing themselves from the currency thanks to the recent volatility in bitcoin prices and associated fees.</p>
<p>Earlier this week, it emerged that Microsoft had <a href="https://www.bleepingcomputer.com/news/cryptocurrency/microsoft-halts-bitcoin-transactions-because-its-an-unstable-currency/" target="_blank" rel="noopener">ceased accepting payments in Bitcoin</a>, citing volatility concerns. In December, online game giant <strong>Steam </strong>said it was <a href="http://www.businessinsider.com/valve-owned-steam-has-stopped-accepting-bitcoin-2017-12" target="_blank" rel="noopener">dropping support for bitcoin payments</a> for the same reason.</p>
<p>And, as KrebsOnSecurity noted last month, even cybercriminals who run online stores that sell stolen identities and credit cards <a href="https://krebsonsecurity.com/2017/12/skyrocketing-bitcoin-fees-hit-carders-in-wallet/" target="_blank" rel="noopener">are urging their customers to transact in something other than bitcoin</a>.</p>
<p>Interestingly, bitcoin is thought to have been behind a huge jump in Overstock&#8217;s stock price in 2017. In December, Overstock CEO <strong>Patrick Byrne </strong>reportedly <a href="https://www.fool.com/investing/2018/01/04/how-overstockcom-inc-stock-rose-265-in-2017.aspx" target="_blank" rel="noopener">stoked the cryptocurrency fires</a> when he said that he might want to sell Overstock&#8217;s e-tailing operations and pour the extra cash into accelerating his blockchain-based business ideas instead.</p>
<p>In case anyone is wondering what I did with the &#8220;profit&#8221; I made from this scheme, I offered to send it back to Overstock, but they told me to keep it. Instead, I donated it to <a href="https://archive.org/donate/bitcoin.php" target="_blank" rel="noopener">archive.org</a>, a site that has come in handy for many stories published here.</p>


feed_id: https://krebsonsecurity.com/?p=42156
title: Microsoft’s Jan. 2018 Patch Tuesday Lowdown
uri: Microsoft-s-Jan-2018-Patch-Tuesday-Lowdown
url: https://krebsonsecurity.com/2018/01/microsofts-jan-2018-patch-tuesday-lowdown/
content:
<p><strong>Microsoft</strong> on Tuesday released 14 security updates, including fixes for the <strong>Spectre</strong> and <strong>Meltdown</strong> flaws detailed last week, as well as a zero-day vulnerability in <strong>Microsoft Office</strong> that is being exploited in the wild. Separately, <strong>Adobe</strong> pushed a security update to its <strong>Flash Player</strong> software.</p>
<p><img class="alignright wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="206" height="216" />Last week&#8217;s story, <a href="https://krebsonsecurity.com/2018/01/scary-chip-flaws-raise-spectre-of-meltdown/" target="_blank" rel="noopener">Scary Chip Flaws Raise Spectre of Meltdown</a>, sought to explain the gravity of these two security flaws present in most modern computers, smartphones, tablets and mobile devices. The bugs are thought to be mainly exploitable in chips made by <strong>Intel</strong> and <strong>ARM</strong>, but researchers said it was possible they also could be leveraged to steal data from computers with chips made by <strong>AMD</strong>.</p>
<p>By the time that story had published, Microsoft had already begun shipping an emergency update to address the flaws, but many readers complained that their PCs experienced the dreaded &#8220;<a href="https://krebsonsecurity.com/2010/03/secret-obsession-odd-windows-crash-alerts/" target="_blank" rel="noopener">blue screen of death</a>&#8221; (BSOD) after applying the update. Microsoft warned that the BSOD problems were attributable to many antivirus programs not yet updating their software to play nice with the security updates.</p>
<p>On Tuesday, Microsoft said it was suspending the patches for computers running AMD chipsets.</p>
<p>&#8220;After investigating, Microsoft determined that some AMD chipsets do not conform to the documentation previously provided to Microsoft to develop the Windows operating system mitigations to protect against the chipset vulnerabilities known as Spectre and Meltdown,&#8221; the company said in <a href="https://support.microsoft.com/en-us/help/4073707/windows-os-security-update-block-for-some-amd-based-devices?ranMID=24542&amp;ranEAID=nOD%2FrLJHOac&amp;ranSiteID=nOD_rLJHOac-_HQEBR_XRHQKxjSSaNyFXQ&amp;tduid=(c438b93529abd1646060d8789010252e)(256380)(2459594)(nOD_rLJHOac-_HQEBR_XRHQKxjSSaNyFXQ)()" target="_blank" rel="noopener">a notice posted to its support site</a>.</p>
<p>&#8220;To prevent AMD customers from getting into an unbootable state, Microsoft has temporarily paused sending the following Windows operating system updates to devices that have impacted AMD processors,&#8221; the company continued. &#8220;Microsoft is working with AMD to resolve this issue and resume Windows OS security updates to the affected AMD devices via Windows Update and WSUS as soon as possible.&#8221;</p>
<p>In short, if you&#8217;re running Windows on a computer powered by an AMD, you&#8217;re not going to be offered the Spectre/Meltdown fixes for now. Not sure whether your computer has an Intel or AMD chip? Most modern computers display this information (albeit very briefly) when the computer first starts up, before the Windows logo appears on the screen.</p>
<p>Here&#8217;s another way. From within Windows, users can find this information by pressing the Windows key on the keyboard and the &#8220;Pause&#8221; key at the same time, which should open the System Properties feature. The chip maker will be displayed next to the &#8220;Processor:&#8221; listing on that page.</p>
<p>Microsoft also on Tuesday <a href="https://cloudblogs.microsoft.com/microsoftsecure/2018/01/09/understanding-the-performance-impact-of-spectre-and-meltdown-mitigations-on-windows-systems/" target="_blank" rel="noopener">provided more information</a> about the potential performance impact on Windows computers after installing the Spectre/Meltdown updates. To summarize, Microsoft said <strong>Windows 7</strong>, <strong>8.1</strong> and <strong>10</strong> users on older chips (circa 2015 or older), as well as Windows server users on any silicon, are likely to notice a slowdown of their computer after applying this update.</p>
<p>Any readers who experience a BSOD after applying January&#8217;s batch of updates may be able to get help from Microsoft&#8217;s site: Here are the corresponding help pages for <a href="https://support.microsoft.com/en-us/help/17074/windows-7-resolving-stop-blue-screen-errors" target="_blank" rel="noopener">Windows 7</a>, <a href="https://support.microsoft.com/en-us/help/17075/windows-8-resolving-blue-screen-errors" target="_blank" rel="noopener">Windows 8.1</a> and <a href="https://support.microsoft.com/en-us/help/14238/windows-10-troubleshoot-blue-screen-errors" target="_blank" rel="noopener">Windows 10</a> users.</p>
<p>As evidenced by this debacle, it&#8217;s a good idea to get in the habit of backing up your system on a regular basis. I typically do this at least once a month &#8212; but especially right before installing any updates from Microsoft. <span id="more-42156"></span></p>
<p>Attackers could exploit a zero-day vulnerability in Office (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802" target="_blank" rel="noopener">CVE-2018-0802</a>) just by getting a user to open a booby-trapped Office document or visit a malicious/hacked Web site. Microsoft also patched a flaw (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0819" target="_blank" rel="noopener">CVE-2018-0819</a>) in <strong>Office for Mac</strong> that was publicly disclosed prior to the patch being released, potentially giving attackers a heads up on how to exploit the bug.</p>
<p>Of the 56 vulnerabilities addressed in the January Patch Tuesday batch, at least 16 earned Microsoft&#8217;s critical rating, meaning attackers could exploit them to gain full access to Windows systems with little help from users. For more on Tuesday&#8217;s updates from Microsoft, check out blogs from <a href="https://www.ivanti.com/blog/january-patch-tuesday-2017/" target="_blank" rel="noopener">Ivanti</a> and <a href="https://blog.qualys.com/laws-of-vulnerabilities/2018/01/09/january-patch-tuesday-meltdown-spectre-16-critical-microsoft-patches-1-adobe-patch" target="_blank" rel="noopener">Qualys</a>.</p>
<p><img class="alignleft size-full wp-image-18875" src="media/18bb50f1.brokenflash-a.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="" width="211" height="180" />As per usual, Adobe issued an update for Flash Player yesterday. The update brings Flash to <em>version 28.0.0.137</em> on Windows, <strong>Mac</strong>, and <strong>Linux</strong> systems. Windows users who browse the Web with anything other than <strong>Internet Explorer</strong> may need to apply the Flash patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>
<p><strong>Chrome</strong> and IE should auto-install the latest Flash version on browser restart (users may need to manually check for updates and/or restart the browser to get the latest Flash version). Chrome users may need to restart the browser to install or automatically download the latest version.</p>
<p>When in doubt, click the vertical three dot icon to the right of the URL bar, select “Help,” then “About Chrome”: If there is an update available, Chrome should install it then. Chrome will replace that three dot icon with an up-arrow inside of a circle when updates are waiting to be installed.</p>
<p>Standard disclaimer: Because Flash remains such a security risk, I continue to encourage readers to remove or hobble Flash Player unless and until it is needed for a specific site or purpose. More on that approach (as well as slightly less radical solutions ) can be found in <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank" rel="noopener">A Month Without Adobe Flash Player</a>. The short version is that you can probably get by without Flash installed and not miss it at all.</p>
<p>For readers still unwilling to cut the Flash cord, there are half-measures that work almost as well. Fortunately, <a href="https://support.google.com/chrome/answer/108086?hl=en" target="_blank" rel="noopener">disabling Flash in Chrome</a> is simple enough. Paste “<a href="chrome://settings/content" target="_blank" rel="noopener">chrome://settings/content</a>” into a Chrome browser bar and then select “Flash” from the list of items. By default it should be set to “Ask first” before running Flash, although users also can disable Flash entirely here or whitelist and blacklist specific sites.</p>
<p>Another, perhaps less elegant, solution is to keep Flash installed in a browser that you don’t normally use, and then to only use that browser on sites that require it.</p>


feed_id: https://krebsonsecurity.com/?p=42160
title: Bitcoin Blackmail by Snail Mail Preys on Those with Guilty Conscience
uri: Bitcoin-Blackmail-by-Snail-Mail-Preys-on-Those-with-Guilty-Conscience
url:
https://krebsonsecurity.com/2018/01/bitcoin-blackmail-by-snail-mail-preys-on-those-with-guilty-conscience/

content:
<p>KrebsOnSecurity heard from a reader whose friend recently received a remarkably customized extortion letter via snail mail that threatened to tell the recipient&#8217;s wife about his supposed extramarital affairs unless he paid $3,600 in bitcoin. The friend said he had nothing to hide and suspects this is part of a random but well-crafted campaign to prey on men who may have a guilty conscience.</p>
<p>The letter addressed the recipient by his first name and hometown throughout, and claimed to have evidence of the supposed dalliances.</p>
<blockquote><p>&#8220;You don&#8217;t know me personally and nobody hired me to look into you,&#8221; the letter begins. &#8220;Nor did I go out looking to burn you. It is just your bad luck that I stumbled across your misadventures while working on a job around Bellevue.&#8221;</p></blockquote>
<p>The missive continues:</p>
<blockquote><p>&#8220;I then put in more time than I probably should have looking into your life. Frankly, I am ready to forget all about you and let you get on with your life. And I am going to give you two options that will accomplish that very thing. These two options are to either ignore this letter, or simply pay me $3,600. Let&#8217;s examine those two options in more detail.&#8221;</p></blockquote>
<p>The letter goes on to say that option 1 (ignoring the threat) means the author will send copies of his alleged evidence to the man&#8217;s wife and to her friends and family if he does not receive payment within 12 days of the letter&#8217;s post marked date.</p>
<p>&#8220;So [name omitted], even if you decide to come clean with your wife, it won&#8217;t protect her from the humiliation she will feel when her friends and family find out your sordid details from me,&#8221; the extortionist wrote.<span id="more-42160"></span></p>
<p>Option 2, of course, involves sending $3,600 in Bitcoin to an address specified in the letter. That bitcoin address does not appear to have received any payments. Attached to the two-sided extortion note is a primer on different ways to quickly and easily obtain bitcoin.</p>
<p>&#8220;If I don&#8217;t receive the bitcoin by that date, I will go ahead and release the evidence to everyone,&#8221; the letter concludes. &#8220;If you go that route, then the least you could do is tell your wife so she can come up with an excuse to prepare her friends and family before they find out. The clock is ticking, [name omitted].&#8221;</p>
<p>Of course, sending extortion letters via postal mail is <a href="https://en.wikipedia.org/wiki/Mail_and_wire_fraud" target="_blank" rel="noopener">mail fraud</a>, a crime which carries severe penalties (fines of up to $1 million and up to 30 years in jail). However, as the extortionist rightly notes in his letter, the likelihood that authorities would ever be able to catch him is probably low.</p>
<p>The last time I heard of or saw this type of targeted extortion by mail was in the wake of the <a href="https://krebsonsecurity.com/?s=ashley+madison&amp;x=0&amp;y=0" target="_blank" rel="noopener">2015 breach at online cheating site AshleyMadison.com</a>. But those attempts made more sense to me since obviously many AshleyMadison users quite clearly did have an affair to hide.</p>
<p>In any case, I&#8217;d wager that this scheme &#8212; assuming that the extortionist is lying and has indeed sent these letters to targets without actual knowledge of extramarital affairs on the part of the recipients &#8212; has a decent chance of being received by someone who really does have a current or former fling that he is hiding from his spouse. Whether that person follows through and pays the extortion, though, is another matter.</p>
<p>I searched online for snippets of text from the extortion letter and found just one other mention of what appears to be the same letter: It was targeting people in Wellesley, Mass, according to a local news report from December 2017.</p>
<p>According to <a href="https://theswellesleyreport.com/2017/12/bah-humbug-in-wellesley-bitcoin-extortionist-betting-residents-have-been-naughty-not-nice/" target="_blank" rel="noopener">that report</a>, the local police had a couple of residents drop off letters or call to report receiving them, &#8220;but to our knowledge no residents have fallen prey to the scam. The envelopes have no return address and are postmarked out of state, but from different states. The people who have notified us suspected it was a scam and just wanted to let us know.”</p>
<p>In the Massachusetts incidents, the extortionist was asking for $8,500 in bitcoin. Assuming it is the same person responsible for sending this letter, perhaps the extortionist wasn&#8217;t getting many people to bite and thus lowered his &#8220;fee.&#8221;</p>
<p>I opted not to publish a scan of the letter here because it was double-sided and redacting names, etc. gets dicey thanks to photo and image manipulation tools. <a href="media/d58603de.extortionletter.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/extortionletter.pdf" target="_blank" rel="noopener">Here&#8217;s a transcription of it instead</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=42223
title: Canadian Police Charge Operator of Hacked Password Service Leakedsource.com
uri: Canadian-Police-Charge-Operator-of-Hacked-Password-Service-Leakedsourc
url:
https://krebsonsecurity.com/2018/01/canadian-police-charge-operator-of-hacked-password-service-leakedsource-com/

content:
<p>Canadian authorities have arrested and charged a 27-year-old Ontario man for allegedly selling billions of stolen passwords online through the now-defunct service <strong>Leakedsource.com</strong>.</p>
<div id="attachment_38087" style="width: 579px" class="wp-caption aligncenter"><img class=" wp-image-38087" src="media/b5c74e2f.lsscreen.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/02/lsscreen.png" alt="" width="569" height="313" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/02/lsscreen.png 894w, https://krebsonsecurity.com/wp-content/uploads/2017/02/lsscreen-580x319.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/02/lsscreen-768x422.png 768w" sizes="(max-width: 569px) 100vw, 569px" /><p class="wp-caption-text">The now-defunct Leakedsource service.</p></div>
<p>On Dec. 22, 2017, the <strong>Royal Canadian Mounted Police</strong> (RCMP) charged <strong>Jordan Evan Bloom</strong> of Thornhill, Ontario for trafficking in identity information, unauthorized use of a computer, mischief to data, and possession of property obtained by crime. Bloom is expected to make his first court appearance today.</p>
<p>According to a statement from the RCMP, &#8220;Project Adoration” began in 2016 when the RCMP learned that LeakedSource.com was being hosted by servers located in Quebec.</p>
<p>“This investigation is related to claims about a website operator alleged to have made hundreds of thousands of dollars selling personal information,&#8221; said Rafael Alvarado, the officer in charge of the RCMP Cybercrime Investigative Team. &#8220;The RCMP will continue to work diligently with our domestic and international law enforcement partners to prosecute online criminality.”</p>
<p>In January 2017, multiple news outlets reported that unspecified law enforcement officials had seized the servers for Leakedsource.com, perhaps the largest online collection of usernames and passwords leaked or stolen in some of the worst data breaches — including three billion credentials for accounts at top sites like <strong>LinkedIn </strong>and <strong>Myspace.</strong></p>
<div id="attachment_42229" style="width: 250px" class="wp-caption alignleft"><img class="wp-image-42229" src="media/336fe925.jordanbloom.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/jordanbloom.png" alt="" width="240" height="305" /><p class="wp-caption-text">Jordan Evan Bloom. Photo: RCMP.</p></div>
<p>LeakedSource in October 2015 began selling access to passwords stolen in high-profile breaches. Enter any email address on the site’s search page and it would tell you if it had a password corresponding to that address. However, users had to select a payment plan before viewing any passwords.</p>
<p>The RCMP alleges that Jordan Evan Bloom was responsible for administering the LeakedSource.com website, and earned approximately $247,000 from trafficking identity information.</p>
<p>A <a href="https://krebsonsecurity.com/2017/02/who-ran-leakedsource-com/" target="_blank" rel="noopener">February 2017 story here at KrebsOnSecurity</a> examined clues that LeakedSource was administered by an individual in the United States.  Multiple sources suggested that one of the administrators of LeakedSource also was the admin of <strong>abusewith[dot]us</strong>, a site unabashedly dedicated to helping people hack email and online gaming accounts.<span id="more-42223"></span></p>
<p>That story traced those clues back to a Michigan man who ultimately admitted to running <strong>Abusewith[dot]us</strong>, but who denied being the owner of LeakedSource.</p>
<p>The RCMP said it had help in the investigation from The <strong>Dutch National Police</strong> and the <strong>FBI</strong>. The FBI could not be immediately reached for comment.</p>
<p>LeakedSource was a curiosity to many, and for some journalists a potential source of news about new breaches. But unlike services such as <a href="https://www.breachalarm.com/" target="_blank" rel="noopener">BreachAlarm</a> and <a href="https://haveibeenpwned.com/" target="_blank" rel="noopener">HaveIBeenPwned.com</a> — which force users to verify that they can access a given account or inbox before the site displays whether it has found a password associated with the account in question — LeakedSource did nothing to validate users.</p>
<p>This fact, critics charged, showed that the proprietors of LeakedSource were purely interested in making money and helping others pillage accounts.</p>
<p>Since the demise of LeakedSource.com, multiple, competing new services have moved in to fill the void. These services &#8212; which are primarily useful because they expose when people re-use passwords across multiple accounts &#8212; are popular among those involved in a variety of cybercriminal activities, particular account takeovers and email hacking.</p>


feed_id: https://krebsonsecurity.com/?p=42216
title: Serial SWATter Tyler “SWAuTistic” Barriss Charged with Involuntary Manslaughter
uri: Serial-SWATter-Tyler-SWAuTistic-Barriss-Charged-with-Involuntary
url:
https://krebsonsecurity.com/2018/01/serial-swatter-tyler-swautistic-barriss-charged-with-involuntary-manslaughter/

content:
<p><strong>Tyler Raj Barriss</strong>, a 25-year-old serial &#8220;swatter&#8221; whose phony emergency call to Kansas police last month triggered a fatal shooting, has been charged with involuntary manslaughter and faces up to eleven years in prison.</p>
<div id="attachment_42104" style="width: 235px" class="wp-caption alignright"><img class=" wp-image-42104" src="media/e6e75b15.tylerrajbarriss.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/tylerrajbarriss.png" alt="" width="225" height="301" /><p class="wp-caption-text">Tyler Raj Barriss, in an undated selfie.</p></div>
<p>Barriss&#8217;s online alias &#8212; &#8220;<strong>SWAuTistic</strong>&#8221; &#8212; is a nod to a dangerous hoax known as &#8220;swatting,&#8221; in which the perpetrator spoofs a call about a hostage situation or other violent crime in progress in the hopes of tricking police into responding at a particular address with potentially deadly force.</p>
<p>Barriss was arrested in Los Angeles this month for alerting authorities in Kansas to a fake hostage situation at an address in Wichita, Kansas on Dec. 28, 2017.</p>
<p>Police responding to the alert surrounded the home at the address Barriss provided and shot 28-year old <strong>Andrew Finch</strong> as he emerged from the doorway of his mother&#8217;s home. Finch, a father of two, was unarmed, and died shortly after being shot by police.</p>
<p>The officer who fired the shot that killed Finch has been identified as a seven-year veteran with the Wichita department. He has been placed on administrative leave pending an internal investigation.</p>
<p>Following his arrest, Barriss was extradited to a Wichita jail, where he <a href="https://www.reuters.com/article/us-kansas-swatting/suspect-held-after-first-court-appearance-in-fatal-kansas-swatting-case-idUSKBN1F20O2" target="_blank" rel="noopener">had his first court appearance via video on Friday</a>. <em>The Los Angeles Times</em> reports that Barriss was charged with involuntary manslaughter and could face up to 11 years and three months in prison if convicted.</p>
<div id="attachment_42124" style="width: 518px" class="wp-caption aligncenter"><img class="size-full wp-image-42124" src="media/76cf57ef.singleshot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/singleshot.png" alt="" width="508" height="353" /><p class="wp-caption-text">The moment that police in Kansas fired a single shot that killed Andrew Finch (in doorway of his mother&#8217;s home).</p></div>
<p>Barriss also was charged with making a false alarm &#8212; a felony offense in Kansas. His bond was <a href="http://www.kansas.com/news/local/crime/article194441604.html" target="_blank" rel="noopener">set at $500,000</a>.</p>
<p>Sedgwick County District Attorney <strong>Marc Bennett</strong> told the The LA Times Barriss made the fake emergency call at the urging of several other individuals, and that authorities have identified other &#8220;potential suspects&#8221; that may also face criminal charges.<span id="more-42216"></span></p>
<p>Barriss <a href="https://krebsonsecurity.com/2017/12/kansas-man-killed-in-swatting-attack/" target="_blank" rel="noopener">sought an interview with KrebsOnSecurity</a> on Dec. 29, just hours after his hoax turned tragic. In that interview, Barriss said he routinely called in bomb threats and fake hostage situations across the country in exchange for money, and that he began doing it after his own home was swatted.</p>
<p>Barriss told KrebsOnSecurity that he felt bad about the incident, but that it wasn&#8217;t he who pulled the trigger. He also enthused about the rush that he got from evading police.</p>
<p>“Bomb threats are more fun and cooler than swats in my opinion and I should have just stuck to that,” he wrote in an instant message conversation with this author.</p>
<p>In <a href="http://www.kwch.com/content/news/Swattings-suspect-headed-back-to-Kansas-468818953.html" target="_blank" rel="noopener">a jailhouse interview Friday</a> with local Wichita news station <strong>KWCH</strong>, Barriss said he feels &#8220;a little remorse for what happened.&#8221;</p>
<p>&#8220;I never intended for anyone to get shot and killed,&#8221; he reportedly told the news station. &#8220;I don&#8217;t think during any attempted swatting anyone&#8217;s intentions are for someone to get shot and killed.&#8221;</p>
<p>The <em>Wichita Eagle</em> <a href="http://www.kansas.com/news/local/crime/article194272244.html" target="_blank" rel="noopener">reports</a> that Barriss also has been charged in Calgary, Canada with public mischief, fraud and mischief for allegedly making a similar swatting call to authorities there. However, no one was hurt or killed in that incident.</p>
<p>Barriss was convicted in 2016 for calling in a bomb threat to an ABC affiliate in Los Angeles. He was sentenced to two years in prison for that stunt, but was released in January 2017.</p>
<p>Using his SWAuTistic alias, Barriss claimed credit for more than a hundred fake calls to authorities across the nation. In an exclusive story published here on Jan. 2, KrebsOnSecurity dissected several months&#8217; worth of tweets from SWAuTistic&#8217;s account before those messages were deleted. In those tweets, SWAuTistic claimed responsibility for calling in bogus hostage situations and bomb threats at roughly 100 schools and at least 10 residences.</p>
<p>In his <a href="media/c266a256.swautistic-twitter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/swautistic-twitter.png" target="_blank" rel="noopener">public tweets</a>, SWAuTistic claimed credit for bomb threats against a <a href="https://www.nbcdfw.com/news/local/Downtown-Dallas-Convention-Center-Evacuated-Witnesses-462882893.html" target="_blank" rel="noopener">convention center in Dallas</a> and <a href="http://www.newsherald.com/news/20171128/students-evacuated-after-arnold-high-bomb-threat-with-audio" target="_blank" rel="noopener">a high school in Florida</a>, as well as <a href="https://www.theverge.com/us-world/2017/12/14/16777178/fcc-net-neutrality-vote-evacuation" target="_blank" rel="noopener">an incident</a> that disrupted a much-watched meeting at the <strong>U.S. Federal Communications Commission</strong> (FCC) in November.</p>
<p>But in private online messages shared by his online friends and acquaintances SWAuTistic can be seen bragging about his escapades, claiming to have called in fake emergencies at approximately 100 schools and 10 homes.</p>
<div id="attachment_42106" style="width: 571px" class="wp-caption aligncenter"><img class=" wp-image-42106" src="media/7028a0a8.100schools.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/100schools.png" alt="" width="561" height="299" /><p class="wp-caption-text">The serial swatter known as &#8220;SWAuTistic&#8221; claimed in private conversations to have carried out swattings or bomb threats against 100 schools and 10 homes.</p></div>


feed_id: https://krebsonsecurity.com/?p=41905
title: Some Basic Rules for Securing Your IoT Stuff
uri: Some-Basic-Rules-for-Securing-Your-IoT-Stuff
url: https://krebsonsecurity.com/2018/01/some-basic-rules-for-securing-your-iot-stuff/
content:
<p>Most readers here have likely heard or read various prognostications about the impending doom from the proliferation of poorly-secured &#8220;<strong>I</strong>nternet <strong>o</strong>f <strong>T</strong>hings&#8221; or IoT devices. Loosely defined as any gadget or gizmo that connects to the Internet but which most consumers probably wouldn&#8217;t begin to know how to secure, IoT encompasses everything from security cameras, routers and digital video recorders to printers, wearable devices and “smart” lightbulbs.</p>
<p>Throughout 2016 and 2017, <a href="https://krebsonsecurity.com/?s=mirai+attack&amp;x=0&amp;y=0" target="_blank" rel="noopener">attacks from massive botnets made up entirely of hacked IoT devices</a> had many experts warning of a dire outlook for Internet security. But the future of IoT doesn&#8217;t have to be so bleak. Here&#8217;s a primer on minimizing the chances that your IoT things become a security liability for you or for the Internet at large.</p>
<p><img class="aligncenter size-full wp-image-40170" src="media/a8923b63.iotc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/08/iotc.png" alt="" width="569" height="395" /></p>
<p><strong>-Rule #1: Avoid connecting your devices directly to the Internet</strong> &#8212; either without a firewall or in front it, by poking holes in your firewall so you can access them remotely. Putting your devices in front of your firewall is generally a bad idea because many IoT products were simply not designed with security in mind and making these things accessible over the public Internet could invite attackers into your network. If you have a router, chances are it also comes with a built-in firewall. Keep your IoT devices behind the firewall as best you can.</p>
<p><strong>-Rule #2:</strong> <strong>If you can, change the thing&#8217;s default credentials</strong> to a complex password that only you will know and can remember. And if you do happen to forget the password, it&#8217;s not the end of the world: Most devices have a recessed reset switch that can be used to restore to the thing to its factory-default settings (and credentials). <a href="http://krebsonsecurity.com/password-dos-and-donts/" target="_blank" rel="noopener">Here’s some advice</a> on picking better ones.</p>
<p>I say &#8220;if you can,&#8221; at the beginning of Rule #2 because very often IoT devices &#8212; particularly security cameras and DVRs &#8212; are so poorly designed from a security perspective that even changing the default password to the thing&#8217;s built-in Web interface does nothing to prevent the things from being reachable and vulnerable once connected to the Internet.</p>
<p>Also, many of these devices are found to have hidden, undocumented &#8220;backdoor&#8221; accounts that attackers can use to remotely control the devices. That&#8217;s why Rule #1 is so important.<span id="more-41905"></span></p>
<p><strong>-Rule #3: Update the firmware. </strong>Hardware vendors sometimes make available security updates for the software that powers their consumer devices (known as &#8220;firmware). It&#8217;s a good idea to visit the vendor&#8217;s Web site and check for any firmware updates before putting your IoT things to use, and to check back periodically for any new updates.</p>
<p><strong>-Rule #4: Check the defaults</strong>, and make sure <a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/comment-page-3/#comment-413306" target="_blank" rel="noopener">features you may not want or need</a> like UPnP (<a href="https://en.wikipedia.org/wiki/Universal_Plug_and_Play" target="_blank" rel="noopener">Universal Plug and Play</a> &#8212; which can easily poke holes in your firewall without you knowing it) &#8212; are disabled.</p>
<p>Want to know if something has poked a hole in your router&#8217;s firewall? <strong>Censys</strong> has a decent scanner that may give you clues about any cracks in your firewall. Browse to <strong>whatismyipaddress.com</strong>, then cut and paste the resulting address into the text box at <a href="https://censys.io/" target="_blank" rel="noopener">Censys.io</a>, select &#8220;IPv4 hosts&#8221; from the drop-down menu, and hit &#8220;search.&#8221;</p>
<p>If that sounds too complicated (or if your ISP&#8217;s addresses are on Censys&#8217;s blacklist) check out <strong>Steve Gibson</strong>&#8216;s <a href="https://www.grc.com/x/ne.dll?rh1dkyd2" target="_blank" rel="noopener">Shield&#8217;s Up page</a>, which features a point-and-click tool that can give you information about which network doorways or &#8220;ports&#8221; may be open or exposed on your network. A quick Internet search on exposed port number(s) can often yield useful results indicating which of your devices may have poked a hole.</p>
<p>If you run antivirus software on your computer, consider upgrading to a &#8220;network security&#8221; or &#8220;Internet security&#8221; version of these products, which ship with more full-featured software firewalls that can make it easier to block traffic going into and out of specific ports.</p>
<p>Alternatively, <a href="https://www.glasswire.com/features/" target="_blank" rel="noopener">Glasswire</a> is a useful tool that offers a full-featured firewall as well as the ability to tell which of your applications and devices are using the most bandwidth on your network. Glasswire recently came in handy to help me determine which application was using gigabytes worth of bandwidth each day (it turned out to be a version of Amazon Music&#8217;s software client that had a glitchy updater).</p>
<p><strong>-Rule #5: Avoid IoT devices that advertise Peer-to-Peer (P2P) capabilities</strong> built-in. P2P IoT devices are notoriously difficult to secure, and research has repeatedly shown that they can be reachable even through a firewall remotely over the Internet because they&#8217;re configured to continuously find ways to connect to a global, shared network so that people can access them remotely. For examples of this, see previous stories here, including <a href="https://krebsonsecurity.com/2016/02/this-is-why-people-fear-the-internet-of-things/" target="_blank" rel="noopener">This is Why People Fear the Internet of Things</a>, and <a href="https://krebsonsecurity.com/2016/12/researchers-find-fresh-fodder-for-iot-attack-cannons/" target="_blank" rel="noopener">Researchers Find Fresh Fodder for IoT Attack Cannons</a>.</p>
<p><strong>-Rule #6: Consider the cost.</strong> Bear in mind that when it comes to IoT devices, cheaper usually is not better. There is no direct correlation between price and security, but history has shown the devices that tend to be toward the lower end of the price ranges for their class tend to have the most vulnerabilities and backdoors, with the least amount of vendor upkeep or support.</p>
<p>In the wake of <a href="https://krebsonsecurity.com/2017/12/mirai-iot-botnet-co-authors-plead-guilty/" target="_blank" rel="noopener">last month&#8217;s guilty pleas by several individuals who created Mirai</a> &#8212; one of the biggest IoT malware threats ever &#8212; the <strong>U.S. Justice Department</strong> released <a href="https://www.justice.gov/criminal-ccips/page/file/984001/download" target="_blank" rel="noopener">a series of tips on securing IoT devices</a>.</p>
<p>One final note: I realize that the people who probably need to be reading these tips the most likely won&#8217;t ever know they need to care enough to act on them. But at least by taking proactive steps, you can reduce the likelihood that your IoT things will contribute to the global IoT security problem.</p>


feed_id: https://krebsonsecurity.com/?p=42149
title: Expert: IoT Botnets the Work of a ‘Vast Minority’
uri: Expert-IoT-Botnets-the-Work-of-a-Vast-Minority
url: https://krebsonsecurity.com/2018/01/expert-iot-botnets-the-work-of-a-vast-minority/
content:
<p>In December 2017, the <strong>U.S. Department of Justice</strong> announced <a href="https://krebsonsecurity.com/2017/12/mirai-iot-botnet-co-authors-plead-guilty/" target="_blank" rel="noopener">indictments and guilty pleas by three men</a> in the United States responsible for creating and using <strong>Mirai</strong>, a malware strain that enslaves poorly-secured &#8220;Internet of Things&#8221; or IoT devices like security cameras and digital video recorders for use in large-scale cyberattacks.</p>
<p>The FBI and the DOJ had help in their investigation from many security experts, but this post focuses on one expert whose research into the Dark Web and its various malefactors was especially useful in that case. <a href="https://www.linkedin.com/in/allison-nixon-81822124/" target="_blank" rel="noopener"><strong>Allison Nixon</strong></a> is director of security research at <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a>, a cyber intelligence firm based in New York City. Nixon spoke with KrebsOnSecurity at length about her perspectives on IoT security and the vital role of law enforcement in this fight.</p>
<p><strong>Brian Krebs (BK): </strong>Where are we today with respect to IoT security? Are we better off than were a year ago, or is the problem only worse?</p>
<p><strong>Allison Nixon (AN):</strong> In some aspects we’re better off. The arrests that happened over the last year in the DDoS space, I would call that a good start, but we’re not out of the woods yet and we’re nowhere near the end of anything.</p>
<p><strong>BK:</strong> Why not?</p>
<p><strong>AN:</strong> Ultimately, what’s going with these IoT botnets is crime. People are talking about these cybersecurity problems &#8212; problems with the devices, etc. &#8212; but at the end of the day it’s crime and private citizens don’t have the power to make these bad actors stop.</p>
<p><strong>BK:</strong> Certainly security professionals like yourself and others can be diligent about tracking the worst actors and the crime machines they’re using, and in reporting those systems when it’s advantageous to do so?</p>
<p><strong>AN:</strong> That’s a fair argument. I can send abuse complaints to servers being used maliciously. And people can write articles that name individuals. However, it’s still a limited kind of impact. I’ve seen people get named in public and instead of stopping, what they do is improve their opsec [operational security measures] and keep doing the same thing but just sneakier. In the private sector, we can frustrate things, but we can’t actually stop them in the permanent, sanctioned way that law enforcement can. We don’t really have that kind of control.</p>
<p><strong>BK:</strong> How are we not better off?</p>
<p><strong>AN:</strong> I would say that as time progresses, the community that practices DDoS and malicious hacking and these pointless destructive attacks get more technically proficient when they’re executing attacks, and they just become a more difficult adversary.</p>
<p><strong>BK: </strong>A more difficult adversary?</p>
<p><strong>AN:</strong> Well, if you look at <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank" rel="noopener">the individuals that were the subject of the announcement this month</a>, and you look in their past, you can see they’ve been active in the hacking community a long time. Litespeed [the nickname used by <a href="media/d6598997.whiteddosplea.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/whiteddosplea.pdf" target="_blank" rel="noopener">Josiah White</a>, one of the men who pleaded guilty to authoring Mirai] has been credited with lots of code.  He’s had years to develop and as far as I could tell he didn’t stop doing criminal activity until he got picked up by law enforcement.</p>
<p><strong>BK:</strong> It seems to me that the Mirai authors probably would not have been caught had they never <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank" rel="noopener">released the source code for their malware</a>. They said they were doing so because multiple law enforcement agencies and security researchers were hot on their trail and they didn&#8217;t want to be the only ones holding the source code when the cops showed up at their door. But if that was really their goal in releasing it, doing so seems to have had the exact opposite effect. What&#8217;s your take on that?</p>
<p class="p1"><strong>AN:</strong> You are absolutely, 100 million percent correct. If they just shut everything down and left, they’d be fine now. The fact that they dumped the source was a tipping point of sorts. The damages they caused at that time were massive, but when they dumped the source code the amount of damage their actions contributed to ballooned [due to the proliferation of copycat Mirai botnets]. The charges against them specified their actions in infecting the machines they controlled, but when it comes to what interested researchers in the private sector, the moment they dumped the source code &#8212; that’s the most harmful act they did out of the entire thing.</p>
<p class="p1"><strong>BK:</strong> Do you believe their claimed reason for releasing the code?</p>
<p class="p1"><strong>AN:</strong> I believe it. They claimed they released it because they wanted to hamper investigative efforts to find them. The problem is that not only is it incorrect, it also doesn&#8217;t take into account the researchers on the other end of the spectrum who have to pick from many targets to spend their time looking at. Releasing the source code changed that dramatically. It was like catnip to researchers, and was just a new thing for researchers to look at and play with and wonder who wrote it.</p>
<p class="p1">If they really wanted to stay off law enforcement&#8217;s radar, they would be as low profile as they could and not be interesting. But they did everything wrong: <span class="pullquote pqleft">They dumped the source code and <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank" rel="noopener">attacked a security researcher</a> using tools that are interesting to security researchers. That’s like attacking a dog with a steak.</span> I’m going to wave this big juicy steak at a dog and that will teach him. They made every single mistake in the book.</p>
<p><strong>BK:</strong> What do you think it is about these guys that leads them to this kind of behavior? Is it just a kind of inertia that inexorably leads them down a slippery slope if they don’t have some kind of intervention?</p>
<p><strong>AN:</strong> These people go down a life path that does not lead them to a legitimate livelihood. They keep doing this and get better at it and they start to do these things that really <a href="https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-reddit/" target="_blank" rel="noopener">can threaten the Internet as a whole</a>. In the case of these DDoS botnets, it’s worrying that these individuals are allowed to go this deep before law enforcement catches them.<span id="more-42149"></span></p>
<p><strong>BK:</strong> There was a narrative that got a lot of play recently, and it was spun by a self-described Internet vigilante who calls himself “<strong>the Janitor</strong>.&#8221; He claimed to have been finding zero-day exploits in IoT devices so that he could shut down insecure IoT things that can’t really be secured before or maybe even after they have been compromised by IoT threats like Mirai. The Janitor says he <a href="https://archive.is/PQAnU" target="_blank" rel="noopener">released a bunch of his code</a> because he’s tired of being the unrecognized superhero that he is, and many in the media seem to have eaten this up and taken his manifesto as gospel. What’s your take on the Janitor, and his so-called “<a href="https://arstechnica.com/information-technology/2017/04/brickerbot-the-permanent-denial-of-service-botnet-is-back-with-a-vengeance/" target="_blank" rel="noopener">bricker bot</a>” project?</p>
<p><strong>AN:</strong> I have to think about how to choose my words, because I don’t want to give anyone bad ideas. But one thing to keep in mind is that his method of bricking IoT devices doesn’t work, and it potentially makes the problem worse.</p>
<p><strong>BK:</strong> What do you mean exactly?</p>
<p><strong>AN:</strong> The reason is sometimes IoT malware like Mirai will try to close the door behind it, by crashing the telnet process that was used to infect the device [after the malware is successfully installed]. This can block other telnet-based malware from getting on the machine. And there’s a lot of this type of King of the Hill stuff going on in the IoT ecosystem right now.</p>
<p>But what [this bricker bot] malware does is a lot times it reboots a machine, and when the device is in that state the vulnerable telnet service goes back up. It used to be a lot of devices were infected with the very first Mirai, and when the [control center] for that botnet went down they were orphaned. We had a bunch of Mirai infections phoning home to nowhere. So there’s a real risk of taking the machine that was in the this weird state and making it vulnerable again.</p>
<p class="p1"><strong>BK:</strong> Hrm. That&#8217;s a very different story from the one told by the Bricker bot author. According to him, he spent several years of his life saving the world from certain doom at the hands of IoT devices. He even took credit for <a href="https://krebsonsecurity.com/2016/11/new-mirai-worm-knocks-900k-germans-offline/" target="_blank" rel="noopener">foiling the Mirai attacks on Deutsche Telekom</a>. Could this just be a case of researcher exaggerating his accomplishments? Do you think his Bricker bot code ever really spread that far?</p>
<p class="p1"><strong>AN:</strong> I don’t have any evidence that there was mass exploitation by Bricker bot. I know his code was published. But when I talk to anyone running an IoT honeypot [a collection of virtual or vulnerable IoT devices designed to attract and record novel attacks against the devices] they have never seen it. The consensus is that regardless of peoples’ opinion on it we haven’t seen it in our honeypots. And considering the diversity of IoT honeypots out there today, if it was out there in real life we would have seen it by now.</p>
<p class="p1"><strong>BK:</strong> A lot of people believe that we&#8217;re focusing on the wrong solutions to IoT security &#8212; that <a href="https://krebsonsecurity.com/2018/01/some-basic-rules-for-securing-your-iot-stuff/" target="_blank" rel="noopener">having consumers lock down IoT devices security-wise</a> or expecting law enforcement agencies to fix this problem for us for me are pollyannish ideas that in any case don&#8217;t address the root cause: Which is that there are a lot of companies producing crap IoT products that have virtually no security. What&#8217;s your take?</p>
<p class="p1"><strong>AN:</strong> The way I approach this problem is I see law enforcement as the ultimate end goal for all of these efforts. When I look at the IoT DDoS activity and the actual human beings doing this, <span class="pullquote pqleft">the vast majority of Mirai attacks, attack infrastructure, malware variants and new exploits are coming from a vast minority of people doing this.</span> That said, the way I perceive the underground ecosystem is probably different than the way most people perceive it.</p>
<p class="p1"><strong>BK:</strong> What&#8217;s the popular perception, do you think?</p>
<p class="p1"><strong>AN:</strong> It&#8217;s that, &#8220;Oh hey, one guy got arrested, great, but another guy will just take his place.&#8221; People compare it to a drug dealer on the street corner, but I don&#8217;t think that&#8217;s accurate in this case. The difference is when you’re looking at advanced criminal hacking campaigns, there’s not usually a replacement person waiting in the wings. These are incredibly deep skills developed over years. The people doing innovations in DDoS attacks and those who are driving the field forward are actually very few. So when you can ID them and attach behavior to the perpetrator, you realize there’s only a dozen people I need to care about and the world suddenly becomes a lot smaller.</p>
<p class="p1"><strong>BK:</strong> So do you think the efforts to force manufacturers to harden their products are a waste of time?</p>
<p class="p1"><strong>AN:</strong> I want to make it clear that all these different ways to tackle the problem&#8230;I don’t want to say one is more important than the other. I just happened to be working on one component of it. There’s definitely a lot of disagreement on this. I totally recognize this as a legitimate approach. A lot of people think the way forward is to focus on making sure the devices are secure. And there are efforts ongoing to help device manufacturers create more secure devices that are more resistant to these efforts.</p>
<p class="p1">And a lot is changing, although slowly. Do you remember way back when you bought a Wi-Fi router and it was open by default? Because the end user was obligated to change the default password, we had open Wi-Fi networks everywhere. As years passed, many manufacturers started making them more secure. For example, many of these devices now have customers refer to sticker on the machine that has a unique Wi-Fi password. That type of shift may be an example of what we can see in the future of IoT security.</p>
<p class="p1"><strong>BK:</strong> In the wake of the huge attacks from Mirai in 2016 and 2017, <a href="https://krebsonsecurity.com/2017/08/new-bill-seeks-basic-iot-security-standards/" target="_blank" rel="noopener">several lawmakers have proposed solutions</a>. What do you think of the idea that it doesn&#8217;t matter what laws we pass in the United States that might require more security by IoT makers, that those makers are just going to keep on ignoring best practices when it comes to security?</p>
<p class="p1"><strong>AN:</strong> It’s easy to get cynical about this and a lot of people definitely feel like these these companies don’t sell directly to the U.S. and therefore don&#8217;t care about such efforts. Maybe in the short term that might be true, but in the long term I think it ends up biting them if they continue to not care.</p>
<p class="p1">Ultimately, these things just catch up with you if you have a reputation for making a poor product. What if you had a reputation for making a device that if you put it on the Internet it would reboot every five minutes because it’s getting attacked? Even if we did enact security requirements for IoT that manufacturers not in the U.S. wouldn&#8217;t have to follow, it would still in their best interests to care, because they are going to care sooner or later.</p>
<p class="p1"><strong>BK:</strong> I was on a Justice Department conference call with other journalists on the day they announced the Mirai author arrests and guilty pleas, and someone asked why this case was prosecuted out of Alaska. The answer that came back was that a great many of the machines infected with Mirai were in Alaska. But it seems more likely that it was because there was an FBI agent there who decided this was an important case but who actually had a very difficult time finding enough infected systems to reach the threshold needed to prosecute the case. What&#8217;s your read on that?</p>
<p class="p1"><strong>AN:</strong> I think that this case is probably going to set precedent in terms of the procedures and processes used to go after cybercrime. I’m sure you finished reading <a href="https://www.wired.com/story/mirai-botnet-minecraft-scam-brought-down-the-internet/" target="_blank" rel="noopener">The Wired article</a> about the Alaska investigation into Mirai: It goes in to detail about some of the difficult things that the Alaska FBI field office had to do to satisfy the legal requirements to take the case. Just to prove they had jurisdiction, they had to find a certain number of infected machines in Alaska.</p>
<p class="p1">Those were not easy to find, and in fact the FBI traveled far and wide in order to find these machines in Alaska. There are all kinds of barriers big and small that slow down the legal process for prosecuting cases like this, some of which are legitimate and some that I think are going to end up being streamlined after a case like this. And every time a successful case like this goes through [to a guilty plea], it makes it more possible for future cases to succeed.</p>
<p class="p1">This one group [that was the subject of the Mirai investigation] was the worst of the worst in this problem area. And right now it’s a huge victory for law enforcement to take down one group that is the worst of the worst in one problem area. Hopefully, it will lead to the takedown of many groups causing damage and harming people.</p>
<p class="p1">But the concept that in order for cybercriminals to get law enforcement attention they need to make international headlines and cause massive damage needs to change. Most cybercriminals probably think that what they&#8217;re doing nobody is going to notice, and in a sense they’re correct because there is so much obvious criminal activity blatantly connected to specific individuals. And that needs to change.</p>
<p class="p1"><strong>BK:</strong> Is there anything we didn&#8217;t talk about related to IoT security, the law enforcement investigations into Mirai, or anything else you&#8217;d like to add?</p>
<p class="p1"><strong>AN:</strong> I want to extend my gratitude to the people in the security industry and network operator community who recognized the gravity of this threat early on. There are a lot of people who were not named [in the stories and law enforcement press releases about the Mirai arrests], and want to say thank you for all the help. This couldn’t have happened without you.</p>


feed_id: https://krebsonsecurity.com/?p=42311
title: Chronicle: A Meteor Aimed At Planet Threat Intel?
uri: Chronicle-A-Meteor-Aimed-At-Planet-Threat-Intel
url: https://krebsonsecurity.com/2018/01/chronicle-a-meteor-aimed-at-planet-threat-intel/
content:
<p><strong>Alphabet Inc.</strong>, the parent company of <strong>Google</strong>, said today it is in the process of rolling out a new service designed to help companies more quickly make sense of and act on the mountains of threat data produced each day by cybersecurity tools.</p>
<p><img class="alignright size-full wp-image-42323" src="media/13a8330b.chonicle.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/chonicle.png" alt="" width="275" height="217" />Countless organizations rely on a hodgepodge of security software, hardware and services to find and detect cybersecurity intrusions before an incursion by malicious software or hackers has the chance to metastasize into a full-blown data breach.</p>
<p>The problem is that the sheer volume of data produced by these tools is staggering and increasing each day, meaning already-stretched IT staff often miss key signs of an intrusion until it&#8217;s too late.</p>
<p>Enter &#8220;<strong>Chronicle</strong>,&#8221; a nascent platform that graduated from the tech giant&#8217;s &#8220;X&#8221; division, which is a separate entity tasked with tackling hard-to-solve problems with an eye toward leveraging the company&#8217;s core strengths: Massive data analytics and storage capabilities, machine learning and custom search capabilities.</p>
<p>&#8220;We want to 10x the speed and impact of security teams’ work by making it much easier, faster and more cost-effective for them to capture and analyze security signals that have previously been too difficult and expensive to find,&#8221; <a href="https://medium.com/chronicle-blog/give-good-the-advantage-75ab2c242e45" target="_blank" rel="noopener">wrote</a> <strong>Stephen Gillett</strong>, CEO of the new venture.</p>
<p>Few details have been released yet about how exactly Chronicle will work, although the company did say it would draw in part on data from <a href="https://www.virustotal.com" target="_blank" rel="noopener">VirusTotal</a>, a free service acquired by Google in 2012 that allows users to scan suspicious files against dozens of commercial antivirus tools simultaneously.</p>
<p>Gillett said his division is already trialing the service with several Fortune 500 firms to test the preview release of Chronicle, but the company declined to name any of those participating.</p>
<h4>ANALYSIS</h4>
<p>It&#8217;s not terribly clear from Gillett&#8217;s post or <a href="https://blog.x.company/graduation-day-introducing-chronicle-318d34b80cce" target="_blank" rel="noopener">another blog post</a> from Alphabet&#8217;s X division by <strong>Astro Teller</strong> how exactly Chronicle will differentiate itself in such a crowded market for cybersecurity offerings. But it&#8217;s worth considering the impact that VirusTotal has had over the years.</p>
<p>Currently, VirusTotal handles approximately one million submissions each day. The results of each submission get shared back with the entire community of antivirus vendors who lend their tools to the service &#8212; which allows each vendor to benefit by adding malware signatures for new variants that their tools missed but that a preponderance of other tools flagged as malicious.</p>
<p>Naturally, cybercriminals have responded by creating their own criminal versions of VirusTotal: So-called <a href="https://krebsonsecurity.com/?s=%22virus+scanners+for+virus+authors%22&amp;x=0&amp;y=0" target="_blank" rel="noopener">&#8220;no distribute&#8221; scanners</a>. These services cater to malware authors, and use the same stable of antivirus tools, except they prevent these tools from phoning home to the antivirus companies about new, unknown variants.<span id="more-42311"></span></p>
<p>On balance, it&#8217;s difficult to know whether the benefit that antivirus companies &#8212; and by extension their customers &#8212; gain by partnering with VirusTotal outweighs the mayhem enabled by these no-distribute scanners. But it seems clear that VirusTotal has helped antivirus companies and their customers do a better job focusing on threats that really matter, as opposed to chasing after (or cleaning up after) so-called &#8220;false positives,&#8221; &#8212; benign files that erroneously get flagged as malicious.</p>
<p>And this is precisely the signal-to-noise challenge created by the proliferation of security tools used in a typical organization today: How to spend more of your scarce cybersecurity workforce, budget and time identifying and stopping the threats that matter and less time sifting through noisy but otherwise time-wasting alerts triggered by non-threats.</p>
<p>I&#8217;m not a big listener of podcasts, but I do find myself increasingly making time to listen to <a href="https://risky.biz/netcasts/risky-business/" target="_blank" rel="noopener">Risky Business</a>, a podcast produced by Australian cybersecurity journalist <strong>Patrick Gray</strong>. Responding to today&#8217;s announcement on Chronicle, Gray said he likewise had few details about it but was looking forward to learning more.</p>
<p>&#8220;Google has so much data and so many amazing internal resources that my gut reaction is to think this new company could be a meteor aimed at planet Threat Intel™️,&#8221; Gray <a href="http://twitter.com/riskybusiness/status/956276917107269634" target="_blank" rel="noopener">quipped on Twitter</a>, referring to the burgeoning industry of companies competing to help companies trying to identify new threats and attack trends. &#8220;Imagine if other companies spin out their tools&#8230;Netflix, Amazon, Facebook etc. That could be a fundamentally reshaped industry.&#8221;</p>
<p>Well said. I also look forward to hearing more about how Chronicle works and, more importantly, <em>if</em> it works.</p>
<p>Full disclosure: Since <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" rel="noopener" target="_blank">September 2016</a>, KrebsOnSecurity has received protection against massive online attacks from <a href="https://projectshield.withgoogle.com/public/" target="_blank" rel="noopener">Project Shield</a>, a free anti-distributed denial-of-service (DDoS) offering provided by <strong>Jigsaw</strong> &#8212; another subsidiary of Google&#8217;s parent company. Project Shield provides DDoS protection for news, human rights, and elections monitoring Web sites.</p>


feed_id: https://krebsonsecurity.com/?p=42213
title: Registered at SSA.GOV? Good for You, But Keep Your Guard Up
uri: Registered-at-SSA-GOV-Good-for-You-But-Keep-Your-Guard-Up
url: https://krebsonsecurity.com/2018/01/registered-at-ssa-gov-good-for-you-but-keep-your-guard-up/
content:
<p>KrebsOnSecurity has <a href="https://krebsonsecurity.com/2013/09/crooks-hijack-retirement-funds-via-ssa-portal/" target="_blank" rel="noopener">long warned</a> readers to plant your own flag at the <a href="https://secure.ssa.gov/RIL/SiView.do" target="_blank" rel="noopener">my Social Security online portal</a> of the <strong>U.S. Social Security Administration</strong> (SSA) &#8212; even if you are not yet drawing benefits from the agency &#8212; because identity thieves have been registering accounts in peoples&#8217; names and siphoning retirement and/or disability funds. This is the story of a Midwest couple that took all the right precautions and still got hit by ID thieves who impersonated them to the SSA directly over the phone.</p>
<p>In mid-December 2017 this author heard from <strong>Ed Eckenstein</strong>, a longtime reader in Oklahoma whose wife <strong>Ruth</strong> had just received a snail mail letter from the SSA about successfully applying to withdraw benefits. The letter confirmed she&#8217;d requested a one-time transfer of more than $11,000 from her SSA account. The couple said they were perplexed because both previously had taken my advice and registered accounts with MySocialSecurity, even though Ruth had not yet chosen to start receiving SSA benefits.</p>
<div id="attachment_42340" style="width: 601px" class="wp-caption aligncenter"><img class=" wp-image-42340" src="media/58c0377f.onetime-ssa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/onetime-ssa.png" alt="" width="591" height="486" /><p class="wp-caption-text">The fraudulent one-time payment that scammers tried to siphon from Ruth Eckenstein&#8217;s Social Security account.</p></div>
<p>Sure enough, when Ruth logged into her MySocialSecurity account online, there was a pending $11,665 withdrawal destined to be deposited into a <a href="https://www.greendot.com/" target="_blank" rel="noopener">Green Dot prepaid debit card account</a> (funds deposited onto a Green Dot card can be spent like cash at any store that accepts credit or debit cards). The $11,655 amount was available for a one-time transfer because it was intended to retroactively cover monthly retirement payments back to her 65th birthday.</p>
<p>The letter the Eckensteins received from the SSA indicated that the benefits had been requested over the phone, meaning the crook(s) had called the SSA pretending to be Ruth and supplied them with enough information about her to enroll her to begin receiving benefits. Ed said he and his wife immediately called the SSA to notify them of fraudulent enrollment and pending withdrawal, and they were instructed to appear in person at an SSA office in Oklahoma City.</p>
<p>The SSA ultimately put a hold on the fraudulent $11,665 transfer, but Ed said it took more than four hours at the SSA office to sort it all out. Mr. Eckenstein said the agency also informed them that the thieves had signed his wife up for disability payments. In addition, her profile at the SSA had been changed to include a phone number in the 786 area code (Miami, Fla.).</p>
<p>&#8220;They didn&#8217;t change the physical address perhaps thinking that would trigger a letter to be sent to us,&#8221; Ed explained.</p>
<p>Thankfully, the SSA sent a letter anyway. Ed said many additional hours spent researching the matter with SSA personnel revealed that in order to open the claim on Ruth&#8217;s retirement benefits, the thieves had to supply the SSA with a short list of static identifiers about her, including her birthday, place of birth, mother&#8217;s maiden name, current address and phone number.</p>
<p>Unfortunately, most (if not all) of this data is available on a broad swath of the American populace for free online (think Zillow, Ancestry.com, Facebook, etc.) or else <a href="https://krebsonsecurity.com/2013/03/credit-reports-sold-for-cheap-in-the-underweb/" target="_blank" rel="noopener">for sale in the cybercrime underground</a> for about the cost of a latte at Starbucks.</p>
<p>The Eckensteins thought the matter had been resolved until Jan. 14, when Ruth received <a href="https://www.irs.gov/forms-pubs/about-form-1099-misc-miscellaneous-income" target="_blank" rel="noopener">a 1099 form</a> from the SSA indicating they&#8217;d reported to the IRS that she had in fact received an $11,665 payment.</p>
<p>&#8220;We’ve emailed our tax guy for guidance on how to deal with this on our taxes,&#8221; Mr. Eckenstein wrote in an email to KrebsOnSecurity. &#8220;My wife logged into SSA portal and there was a note indicating that corrected/updated 1099s would be available at the end of the month. She’s not sure whether that message was specific to her or whether everyone’s seeing that.&#8221;<span id="more-42213"></span></p>
<h4>NOT SMALL IF IT HAPPENS TO YOU</h4>
<p>Identity thieves have been exploiting authentication weaknesses to divert retirement account funds almost since the SSA launched its portal eight years ago. But the crime <a href="http://krebsonsecurity.com/2013/09/crooks-hijack-retirement-funds-via-ssa-portal/" target="_blank" rel="noopener">really picked up in 2013</a>, around the same time KrebsOnSecurity first began warning readers to register their own accounts at the MySSA portal. That uptick coincided with a move by the U.S. Treasury to start requiring that all beneficiaries receive payments through direct deposit (though the SSA says paper checks are still available to some beneficiaries under limited circumstances).</p>
<p>More than 34 million Americans now conduct business with the Social Security Administration (SSA) online. A <a href="https://www.reuters.com/article/us-column-miller-socialsecurity/social-security-online-accounts-safe-from-identity-theft-idUSKBN1FE296" target="_blank" rel="noopener">story this week from Reuters</a> says the SSA doesn&#8217;t track data on the prevalence of identity theft. Nevertheless, the agency assured the news outlet that its anti-fraud efforts have made the problem &#8220;very rare.&#8221;</p>
<p>But Reuters notes that a 2015 investigation by the SSA&#8217;s Office of Inspector General investigation identified more than 30,000 suspicious MySSA registrations, and more than 58,000 allegations of fraud related to MySSA accounts from February 2013 to February 2016.</p>
<p>&#8220;Those figures are small in the context of overall MySSA activity &#8211; but it will not seem small if it happens to you,&#8221; writes <strong>Mark Miller </strong>for Reuters.</p>
<p>The SSA has not yet responded to a request for comment.</p>
<p>Ed and Ruth&#8217;s experience notwithstanding, it&#8217;s still a good idea to <a href="https://www.ssa.gov/myaccount/" target="_blank" rel="noopener">set up a MySSA account</a> &#8212; particularly if you or your spouse will be eligible to withdraw benefits soon. The agency has been trying to beef up online authentication for citizens logging into its MySSA portal. Last summer the SSA <a href="https://krebsonsecurity.com/2017/05/ssa-gov-to-require-stronger-authentication/" target="_blank" rel="noopener">began requiring all users to enter a username and password in addition to a one-time security code sent their email or phone,</a> although as previously reported here that authentication process could be far more robust.</p>
<p>The Reuters story reminds readers to periodically use the MySSA portal to check and make sure that your personal information &#8211; such as date of birth and mailing address &#8211; are correct. &#8220;For current beneficiaries, if you notice that a monthly payment has not arrived, you should notify the SSA immediately via the agency’s toll-free line (1-800-772-1213) or at your local field office,&#8221; Miller advised. &#8220;In most cases, the SSA will make you whole if the theft is reported quickly.&#8221;</p>
<p>Another option is to use the SSA’s “<a href="https://secure.ssa.gov/acu/IPS_INTR/blockaccess" target="_blank" rel="noopener">Block Electronic Access</a>” feature, which blocks any automatic telephone or online access to your Social Security record &#8211; including by you (although it&#8217;s unclear if blocking access this way would have stopped ID thieves who manage to speak with a live SSA representative). To restore electronic access, you&#8217;ll need to contact the Social Security Administration and provide proof of your identity.</p>


feed_id: https://krebsonsecurity.com/?p=42364
title: First ‘Jackpotting’ Attacks Hit U.S. ATMs
uri: First-Jackpotting-Attacks-Hit-U-S-ATMs
url: https://krebsonsecurity.com/2018/01/first-jackpotting-attacks-hit-u-s-atms/
content:
<p>ATM &#8220;<strong>jackpotting</strong>&#8221; &#8212; a sophisticated crime in which thieves install malicious software and/or hardware at ATMs that forces the machines to spit out huge volumes of cash on demand &#8212; has long been a threat for banks in Europe and Asia, yet these attacks somehow have eluded U.S. ATM operators. But all that changed this week after the <strong>U.S. Secret Service</strong> quietly began warning financial institutions that jackpotting attacks have now been spotted targeting cash machines here in the United States.</p>
<p>To carry out a jackpotting attack, thieves first must gain physical access to the cash machine. From there they can use malware or specialized electronics &#8212; often a combination of both &#8212; to control the operations of the ATM.</p>
<div id="attachment_42367" style="width: 608px" class="wp-caption aligncenter"><img class=" wp-image-42367" src="media/9c451a65.ploutus-d.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/ploutus-d.png" alt="" width="598" height="332" /><p class="wp-caption-text">A keyboard attached to the ATM port. Image: FireEye</p></div>
<p>On Jan. 21, 2018, KrebsOnSecurity began hearing rumblings about jackpotting attacks, also known as &#8220;logical attacks,&#8221; hitting U.S. ATM operators. I quickly reached out to ATM giant <strong>NCR Corp.</strong> to see if they&#8217;d heard anything. NCR said at the time it had received unconfirmed reports, but nothing solid yet.</p>
<p>On Jan. 26, NCR sent an advisory to its customers saying it had received reports from the Secret Service and other sources about jackpotting attacks against ATMs in the United States.</p>
<p>&#8220;While at present these appear focused on non-NCR ATMs, logical attacks are an industry-wide issue,&#8221; the NCR alert reads. &#8220;This represents the first confirmed cases of losses due to logical attacks in the US. This should be treated as a call to action to take appropriate steps to protect their ATMs against these forms of attack and mitigate any consequences.&#8221;</p>
<p>The NCR memo does not mention the type of jackpotting malware used against U.S. ATMs. But a source close to the matter said the Secret Service is warning that organized criminal gangs have been attacking stand-alone ATMs in the United States using &#8220;<strong>Ploutus.D</strong>,&#8221; an advanced strain of jackpotting malware <a href="https://www.fireeye.com/blog/threat-research/2017/01/new_ploutus_variant.html" target="_blank" rel="noopener">first spotted in 2013</a>.</p>
<p>According to that source &#8212; who asked to remain anonymous because he was not authorized to speak on the record &#8212; the Secret Service has received credible information that crooks are activating so-called &#8220;cash out crews&#8221; to attack front-loading ATMs manufactured by ATM vendor <strong>Diebold Nixdorf</strong>.</p>
<p>The source said the Secret Service is warning that thieves appear to be targeting <strong>Opteva 500 and 700</strong> series Dielbold ATMs using the Ploutus.D malware in a series of coordinated attacks over the past 10 days, and that there is evidence that further attacks are being planned across the country.</p>
<p>&#8220;The targeted stand-alone ATMs are routinely located in pharmacies, big box retailers, and drive-thru ATMs,&#8221; reads a confidential Secret Service alert sent to multiple financial institutions and obtained by KrebsOnSecurity. &#8220;During previous attacks, <span class="pullquote pqleft">fraudsters dressed as ATM technicians and attached a laptop computer with a mirror image of the ATMs operating system along with a mobile device to the targeted ATM.</span>&#8221;</p>
<p>Reached for comment, Diebold shared an alert it sent to customers Friday warning of potential jackpotting attacks in the United States. Diebold&#8217;s alert confirms the attacks so far appear to be targeting front-loaded Opteva cash machines.</p>
<p>&#8220;As in Mexico last year, the attack mode involves a series of different steps to overcome security mechanism and the authorization process for setting the communication with the [cash] dispenser,&#8221; the Diebold security alert reads. A copy of the entire Diebold alert, complete with advice on how to mitigate these attacks, is available <a href="media/551c6d70.-0005-Potential-Jackpotting-US-Update-on-017-34-0002-smaller.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/20180126-GLOBAL-SECURITY-ALERT-018-04-0005-Potential-Jackpotting-US-Update-on-017-34-0002-smaller.pdf" target="_blank" rel="noopener">here</a> (PDF).<span id="more-42364"></span></p>
<p>The Secret Service alert explains that the attackers typically use an <a href="https://en.wikipedia.org/wiki/Endoscope" target="_blank" rel="noopener">endoscope</a> &#8212; a slender, flexible instrument traditionally used in medicine to give physicians a look inside the human body &#8212; to locate the internal portion of the cash machine where they can attach a cord that allows them to sync their laptop with the ATM&#8217;s computer.</p>
<div id="attachment_42369" style="width: 607px" class="wp-caption aligncenter"><img class=" wp-image-42369" src="media/9f3cc53a.endoscope.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/endoscope.png" alt="" width="597" height="521" /><p class="wp-caption-text">An endoscope made to work in tandem with a mobile device. Source: gadgetsforgeeks.com.au</p></div>
<p>&#8220;Once this is complete, the ATM is controlled by the fraudsters and the ATM will appear Out of Service to potential customers,&#8221; reads the confidential Secret Service alert.</p>
<p>At this point, the crook(s) installing the malware will contact co-conspirators who can remotely control the ATMs and force the machines to dispense cash.</p>
<p>&#8220;In previous Ploutus.D attacks, the ATM continuously dispensed at a rate of 40 bills every 23 seconds,&#8221; the alert continues. Once the dispense cycle starts, the only way to stop it is to press cancel on the keypad. Otherwise, the machine is completely emptied of cash, according to the alert.</p>
<p>An 2017 analysis of Ploutus.D by security firm <strong>FireEye</strong> called it &#8220;one of the most advanced ATM malware families we&#8217;ve seen in the last few years.&#8221;</p>
<p>&#8220;Discovered for the <a href="https://www.symantec.com/connect/blogs/criminals-hit-atm-jackpot" rel="noreferrer" data-ss1517067919="1">first time in Mexico </a>back in 2013, Ploutus enabled criminals to empty ATMs using either an external keyboard attached to the machine or <a href="https://www.symantec.com/connect/blogs/texting-atms-cash-shows-cybercriminals-increasing-sophistication" rel="noreferrer" data-ss1517067919="1">via SMS message</a>, a technique that had never been seen before,&#8221; FireEye&#8217;s <strong>Daniel Regalado</strong> wrote.</p>
<p>According to FireEye, the Ploutus attacks seen so far require thieves to somehow gain physical access to an ATM &#8212; either by picking its locks, using a stolen master key or otherwise removing or destroying part of the machine.</p>
<p>Regalado says the crime gangs typically responsible for these attacks deploy &#8220;money mules&#8221; to conduct the attacks and siphon cash from ATMs. The term refers to low-level operators within a criminal organization who are assigned high-risk jobs, such as installing ATM skimmers and otherwise physically tampering with cash machines.</p>
<p>&#8220;From there, the attackers can attach a physical keyboard to connect to the machine, and [use] an activation code provided by the boss in charge of the operation in order to dispense money from the ATM,&#8221; he wrote. &#8220;Once deployed to an ATM, Ploutus makes it possible for criminals to obtain thousands of dollars in minutes. While there are some risks of the money mule being caught by cameras, the speed in which the operation is carried out minimizes the mule’s risk.&#8221;</p>
<p>Indeed, the Secret Service memo shared by my source says the cash out crew/money mules typically take the dispensed cash and place it in a large bag. After the cash is taken from the ATM and the mule leaves, the phony technician(s) return to the site and remove their equipment from the compromised ATM.</p>
<p>&#8220;The last thing the fraudsters do before leaving the site is to plug the Ethernet cable back in,&#8221; the alert notes.</p>
<p>FireEye said all of the samples of Ploutus.D it examined targeted Diebold ATMs, but it warned that small changes to the malware&#8217;s code could enable it to be used against <a href="http://www.kal.com/en/video/multi-vendor" rel="noreferrer" data-ss1517067919="1">40 different ATM vendors in 80 countries</a>.</p>
<p>The Secret Service alert says ATMs still running on <strong>Windows XP</strong> are particularly vulnerable, and it urged ATM operators to update to a version of <strong>Windows 7</strong> to defeat this specific type of attack.</p>
<p>This is a quickly developing story and may be updated multiple times over the next few days as more information becomes available.</p>


feed_id: https://krebsonsecurity.com/?p=42288
title: File Your Taxes Before Scammers Do It For You
uri: File-Your-Taxes-Before-Scammers-Do-It-For-You
url: https://krebsonsecurity.com/2018/01/file-your-taxes-before-scammers-do-it-for-you/
content:
<p>Today, Jan. 29, is officially the first day of the 2018 tax-filing season, also known as the day fraudsters start requesting phony tax refunds in the names of identity theft victims. Want to minimize the chances of getting hit by tax refund fraud this year? File your taxes before the bad guys can!</p>
<p>Tax refund fraud affects hundreds of thousands, if not millions, of U.S. citizens annually. Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS.</p>
<p><img class="aligncenter wp-image-42398" src="media/69b57c63.taxthiefa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/taxthiefa.png" alt="" width="594" height="218" /></p>
<p>According to the IRS, consumer complaints over tax refund fraud have been declining steadily over the years as the IRS and states enact <a href="https://www.irs.gov/privacy-disclosure/security-summit" target="_blank" rel="noopener">more stringent measures</a> for screening potentially fraudulent applications.</p>
<p>If you file your taxes electronically and the return is rejected, and if you were the victim of identity theft (e.g., if your Social Security number and other information was leaked in <a href="https://krebsonsecurity.com/?s=equifax+breach&amp;x=0&amp;y=0" target="_blank" rel="noopener">the Equifax breach last year</a>), you should submit an Identity Theft Affidavit (<a href="media/d356facd.f14039.pdf" data-original-source="https://www.irs.gov/pub/irs-pdf/f14039.pdf" target="_blank" rel="noopener">Form 14039</a>). The IRS advises that if you suspect you are a victim of identity theft, continue to pay your taxes and file your tax return, even if you must do so by paper.</p>
<p>If the IRS believes you were likely the victim of tax refund fraud in the previous tax year they will likely send you a special filing PIN that needs to be entered along with this year&#8217;s return before the filing will be accepted by the IRS electronically. This year marks the third out of the last five that I&#8217;ve received one of these PINs from the IRS.</p>
<p>Of course, filing your taxes early to beat the fraudsters requires one to have all of the tax forms needed to do so. As a sole proprietor, this is a great challenge because many companies take their sweet time sending out 1099 forms and such (even though they&#8217;re required to do so by Jan. 31).</p>
<p>A great many companies are now turning to online services to deliver tax forms to contractors, employees and others. For example, I have received several notices via email regarding the availability of 1099 forms online; most say they are sending the forms in snail mail, but that if I need them sooner I can get them online if I just create an account or enter some personal information at some third-party site.</p>
<p>Having seen how so many of these sites handle personal information, I&#8217;m not terribly interested in volunteering more of it. According to <a href="https://www.bankrate.com/finance/money-guides/you-can-file-your-return-without-1099-forms.aspx" target="_blank" rel="noopener">Bankrate</a>, taxpayers can still file their returns even if they don&#8217;t yet have all of their 1099s &#8212; as long as you have the correct information about how much you earned.</p>
<p>&#8220;Unlike a W-2, you generally don’t have to attach 1099s to your tax return,&#8221; Bankrate explains. &#8220;They are just issued so you’ll know how much to report, with copies going to the IRS so return processors can double-check your entries. As long as you have the correct information, you can put it on your tax form without having the statement in hand.&#8221;<span id="more-42288"></span></p>
<p>In past tax years, identity thieves have used data gleaned from a variety of third-party and government Web sites to file phony tax refund requests &#8212; including from the IRS itself! One of their perennial favorites was the <a href="https://www.irs.gov/individuals/get-transcript" target="_blank" rel="noopener">IRS&#8217;s Get Transcript service</a>, which <a href="https://krebsonsecurity.com/?s=get+transcript+irs&amp;x=0&amp;y=0" target="_blank" rel="noopener">previously had fairly lax authentication measures</a>.</p>
<p>After <a href="https://krebsonsecurity.com/2016/02/irs-390k-more-victims-of-irs-gov-weakness/" target="_blank" rel="noopener">hundreds of thousands of taxpayers</a> had their tax data accessed through the online tool, the IRS took it offline for a bit and then brought it back online but requiring a host of new data elements.</p>
<p>But many of those elements &#8212; such as your personal account number from a credit card, mortgage, home equity loan, home equity line of credit or car loan &#8212; can be gathered from multiple locations online with almost no authentication. For example, earlier this week I heard from Jason, a longtime reader who was shocked at how little information was required to get a copy of his 2017 mortgage interest statement from his former lender.</p>
<p>&#8220;I called our old mortgage company (Chase) to retrieve our 1098 from an old loan today,&#8221; Jason wrote. &#8220;After I provided the last four digits of the social security # to their IVR [interactive voice response system] that was enough to validate me to request a fax of the tax form, which would have included sensitive information. I asked for a supervisor who explained to me that it was sufficient to check the SSN last 4 + the caller id phone number to validate the account.&#8221;</p>
<p>If you&#8217;ve taken my advice and <a href="https://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=https://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/&amp;source=gmail&amp;ust=1517328723122000&amp;usg=AFQjCNHZmsvEkej7BDq-YqFSiMeRKyOGmQ">placed a security freeze on your credit file</a> with the major credit bureaus, you don&#8217;t have to worry about thieves somehow bypassing the security on the IRS&#8217;s Get Transcript site. That&#8217;s because the IRS uses <strong>Experian</strong> to ask a series of knowledge-based authentication questions before an online account can even be created at the IRS&#8217;s site to access the transcript.</p>
<p>Now, anyone who reads this site regularly should know I&#8217;ve been <a href="https://krebsonsecurity.com/?s=kba&amp;x=0&amp;y=0" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=https://krebsonsecurity.com/?s%3Dkba%26x%3D0%26y%3D0&amp;source=gmail&amp;ust=1517328723122000&amp;usg=AFQjCNG-DIY5Rz89PI9hM4XYjSCbM0Sh2A">highly critical of these KBA questions</a> as a means of authentication. But the upshot here is that if you have a freeze in place at Experian (and I <a href="https://krebsonsecurity.com/?s=equifax+breach&amp;x=0&amp;y=0" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=https://krebsonsecurity.com/?s%3Dequifax%2Bbreach%26x%3D0%26y%3D0&amp;source=gmail&amp;ust=1517328723122000&amp;usg=AFQjCNGVGv4FpDBErLZMmTZXGi8XgU2sSw">sincerely hope you do</a>), Experian won&#8217;t even be able to ask those questions. Thus, thieves should not be able to create an account in your name at the IRS&#8217;s site (unless of course thieves manage to <a href="https://krebsonsecurity.com/2017/09/experian-site-can-give-anyone-your-credit-freeze-pin/" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=https://krebsonsecurity.com/2017/09/experian-site-can-give-anyone-your-credit-freeze-pin/&amp;source=gmail&amp;ust=1517328723122000&amp;usg=AFQjCNE57EPQhc59tf3rMWtn6EenLkc7yA">successfully request your freeze PIN from Experian&#8217;s site</a>, in which case all bets are off).</p>
<p>While you&#8217;re getting your taxes in order this filing season, be on guard against fake emails or Web sites that may try to phish your personal or tax data. The IRS stresses that it will never initiate contact with taxpayers about a bill or refund. If you receive a phishing email that spoofs the IRS, consider forwarding it to <strong>phishing@irs.gov</strong>.</p>
<p>Finally, tax season also is when the phone-based tax scams kick into high gear, with fraudsters threatening taxpayers with arrest, deportation and other penalties if they don&#8217;t make an immediate payment over the phone. If you care for older parents or relatives, this may be a good time to remind them about these and other phone-based scams.</p>


feed_id: https://krebsonsecurity.com/?p=42410
title: Drugs Tripped Up Suspects In First Known ATM “Jackpotting” Attacks in the US
uri: Drugs-Tripped-Up-Suspects-In-First-Known-ATM-Jackpotting-Attacks
url:
https://krebsonsecurity.com/2018/01/drug-charges-tripped-up-suspects-in-first-known-atm-jackpotting-attacks-in-the-us/

content:
<p>On Jan. 27, 2018, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/01/first-jackpotting-attacks-hit-u-s-atms/" target="_blank" rel="noopener">published</a> what this author thought a scoop about the first known incidence of U.S. ATMs being hit with &#8220;jackpotting&#8221; attacks, a crime in which thieves deploy malware that forces cash machines to spit out money like a loose Las Vegas slot machine. As it happens, the first known jackpotting attacks in the United States were reported in November 2017 by local media on the west coast, although the reporters in those cases seem to have completely buried the <a href="https://www.merriam-webster.com/words-at-play/bury-the-lede-versus-lead" target="_blank" rel="noopener">lede</a>.</p>
<div id="attachment_42412" style="width: 573px" class="wp-caption aligncenter"><img class=" wp-image-42412" src="media/d22434b5.jackpotters.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/jackpotters.png" alt="" width="563" height="354" /><p class="wp-caption-text">Isaac Rafael Jorge Romero, Jose Alejandro Osorio Echegaray, and Elio Moren Gozalez have been charged with carrying out ATM &#8220;jackpotting&#8221; attacks that force ATMs to spit out cash like a Las Vegas casino.</p></div>
<p>On Nov. 20, 2017, <em>Oil City News</em> &#8212; a community publication in Wyoming &#8212; <a href="https://oilcitywyo.com/crime/2017/11/21/bank-robbery-suspects-arrested-jackson-hear-charges-fed-court-casper/" target="_blank" rel="noopener">reported</a> on the arrest of three Venezuelan nationals who were busted on charges of marijuana possession after being stopped by police.</p>
<p>After pulling over the van the men were driving, police on the scene reportedly detected the unmistakable aroma of pot smoke wafting from the vehicle. When the cops searched the van, they discovered small amounts of pot, THC edible gummy candies, and several backpacks full of cash.</p>
<p>FBI agents had already been looking for the men, who were allegedly caught on surveillance footage tinkering with cash machines in Wyoming, Colorado and Utah, shortly before those ATMs were relieved of tens of thousands of dollars.</p>
<p>According to a complaint filed in the U.S. District Court for the District of Colorado, the men first hit an ATM at a credit union in Parker, Colo. on October 10, 2017. The robbery occurred after business hours, but the cash machine in question was located in a vestibule available to customers 24/7.</p>
<p>The complaint says surveillance videos showed the men opening the top of the ATM, which housed the computer and hard drive for the ATM &#8212; but not the secured vault where the cash was stored. The video showed the subjects reaching into the ATM, and then closing it and exiting the vestibule. On the video, one of the subjects appears to be carrying an object consistent with the size and appearance of the hard drive from the ATM.</p>
<p>Approximately ten minutes later, the subjects returned and opened up the cash machine again. Then they closed the top of the ATM and appeared to wait while the ATM computer restarted. After that, both subjects could be seen on the video using their mobile phones. One of the subjects reportedly appeared to be holding a small wireless mini-computer keyboard.</p>
<p>Soon after, the ATM began spitting out cash, netting the thieves more than $24,000. When they they were done, the suspects allegedly retrieved their equipment from the ATM and left.</p>
<p>Forensic analysis of the ATM hard drive determined that the thieves installed the <strong>Ploutus.D</strong> malware on the cash machine&#8217;s hard drive. Ploutus.D is <a href="https://www.fireeye.com/blog/threat-research/2017/01/new_ploutus_variant.html" target="_blank" rel="noopener">an advanced malware strain</a> that lets crooks interact directly with the ATM&#8217;s computer and force it to dispense money.</p>
<p>&#8220;Often the malware requires entering of codes to dispense cash,&#8221; reads <a href="media/f7140a42.romeroetal-jackpotting.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/romeroetal-jackpotting.pdf" target="_blank" rel="noopener">an FBI affidavit</a> (PDF). &#8220;These codes can be obtained by a third party, not at the location, who then provides the codes to the subjects at the ATM. This allows the third party to know how much cash is dispensed from the ATM, preventing those who are physically at the ATM from keeping cash for themselves instead of providing it to the criminal organization. The use of mobile phones is often used to obtain these dispensing codes.&#8221;<span id="more-42410"></span></p>
<p>In November 2017, similar ATM jackpotting attacks were discovered in the Saint George, Utah area. Surveillance footage from those ATMs showed the same subjects were at work.</p>
<p>The FBI&#8217;s investigation determined that the vehicles used by the suspects in the Utah thefts were rented by Venezuelan nationals.</p>
<p>On Nov. 16, <strong>Isaac Rafael Jorge Romero</strong>, 29, <strong>Jose Alejandro Osorio Echegaray</strong>, 36, and two other Venezuelan nationals were arrested Teton County, Wyo. on drug charges. Two other suspects in the Utah theft were arrested in San Diego when they tried to return a rental car that was caught on surveillance camera at one of the hacked ATMs.</p>
<p>To carry out a jackpotting attack, thieves first must gain physical access to the cash machine. From there they can use malware or specialized electronics — often a combination of both — to control the operations of the ATM.</p>
<p>All of the known ATM jackpotting attacks in the U.S. so far appear to be targeting a handful of older model cash machines manufactured by ATM giant <strong>Diebold Nixdorf</strong>. However, security firm FireEye notes that &#8212; with minor modifications to the malware code &#8212; Plotus.D could be used to target software that <a href="http://www.kal.com/en/video/multi-vendor" rel="noreferrer" data-ss1517331322="1">runs on 40 different ATM vendors in 80 countries.</a></p>
<p>Diebold&#8217;s advisory on hardening ATMs against jackpotting attacks is available <a href="media/551c6d70.-0005-Potential-Jackpotting-US-Update-on-017-34-0002-smaller.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/20180126-GLOBAL-SECURITY-ALERT-018-04-0005-Potential-Jackpotting-US-Update-on-017-34-0002-smaller.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>
<p>Jackpotting is not a new crime: Indeed, it has been a problem for ATM operators in most of the world for many years now. But for some reason, jackpotting attacks have until recently eluded U.S. ATM operators.</p>
<p>Jackpotting has been a real threat to ATM owners and manufacturers since at least 2010, when the late security researcher <a href="https://en.wikipedia.org/wiki/Barnaby_Jack" target="_blank" rel="noopener">Barnaby Michael Douglas Jack</a> (known to most as simply &#8220;Barnaby Jack&#8221;) demonstrated the attack to a cheering audience at the Black Hat security conference. A recording of that presentation is below.</p>
<div style="text-align: center;"><iframe src="https://www.youtube.com/embed/Ss_RWctTARU" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>


feed_id: https://krebsonsecurity.com/?p=42437
title: Attackers Exploiting Unpatched Flaw in Flash
uri: Attackers-Exploiting-Unpatched-Flaw-in-Flash
url: https://krebsonsecurity.com/2018/02/attackers-exploiting-unpatched-flaw-in-flash/
content:
<p><strong>Adobe</strong> warned on Thursday that attackers are exploiting a previously unknown security hole in its <strong>Flash Player</strong> software to break into <strong>Microsoft Windows</strong> computers. Adobe said it plans to issue a fix for the flaw in the next few days, but now might be a good time to check your exposure to this still-ubiquitous program and harden your defenses.</p>
<p><img class="alignright size-full wp-image-18875" src="media/18bb50f1.brokenflash-a.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="" width="211" height="180" />Adobe said a critical vulnerability (<strong>CVE-2018-4878</strong>) exists in Adobe Flash Player <em>28.0.0.137</em> and earlier versions. Successful exploitation could allow an attacker to take control of the affected system.</p>
<p>The software company warns that an exploit for the flaw is being used in the wild, and that so far the attacks leverage <strong>Microsoft Office</strong> documents with embedded malicious Flash content. Adobe said it plans to address this vulnerability in a release planned for the week of February 5.</p>
<p>According to <a href="https://helpx.adobe.com/security/products/flash-player/apsa18-01.html" target="_blank" rel="noopener">Adobe&#8217;s advisory</a>, b<span id="m_5642985625085996912OLK_SRC_BODY_SECTION">eginning with Flash Player 27, administrators have the ability to change Flash Player&#8217;s behavior when running on Internet Explorer on Windows 7 and below by prompting the user before playing Flash content. A guide on how to do that is <a href="media/116dd27f.flash_player_27_0_admin_guide.pdf" data-original-source="https://www.adobe.com/content/dam/acom/en/devnet/flashplayer/articles/flash_player_admin_guide/pdf/flash_player_27_0_admin_guide.pdf" target="_blank" rel="noopener">here</a> (PDF). Administrators may also consider implementing <a href="https://support.office.com/en-us/article/what-is-protected-view-d6f09ac7-e6b9-4495-8e43-2bbcdbcb6653#bm5" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=https://support.office.com/en-us/article/what-is-protected-view-d6f09ac7-e6b9-4495-8e43-2bbcdbcb6653%23bm5&amp;source=gmail&amp;ust=1517665562120000&amp;usg=AFQjCNH1N5uNNb93xTY_aa6zwH-Ou6cUGg">Protected View for Office</a>. Protected View opens a file marked as potentially unsafe in Read-only mode.</span></p>
<p><span id="more-42437"></span></p>
<p>Hopefully, most readers here have taken my longstanding advice to disable or at least hobble Flash, a buggy and insecure component that nonetheless ships by default with <strong>Google Chrome</strong> and <strong>Internet Explorer</strong>. More on that approach (as well as slightly less radical solutions) can be found in <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank" rel="noopener">A Month Without Adobe Flash Player</a>. The short version is that you can probably get by without Flash installed and not miss it at all.</p>
<p>For readers still unwilling to cut the Flash cord, there are half-measures that work almost as well. Fortunately, <a href="https://support.google.com/chrome/answer/108086?hl=en" target="_blank" rel="noopener">disabling Flash in Chrome</a> is simple enough. Paste “<a href="chrome://settings/content" target="_blank" rel="noopener">chrome://settings/content</a>” into a Chrome browser bar and then select “Flash” from the list of items. By default it should be set to “Ask first” before running Flash, although users also can disable Flash entirely here or whitelist and blacklist specific sites.</p>
<p>By default, <strong>Mozilla Firefox</strong> on Windows computers with Flash installed runs Flash in a &#8220;<a href="http://blogs.adobe.com/security/2012/06/inside-flash-player-protected-mode-for-firefox.html" target="_blank" rel="noopener">protected mode</a>,&#8221; which prompts the user to decide if they want to enable the plugin before Flash content runs on a Web site.</p>
<p>Another, perhaps less elegant, alternative to wholesale kicking Flash to the curb is to keeping it installed in a browser that you don’t normally use, and then only using that browser on sites that require Flash.</p>


feed_id: https://krebsonsecurity.com/?p=42447
title: Alleged Spam Kingpin ‘Severa’ Extradited to US
uri: Alleged-Spam-Kingpin-Severa-Extradited-to-US
url: https://krebsonsecurity.com/2018/02/alleged-spam-kingpin-severa-extradited-to-us/
content:
<p><strong>Peter Yuryevich Levashov</strong>, a 37-year-old Russian computer programmer thought to be one of the world&#8217;s most notorious spam kingpins, has been extradited to the United States to face federal hacking and spamming charges.</p>
<div id="attachment_42464" style="width: 268px" class="wp-caption alignright"><img class=" wp-image-42464" src="media/217d1288.levashov.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/levashov.png" alt="" width="258" height="377" /><p class="wp-caption-text">Levashov, in an undated photo.</p></div>
<p>Levashov, who allegedly went by the hacker names &#8220;<strong>Peter Severa</strong>,&#8221; and &#8220;<strong>Peter of the</strong> <strong>North</strong>,&#8221;<strong> </strong>hails from St. Petersburg in northern Russia, but he was <a href="https://krebsonsecurity.com/2017/04/alleged-spam-king-pyotr-levashov-arrested/" target="_blank" rel="noopener">arrested last year</a> while in Barcelona, Spain with his family.</p>
<p>Authorities have long suspected he is the cybercriminal behind the once powerful spam botnet known as <strong>Waledac</strong> (a.k.a. &#8220;Kelihos&#8221;), a now-defunct malware strain responsible for sending more than 1.5 billion spam, phishing and malware attacks each day.</p>
<p>According to <a href="https://www.justice.gov/opa/pr/alleged-operator-kelihos-botnet-extradited-spain" target="_blank" rel="noopener">a statement</a> released by the <strong>U.S. Justice Department</strong>, Levashov was arraigned last Friday in a federal court in New Haven, Ct. Levashov&#8217;s New York attorney <strong>Igor Litvak</strong> said he is eager to review the evidence against Mr. Levashov, and that while the indictment against his client is available, the complaint in the case remains sealed.</p>
<p>&#8220;We haven&#8217;t received any discovery, we have no idea what the government is relying on to bring these allegations,&#8221; Litvak said. &#8220;Mr. Levashov maintains his innocence and is looking forward to resolving this case, clearing his name, and returning home to his wife and 5-year-old son in Spain.&#8221;</p>
<p>In 2010, <strong>Microsoft</strong> &#8212; in tandem with a number of security researchers &#8212; launched a <a href="https://krebsonsecurity.com/2010/02/microsoft-ambushes-waledac-botnet-shutters-whistleblower-site/" target="_blank" rel="noopener">combined technical and legal sneak attack</a> on the Waledac botnet, successfully dismantling it. The company would later do the same <a href="https://krebsonsecurity.com/2012/03/researchers-clobber-khelios-spam-botnet/" target="_blank" rel="noopener">to the Kelihos botnet</a>, a global spam machine which shared a great deal of computer code with Waledac.</p>
<p>Severa routinely rented out segments of his Waledac botnet to anyone seeking a vehicle for sending spam. For $200, vetted users could hire his botnet to blast one million pieces of spam. Junk email campaigns touting employment or “money mule” scams cost $300 per million, and phishing emails could be blasted out through Severa’s botnet for the bargain price of $500 per million.</p>
<p>Waledac first surfaced in April 2008, but many experts believe the spam-spewing machine was merely an update to the Storm worm, the engine behind another massive spam botnet that first surfaced in 2007. Both Waledac and Storm were major distributors of pharmaceutical and malware spam.</p>
<p>According to Microsoft, in one month alone approximately 651 million spam emails attributable to Waledac/Kelihos were directed to Hotmail accounts, including offers and scams related to online pharmacies, imitation goods, jobs, penny stocks, and more. The Storm worm botnet also sent billions of messages daily and infected an estimated one million computers worldwide.</p>
<p>Both Waledac/Kelihos and Storm were hugely innovative because they each included self-defense mechanisms designed specifically to stymie security researchers who might try to dismantle the crime machines.</p>
<p>Waledac and Storm sent updates and other instructions via a peer-to-peer communications system not unlike popular music and file-sharing services. Thus, even if security researchers or law-enforcement officials manage to seize the botnet’s back-end control servers and clean up huge numbers of infected PCs, the botnets could respawn themselves by relaying software updates from one infected PC to another.</p>
<h4>FAKE NEWS</h4>
<p>According to <a href="https://www.wired.com/2017/04/fbi-took-russias-spam-king-massive-botnet/" target="_blank" rel="noopener">a lengthy April 2017 story in Wired.com</a> about Levashov&#8217;s arrest and the takedown of Waledac, Levashov got caught because he violated a basic security no-no: He used the same log-in credentials to both run his criminal enterprise and log into sites like iTunes.</p>
<p>After Levashov&#8217;s arrest, numerous media outlets quoted his wife saying he was being rounded up as part of a dragnet targeting Russian hackers thought to be involved in alleged interference in the 2016 U.S. election. Russian news media outlets made much hay over this claim. In contesting his extradition to the United States, Levashov even <a href="https://www.reuters.com/article/us-usa-cyber-botnet/russian-hacker-wanted-by-u-s-tells-court-he-worked-for-putins-party-idUSKCN1C32EP" target="_blank" rel="noopener">reportedly</a> told the RIA Russian news agency that he worked for <strong>Russian President Vladimir Putin</strong>&#8216;s United Russia party, and that he would die within a year of being extradited to the United States.</p>
<p><span class="pullquote pqleft">&#8220;If I go to the U.S., I will die in a year,&#8221; Levashov is quoted as saying.</span> &#8220;They want to get information of a military nature and about the United Russia party. I will be tortured, within a year I will be killed, or I will kill myself.&#8221;</p>
<p>But <a href="https://krebsonsecurity.com/2017/04/fake-news-at-work-in-spam-kingpins-arrest/" target="_blank" rel="noopener">there is so far zero evidence</a> that anyone has accused Levashov of being involved in election meddling. However, the Waledac/Kelihos botnet does have a historic association with election meddling: It was used during the Russian election in 2012 to send political messages to email accounts on computers with Russian Internet addresses. <a href="https://www.symantec.com/connect/ru/blogs/waledac-spam-dirtying-russian-2012-elections?page=1" target="_blank" rel="noopener">Those emails linked to fake news stories</a> saying that <a href="https://en.wikipedia.org/wiki/Mikhail_Prokhorov" target="_blank" rel="noopener">Mikhail D. Prokhorov</a>, a businessman who was running for president against Putin, had come out as gay.<span id="more-42447"></span></p>
<h4>SEVERA&#8217;S PARTNERS</h4>
<p>If Levashov was to plead guilty in the case being prosecuted by U.S. authorities, it could shed light on the real-life identities of other top spammers.</p>
<p>Severa worked very closely with two major purveyors of spam. One was <strong>Alan Ralsky</strong>, an American spammer who was <a href="https://en.wikipedia.org/wiki/Alan_Ralsky" target="_blank" rel="noopener">convicted in 2009</a> of paying him and other spammers to promote the pump-and-dump stock scams.</p>
<p>The other was a spammer who went by the nickname &#8220;<strong>Cosma</strong>,&#8221; the cybercriminal thought to be responsible for managing the <strong>Rustock</strong> botnet (so named because it was a Russian botnet frequently used to send pump-and-dump stock spam). In 2011, Microsoft <a href="https://krebsonsecurity.com/2011/07/microsoft-offers-250k-bounty-for-rustock-author/" target="_blank" rel="noopener">offered a still-unclaimed $250,000 reward</a> for information leading to the arrest and conviction of the Rustock author.</p>
<div id="attachment_13548" style="width: 599px" class="wp-caption aligncenter"><a class="lightbox" href="media/5590783c.SeveraSpamdot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2012/01/SeveraSpamdot.png"><img class="wp-image-13548" src="media/5590783c.SeveraSpamdot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2012/01/SeveraSpamdot.png" alt="" width="589" height="407" srcset="https://krebsonsecurity.com/wp-content/uploads/2012/01/SeveraSpamdot.png 1249w, https://krebsonsecurity.com/wp-content/uploads/2012/01/SeveraSpamdot-600x414.png 600w, https://krebsonsecurity.com/wp-content/uploads/2012/01/SeveraSpamdot-1024x706.png 1024w" sizes="(max-width: 589px) 100vw, 589px" /></a><p class="wp-caption-text">Spamdot.biz moderator Severa listing prices to rent his Waledac spam botnet.</p></div>
<p>Microsoft believes Cosma&#8217;s real name may be <strong>Dmitri A. Sergeev</strong>, <strong>Artem Sergeev</strong>, or <strong>Sergey Vladomirovich Sergeev. </strong>In June 2011, KrebsOnSecurity <a href="https://krebsonsecurity.com/2011/06/rustock-botnet-suspect-sought-job-at-google/" target="_blank" rel="noopener">published a brief profile of Cosma</a> that included Sergeev&#8217;s resume and photo, both of which indicated he is a Belorussian programmer who once sought a job at <strong>Google</strong>. For more on Cosma, see &#8220;<a href="https://krebsonsecurity.com/2011/08/flashy-cars-got-spam-kingpin-mugged/" target="_blank" rel="noopener">Flashy Car Got Spam Kingpin Mugged</a>.&#8221;</p>
<p>Severa and Cosma had met one another several times in their years together in the stock spamming business, and they appear to have known each other intimately enough to be on a first-name basis. Both of these titans of junk email are featured prominently in &#8220;Meet the Spammers,&#8221; the 7th chapter of my book, <a href="https://www.amazon.com/Spam-Nation-Organized-Cybercrime-Epidemic-ebook/dp/B00L5QGBL0" target="_blank" rel="noopener">Spam Nation: The Inside Story of Organized Cybercrime</a>.</p>
<p>Much like his close associate — Cosma, the Rustock botmaster — Severa may also have a $250,000 bounty on his head, albeit indirectly. <a href="https://en.wikipedia.org/wiki/Conficker" target="_blank" rel="noopener">The Conficker worm</a>, a global contagion launched in 2009 that quickly spread to an estimated 9 to 15 million computers worldwide, prompted an unprecedented international response from security experts. This group of experts, dubbed the “Conficker Cabal,” sought in vain to corral the spread of the worm.</p>
<p>But despite infecting huge numbers of Microsoft Windows systems, Conficker was never once used to send spam. In fact, the only thing that Conficker-infected systems ever did was download and spread a new version of the the malware that powered the Waledac botnet. Later that year, Microsoft announced it was <a href="http://voices.washingtonpost.com/securityfix/2009/02/microsoft_offers_250000_reward.html" target="_blank" rel="noopener">offering a $250,000 reward</a> for information leading to the arrest and conviction of the Conficker author(s). Some security experts believe this proves a link between Severa and Conficker.</p>
<p>Both Cosma and Severa were quite active on <a href="https://krebsonsecurity.com/?s=spamit.com&amp;x=0&amp;y=0" target="_blank" rel="noopener">Spamit[dot]com</a>, a once closely-guarded forum for Russian spammers. In 2010, Spamit was hacked, and a copy of its database was shared with this author. In that database were all private messages between Spamit members, including many between Cosma and Severa. For more on those conversations, see &#8220;<a href="https://krebsonsecurity.com/2012/12/a-closer-look-at-two-bigtime-botmasters/" target="_blank" rel="noopener">A Closer Look at Two Big Time Botmasters.</a>&#8221;</p>
<p>In addition to renting out his spam botnet, Severa also managed multiple affiliate programs in which he paid other cybercriminals to distribute so-called <a href="https://krebsonsecurity.com/?s=fake+antivirus&amp;x=0&amp;y=0" target="_blank" rel="noopener">fake antivirus products</a>. Also known as &#8220;scareware,&#8221; fake antivirus was at one time a major scourge, using false and misleading pop-up alerts to trick and <a href="https://en.wikipedia.org/wiki/Mousetrapping" target="_blank" rel="noopener">mousetrap</a> unsuspecting computer users into purchasing worthless (and in many cases outright harmful) software disguised as antivirus software.</p>
<div id="attachment_10861" style="width: 567px" class="wp-caption aligncenter"><a class="lightbox" href="media/8bccddc8.sevdownload.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2011/07/sevdownload.png"><img class="wp-image-10861 size-full" src="media/8bccddc8.sevdownload.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2011/07/sevdownload.png" alt="" width="557" height="550" srcset="https://krebsonsecurity.com/wp-content/uploads/2011/07/sevdownload.png 557w, https://krebsonsecurity.com/wp-content/uploads/2011/07/sevdownload-300x296.png 300w" sizes="(max-width: 557px) 100vw, 557px" /></a><p class="wp-caption-text">A screenshot of the eponymous scareware affiliate program run by &#8220;Severa,&#8221; allegedly the cybercriminal alias of Peter Levashov.</p></div>
<p>In 2011, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2011/07/spam-fake-av-like-ham-eggs/" target="_blank" rel="noopener">Spam &amp; Fake AV: Like Ham &amp; Eggs</a>, which sought to illustrate the many ways in which the spam industry and fake antivirus overlapped. That analysis included data from <strong>Brett Stone-Gross</strong>, a cybercrime expert who later would assist Microsoft and other researchers in their successful efforts to dismantle the Waledac/Kelihos botnet.</p>
<p>Levashov faces federal criminal charges on eight counts, including aggravated identity theft, wire fraud, conspiracy, and intentional damage to protected computers. The indictment in his case is available <a href="media/e1374705.levashovindictment.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/levashovindictment.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>
<p>Further reading: <a href="https://krebsonsecurity.com/2012/01/mr-waledac-the-peter-north-of-spamming/" target="_blank" rel="noopener">Mr Waledac &#8212; The Peter North of Spamming</a></p>


feed_id: https://krebsonsecurity.com/?p=42453
title: Would You Have Spotted This Skimmer?
uri: Would-You-Have-Spotted-This-Skimmer
url: https://krebsonsecurity.com/2018/02/would-you-have-spotted-this-skimmer/
content:
<p>When you realize how easy it is for thieves to compromise an ATM or credit card terminal with skimming devices, it&#8217;s difficult not to inspect or even pull on these machines when you&#8217;re forced to use them personally &#8212; half expecting something will come detached. For those unfamiliar with the stealth of these skimming devices and the thieves who install them, read on.</p>
<p>Police in Lower Pottsgrove, PA are searching for a pair of men who&#8217;ve spent the last few months installing card and PIN skimmers at checkout lanes inside of Aldi supermarkets in the region. These are &#8220;overlay&#8221; skimmers, in that they&#8217;re designed to be installed in the blink of an eye just by placing them over top of the customer-facing card terminal.</p>
<div id="attachment_42478" style="width: 570px" class="wp-caption aligncenter"><img class=" wp-image-42478" src="media/b82e8236.aldisskimfront.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/aldisskimfront.png" alt="" width="560" height="480" /><p class="wp-caption-text">The top of the overlay skimmer models removed from several Aldi grocery story locations in Pennsylvania over the past few months.</p></div>
<p>The underside of the skimmer hides the brains of this little beauty, which is configured to capture the personal identification number (PIN) of shoppers who pay for their purchases with a debit card. This likely describes a great number of loyal customers at Aldi; the discount grocery chain <a href="https://www.nerdwallet.com/blog/credit-cards/aldi-starts-taking-credit-cards/" target="_blank" rel="noopener">only in 2016 started accepting credit cards</a>, and previously only took cash, debit cards, <a href="https://www.fns.usda.gov/snap/supplemental-nutrition-assistance-program-snap" target="_blank" rel="noopener">SNAP</a>, and <a href="https://en.wikipedia.org/wiki/Electronic_benefit_transfer" target="_blank" rel="noopener">EBT</a> cards.</p>
<div id="attachment_42479" style="width: 587px" class="wp-caption aligncenter"><img class=" wp-image-42479" src="media/ad1eeb72.aldisskimback.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/aldisskimback.png" alt="" width="577" height="454" /><p class="wp-caption-text">The underside of this skimmer found at Aldi is designed to record PINs.</p></div>
<p>The Lower Pottsgrove police have been asking local citizens for help in identifying the men spotted on surveillance cameras installing the skimming devices, noting that multiple victims have seen their checking accounts cleaned out after paying at compromised checkout lanes.</p>
<p>Local police released the following video footage showing one of the suspects installing an overlay skimmer exactly like the one pictured above. The man is clearly nervous and fidgety with his feet, but the cashier can&#8217;t see his little dance and certainly doesn&#8217;t notice the half second or so that it takes him to slip the skimming device over top of the payment terminal.</p>
<div style="text-align: center;"><iframe src="https://www.youtube.com/embed/fdKrSQUV5qU" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p><span id="more-42453"></span>I realize a great many people use debit cards for everyday purchases, but I&#8217;ve never been interested in assuming the added risk and so pay for everything with cash or a credit card. Armed with your PIN and debit card data, thieves can clone the card and pull money out of your account at an ATM. Having your checking account emptied of cash while your bank sorts out the situation can be a huge hassle and create secondary problems (bounced checks, for instance).</p>
<p>The Lower Pottsgrove Police have been admonishing people for blaming Aldi for the incidents, saying the thieves are extremely stealthy and that this type of crime could hit virtually any grocery chain.</p>
<p>While Aldi payment terminals in the United States are capable of accepting more secure chip-based card transactions, the company has yet to enable chip payments (although it does accept mobile contactless payment methods such as Apple Pay and Google Pay). This is important because these overlay skimmers are designed to steal card data stored on the magnetic stripe when customers swipe their cards.</p>
<p>However, many stores that have chip-enabled terminals are <a href="https://krebsonsecurity.com/2016/02/the-great-emv-fake-out-no-chip-for-you/" target="_blank" rel="noopener">still forcing customers to swipe the stripe instead of dip the chip</a>.</p>
<p>Want to learn more about self-checkout skimmers? Check out these other posts:</p>
<p><a href="https://krebsonsecurity.com/2016/06/how-to-spot-ingenico-self-checkout-skimmers/" target="_blank" rel="noopener">How to Spot Ingenico Self-Checkout Skimmers</a></p>
<p><a href="https://krebsonsecurity.com/2016/10/self-checkout-skimmers-go-bluetooth/" target="_blank" rel="noopener">Self-Checkout Skimmers Go Bluetooth</a></p>
<p><a href="https://krebsonsecurity.com/2017/02/more-on-bluetooth-ingenico-overlay-skimmers/" target="_blank" rel="noopener">More on Bluetooth Ingenico Overlay Skimmers</a></p>
<p><a href="https://krebsonsecurity.com/2016/02/safeway-self-checkout-skimmer-close-up/" target="_blank" rel="noopener">Safeway Self-Checkout Skimmers Up Close</a></p>
<p><a href="https://krebsonsecurity.com/2016/05/skimmers-found-at-walmart-a-closer-look/" target="_blank" rel="noopener">Skimmers Found at Wal-Mart: A Closer Look</a></p>


feed_id: https://krebsonsecurity.com/?p=42484
title: U.S. Arrests 13, Charges 36 in ‘Infraud’ Cybercrime Forum Bust
uri: U-S-Arrests-13-Charges-36-in-Infraud-Cybercrime-Forum-Bust
url: https://krebsonsecurity.com/2018/02/u-s-arrests-13-charges-36-in-infraud-cybercrime-forum-bust/
content:
<p>The <strong>U.S. Justice Department</strong> announced charges on Wednesday against three dozen individuals thought to be key members of &#8216;<strong>Infraud</strong>,&#8221; a long-running cybercrime forum that federal prosecutors say cost consumers more than a half billion dollars. In conjunction with the forum takedown, 13 alleged Infraud members from the United States and six other countries were arrested.</p>
<div id="attachment_42494" style="width: 214px" class="wp-caption alignright"><a href="media/370ba2c1.Infraudhome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/Infraudhome.png"><img class="wp-image-42494" src="media/370ba2c1.Infraudhome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/Infraudhome.png" alt="" width="204" height="841" /></a><p class="wp-caption-text">A screenshot of the Infraud forum, circa Oct. 2014. Like most other crime forums, it had special sections dedicated to vendors of virtually every kind of cybercriminal goods or services imaginable. Click to enlarge.</p></div>
<p>Started in October 2010, Infraud was short for &#8220;In Fraud We Trust,&#8221; and collectively the forum referred to itself as the &#8220;Ministry of Fraudulently [sic] Affairs.&#8221; As a mostly English-language fraud forum, Infraud attracted nearly 11,000 members from around the globe who sold, traded and bought everything from stolen identities and credit card accounts to ATM skimmers, botnet hosting and malicious software.</p>
<p>“Today’s indictment and arrests mark one of the largest cyberfraud enterprise prosecutions ever undertaken by the Department of Justice,” <a href="https://www.justice.gov/opa/pr/thirty-six-defendants-indicted-alleged-roles-transnational-criminal-organization-responsible" target="_blank" rel="noopener">said</a> <strong>John P. Cronan</strong>, acting assistant attorney general of the Justice Department’s criminal division. “As alleged in the indictment, Infraud operated like a business to facilitate cyberfraud on a global scale.&#8221;</p>
<p>The complaint released by the DOJ lists 36 Infraud members &#8212; some only by their hacker nicknames, others by their alleged real names and handles, and still others just as &#8220;John Does.&#8221; Having been a fairly regular lurker on Infraud over the past seven years who has sought to independently identify many of these individuals, I can say that some of these names and nick associations sound accurate but several do not.</p>
<p>The government says the founder and top member of Infraud was <strong>Svyatoslav Bondarenko</strong>, a hacker from Ukraine who used the nicknames &#8220;<strong>Rector</strong>&#8221; and &#8220;<strong>Helkern</strong>.&#8221; The first nickname is well supported by copies of the forum obtained by this author several years back; indeed, Rector&#8217;s profile listed him an administrator, and Rector can be seen on countless Infraud discussion threads vouching for sellers who had paid the monthly fee to advertise their services in &#8220;sticky&#8221; threads on the forum.</p>
<p>However, I&#8217;m not sure the Helkern association with Bondarenko is accurate. In December 2014, just days after <a href="https://krebsonsecurity.com/2013/12/sources-target-investigating-data-breach/" target="_blank" rel="noopener">breaking the story</a> about the theft of some 40 million credit and debit cards from retail giant <strong>Target</strong>, KrebsOnSecurity posted a lengthy investigation into the identity of &#8220;<strong>Rescator</strong>&#8221; &#8212; the hacker whose cybercrime shop was identified as <a href="https://krebsonsecurity.com/2013/12/cards-stolen-in-target-breach-flood-underground-markets/" target="_blank" rel="noopener">the primary vendor of cards stolen from Target</a>.</p>
<p>That story showed that Rescator changed his nickname from Helkern after Helkern&#8217;s previous cybercrime forum (Darklife) got massively hacked, and it presented clues indicating that Rescator/Helkern was a different Ukrainian man named <strong>Andrey Hodirevski</strong>. For more on that connection, see <a href="https://krebsonsecurity.com/2013/12/whos-selling-credit-cards-from-target/" target="_blank" rel="noopener">Who&#8217;s Selling Cards from Target</a>.</p>
<p>Also, Rescator was a separate vendor on Infraud, and there are no indications that I could find suggesting that Rector and Rescator were the same people. Here is Rescator&#8217;s most recent sales thread for his credit card shop on Infraud &#8212; dated almost a year after the Target breach. Notice the last comment on that thread alleges that Rescator had recently been arrested and that his shop was being run by law enforcement officials: <a class="lightbox" href="media/d905eaef.rescator-infraud.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/rescator-infraud.png"><img class="aligncenter wp-image-42490" src="media/d905eaef.rescator-infraud.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/rescator-infraud.png" alt="" width="590" height="826" /></a></p>
<p>Another top administrator of Infraud used the nickname &#8220;<strong>Stells</strong>.&#8221; According to the Justice Department, Stells&#8217; real name is <strong>Sergey Medvedev</strong>. The government doesn&#8217;t describe his exact role, but it appears to have been administering the forum&#8217;s escrow service (see screenshot below).</p>
<p>Most large cybercrime forums have an escrow service, which holds the buyer&#8217;s virtual currency until forum administrators can confirm the seller has consummated the transaction acceptably to both parties. The escrow feature is designed to cut down on members ripping one another off — but it also can add considerably to the final price of the item(s) for sale.</p>
<p>In April 2016, Medvedev would take over as the “admin and owner” of Infraud, after he posted a note online saying that Bondarenko had gone missing, the Justice Department said.</p>
<p><a class="lightbox" href="media/75262ec5.stells.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/stells.png"><img class="aligncenter wp-image-42489" src="media/75262ec5.stells.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/stells.png" alt="" width="596" height="263" /></a></p>
<p>One defendant in the case, a well-known vendor of stolen credit and debit cards who goes by the nickname &#8220;<strong>Zo0mer</strong>,&#8221; is listed as a John Doe. But according to a <a href="http://www.nytimes.com/2006/04/03/business/countless-dens-of-uncatchable-thieves.html" target="_blank" rel="noopener">New York Times story from 2006</a>, Zo0mer&#8217;s real name is <strong>Sergey Kozerev</strong>, and he hails from St. Petersburg, Russia.<span id="more-42484"></span></p>
<p>The indictments also list two other major vendors of stolen credit and debit cards: hackers who went by the nicknames &#8220;<strong>Unicc</strong>&#8221; and &#8220;<strong>TonyMontana</strong>&#8221; (the latter being a reference to the fictional gangster character played by Al Pacino in the 1983 movie Scarface). Both hackers have long operated and operate to this day their own carding shops:</p>
<div id="attachment_42488" style="width: 603px" class="wp-caption aligncenter"><a class="lightbox" href="media/f291787c.unicc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/unicc.png"><img class="wp-image-42488" src="media/f291787c.unicc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/unicc.png" alt="" width="593" height="372" /></a><p class="wp-caption-text">Unicc shop, which sells stolen credit card data as well as Social Security numbers and other consumer information that can be used for identity theft.</p></div>
<p>The government says Unicc&#8217;s real name is <strong>Andrey Sergeevich Novak</strong>. TonyMontana is listed in the complaint as John Doe #1.</p>
<div id="attachment_42487" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/068c7ec3.tonym.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/tonym.png"><img class="wp-image-42487" src="media/068c7ec3.tonym.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/tonym.png" alt="" width="597" height="434" /></a><p class="wp-caption-text">TonyMontana&#8217;s carding shop.</p></div>
<p>Perhaps the most successful vendor of skimming devices made to be affixed to ATMs and fuel pumps was a hacker known on Infraud and other crime forums as &#8220;<strong>Rafael101</strong>.&#8221; Several of <a href="https://krebsonsecurity.com/all-about-skimmers/" target="_blank" rel="noopener">my early stories about new skimming innovations</a> came from discussions with Rafael in which this author posed as an interested buyer and asked for videos, pictures and technical descriptions of his skimming devices.</p>
<p>A confidential source who asked not to be named told me a few years back that Rafael had used the same password for his skimming sales accounts on multiple competing cybercrime forums. When one of those forums got hacked, it enabled this source to read Rafael&#8217;s emails (Rafael evidently used the same password for his email account as well).</p>
<p>The source said the emails showed Rafael was ordering the parts for his skimmers in bulk from Chinese e-commerce giant <strong>Alibaba</strong>, and that he charged a significant markup on the final product. The source said Rafael had the packages all shipped to a <strong>Jose Gamboa</strong> in Norwalk, Calif &#8212; a suburb of Los Angeles. Sure enough, the indictment unsealed this week says Rafael&#8217;s real name is Jose Gamboa and that he is from Los Angeles.</p>
<div id="attachment_42495" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/b98822a9.rafael101pm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/rafael101pm.png"><img class="wp-image-42495" src="media/b98822a9.rafael101pm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/rafael101pm.png" alt="" width="598" height="261" /></a><p class="wp-caption-text">A private message from the skimmer vendor Rafael101, from on a competing cybercrime forum (carder.su) in 2012.</p></div>
<p>The Justice Department says the arrests in this case took place in Australia, France, Italy, Kosovo, Serbia, the United Kingdom and the United States. The defendants face a variety of criminal charges, including identity theft, bank fraud, wire fraud and money laundering. A copy of the indictment is available <a href="https://www.justice.gov/opa/press-release/file/1032021/download" target="_blank" rel="noopener">here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=42513
title: Domain Theft Strands Thousands of Web Sites
uri: Domain-Theft-Strands-Thousands-of-Web-Sites
url: https://krebsonsecurity.com/2018/02/domain-theft-strands-thousands-of-web-sites/
content:
<p><strong>Newtek Business Services Corp.</strong> [NASDAQ:NEWT], a Web services conglomerate that operates more than 100,000 business Web sites and some 40,000 managed technology accounts, had several of its core domain names stolen over the weekend. The theft shut off email and stranded Web sites for many of Newtek&#8217;s customers.</p>
<p>An email blast Newtek sent to customers late Saturday evening made no mention of a breach or incident, saying only that the company was changing domains due to &#8220;increased&#8221; security. A copy of that message can be read <a href="media/0938ae13.newtek1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/newtek1.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>
<p>In reality, three of their core domains were hijacked by a Vietnamese hacker, who replaced the login page many Newtek customers used to remotely manage their Web sites (<strong>webcontrolcenter[dot]com</strong>) with a live Web chat service. As a result, Newtek customers seeking answers to why their Web sites no longer resolved correctly ended up chatting with the hijacker instead.</p>
<div id="attachment_42518" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/025783b2.phpfreechat.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/phpfreechat.png"><img class="wp-image-42518" src="media/025783b2.phpfreechat.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/phpfreechat.png" alt="" width="597" height="258" /></a><p class="wp-caption-text">The PHP Web chat client that the intruder installed on Webcontrolcenter[dot]com, a domain that many Newtek customers used to manage their Web sites with the company. The perpetrator can be seen in this chat using the name &#8220;admin.&#8221; Click to enlarge.</p></div>
<p>In a follow-up email sent to customers <a href="media/2145dcc9.newtek2.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/newtek2.pdf" target="_blank" rel="noopener">10 hours later</a> (PDF), Newtek acknowledged the outage was the result of a &#8220;dispute&#8221; over three domains, <b>webcontrolcenter[dot]com, thesba[dot]com, and crystaltech[dot]com. </b></p>
<p>&#8220;We strongly request that you eliminate these domain names from all your corporate or personal browsers, and avoid clicking on them,&#8221; the company warned its customers. &#8220;At this hour, it has become apparent that as a result over the dispute for these three domain names, we do not currently have control over the domains or email coming from them.&#8221;</p>
<p>The warning continued: &#8220;There is an unidentified third party that is attempting to chat and may engage with clients when visiting the three domains. It is imperative that you do not communicate or provide any sensitive data at these locations.&#8221;</p>
<p>Newtek did not respond to requests for comment.</p>
<p>Domain hijacking is not a new problem, but it can be potentially devastating to the victim organization. In control of a hijacked domain, a malicious attacker could seamlessly conduct phishing attacks to steal personal information, or use the domain to foist malicious software on visitors.</p>
<p>Newtek is not just a large Web hosting firm: It aims to be a one-stop shop for almost any online service a small business might need. As such, it&#8217;s a mix of very different business units rolled up into one since its founding in 1998, including lending solutions, HR, payroll, managed cloud solutions, group health insurance and disaster recovery solutions.</p>
<p>&#8220;NEWT&#8217;s tentacles go deep into their client&#8217;s businesses through providing data security, human resources, employee benefits, payments technology, web design and hosting, a multitude of insurance solutions, and a suite of IT services,&#8221; reads <a href="https://seekingalpha.com/article/4108064-newtek-business-services-corp-yielding-10-percent-afraid-get-hands-dirty" target="_blank" rel="noopener">a Sept. 2017 profile</a> of the company at <strong>SeekingAlpha</strong>, a crowdsourced market analysis publication.</p>
<div id="attachment_42526" style="width: 575px" class="wp-caption aligncenter"><img class="wp-image-42526 " src="media/cb3ab1d6.whoisnewtek.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/whoisnewtek.png" alt="" width="565" height="267" /><p class="wp-caption-text">Newtek&#8217;s various business lines. Source: Newtek.</p></div>
<p><span id="more-42513"></span></p>
<p><img class="aligncenter wp-image-42525" src="media/464b966d.whoisnewtek2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/whoisnewtek2.png" alt="" width="559" height="338" /></p>
<p>Reached via the Web chat client he installed at webcontrolcenter[dot]com, the person who claimed responsibility for the hijack said he notified Newtek five days ago about a &#8220;bug&#8221; he found in the company&#8217;s online operations, but that he received no reply.</p>
<p>A Newtek customer who resells the company&#8217;s products to his clients said he had to spend much of the weekend helping clients regain access to email accounts and domains as a result of the incident. The customer, who asked to remain anonymous, said he was shocked that Newtek made little effort to convey the gravity of the hijack to its customers &#8212; noting that the company&#8217;s <a href="http://www.newtekone.com" target="_blank" rel="noopener">home page</a> still makes no mention of the incident.</p>
<p>&#8220;They also fail to make it clear that any data sent to any host under the domain could be recorded (email passwords, web credentials, etc.) by the attacker,&#8221; he said. &#8220;I’m floored at how bad their communication was to their users. I’m not surprised, but concerned, that they didn’t publish the content in the emails directly on their website.&#8221;</p>
<p>The source said that at a minimum Newtek should have expired all passwords immediately and required resets through non-compromised hosts.</p>
<p>&#8220;And maybe put a notice about this on their home page instead of relying on email, because a lot of my customers can&#8217;t get email right now as a result of this,&#8221; the source said.</p>
<p>There are a few clues that suggest the perpetrator of these domain hijacks is indeed being truthful about both his nationality and that he located a bug in Newtek&#8217;s service. Two of the hijacked domains were moved to a Vietnamese domain registrar (inet.vn).</p>
<p>This individual gave me an email address to contact him at &#8212; <strong>hd2416@gmail.com</strong> &#8212; although he has so far not responded to questions beyond promising to reply in Vietenamese. The email is tied to two different Vietnamese-language social networking profiles.</p>
<p>A search at <a href="https://www.domaintools.com" target="_blank" rel="noopener">Domaintools</a> indicates that this address is linked to the registration records for four domains, including one (giakiemnew[dot]com) that was recently hosted on a dedicated server operated by Newtek&#8217;s legacy business unit Crystaltek [full disclosure: Domaintools is an advertiser on this site]. Recall that Crystaltek[dot]com was among the three hijacked domains.</p>
<p>In addition, the domain giakiemnew[dot]com was registered through <strong>Newtek Technology Services</strong>, a domain registration service offered by Newtek. This suggests that the perpetrator was in fact a customer of Newtek, and perhaps did discover a vulnerability while using the service.</p>


feed_id: https://krebsonsecurity.com/?p=42544
title: Microsoft Patch Tuesday, February 2018 Edition
uri: Microsoft-Patch-Tuesday-February-2018-Edition
url: https://krebsonsecurity.com/2018/02/microsoft-patch-tuesday-february-2018-edition/
content:
<p><strong>Microsoft</strong> today released a bevy of security updates to tackle more than 50 serious weaknesses in <strong>Windows</strong>, <strong>Internet Explorer</strong>/<strong>Edge</strong>, <strong>Microsoft Office</strong> and <strong>Adobe Flash Player</strong>, among other products. A good number of the patches issued today ship with Microsoft&#8217;s &#8220;critical&#8221; rating, meaning the problems they fix could be exploited remotely by miscreants or malware to seize complete control over vulnerable systems &#8212; with little or no help from users.</p>
<p><img class="alignright wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="174" height="182" />February&#8217;s Patch Tuesday batch includes fixes for at least 55 security holes. Some of the scarier bugs include vulnerabilities in <strong>Microsoft Outlook</strong>, Edge and Office that could let bad guys or bad code into your Windows system just by getting you to click on a booby trapped link, document or visit a compromised/hacked Web page.</p>
<p>As per usual, the <strong>SANS Internet Storm Center</strong> has <a href="https://isc.sans.edu/forums/diary/February+2018+Microsoft+and+Adobe+Patch+Tuesday/23341/" target="_blank" rel="noopener">a handy rundown</a> on the individual flaws, neatly indexing them by severity rating, exploitability and whether the problems have been publicly disclosed or exploited.<span id="more-42544"></span></p>
<p>One of the updates addresses a pair of serious vulnerabilities in Adobe Flash Player (which ships with the latest version of Internet Explorer/Edge). As KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/02/attackers-exploiting-unpatched-flaw-in-flash/" target="_blank" rel="noopener">warned last week</a>, there are active attacks ongoing against these Flash vulnerabilities.</p>
<p><img class="alignleft wp-image-18875" src="media/18bb50f1.brokenflash-a.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="" width="177" height="151" />Adobe is phasing out Flash entirely by 2020, but most of the major browsers already take steps to hobble Flash. And with good reason: It&#8217;s a major security liability. Chrome also bundles Flash, but blocks it from running on all but a handful of popular sites, and then only after user approval.</p>
<p>For Windows users with Mozilla Firefox installed, the browser prompts users to enable Flash on a per-site basis. Through the end of 2017 and into 2018, Microsoft Edge will continue to ask users for permission to run Flash on most sites the first time the site is visited, and will remember the user’s preference on subsequent visits.</p>
<p>The latest <a href="https://helpx.adobe.com/security/products/flash-player/apsb18-03.html" target="_blank" rel="noopener">standalone version</a> of Flash that addresses these bugs is <em>28.0.0.161</em> for Windows, Mac, Linux and Chrome OS. But most users probably would be better off manually hobbling or removing Flash altogether, since so few sites actually require it still. Disabling Flash in Chrome is simple enough. Paste “<a href="chrome://settings/content" target="_blank" rel="noopener">chrome://settings/content</a>” into a Chrome browser bar and then select “Flash” from the list of items. By default it should be set to “Ask first” before running Flash, although users also can disable Flash entirely here or whitelist and blacklist specific sites.</p>
<p>People running <strong>Adobe Reader</strong> or <strong>Acrobat</strong> also need to update, as Adobe has shipped new versions of these products that fix <a href="https://helpx.adobe.com/security/products/acrobat/apsb18-02.html" target="_blank" rel="noopener">at least 39 security holes</a>. Adobe Reader users should know there are alternative PDF readers that aren&#8217;t so bloated or full of security issues. <a href="http://www.sumatrapdfreader.org/free-pdf-reader.html" target="_blank" rel="noopener">Sumatra PDF</a> is a good, lightweight alternative.</p>
<p>Experience any issues, glitches or problems installing these updates? Sound off about it in the comments below.</p>


