# articles

feed_id: https://krebsonsecurity.com/?p=37499
title: Adobe, Microsoft Push Critical Security Fixes
uri: 2017-01-12-Adobe-Microsoft-Push-Critical-Security-Fixes
url: https://krebsonsecurity.com/2017/01/adobe-microsoft-push-critical-security-fixes-9/
content:
<p><strong>Adobe</strong> and <strong>Microsoft</strong> on Tuesday each released security updates for software installed on hundreds of millions of devices. Adobe issued an update for <strong>Flash Player</strong> and for <strong>Acrobat/Reader</strong>. Microsoft released just <a href="https://technet.microsoft.com/en-us/library/security/ms17-jan.aspx" target="_blank">four updates</a> to plug some 15 security holes in <strong>Windows</strong> and related software.</p>
<p><img class="alignright wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="185" height="194" />Microsoft&#8217;s batch includes updates for Windows, <strong>Office</strong> and <strong>Microsoft Edge</strong> (Redmond&#8217;s replacement for <strong>Internet Explorer</strong>). Also interesting is that January 2017 is the last month Microsoft plans to publish individual bulletins for each patch. From now on, some of the data points currently in the individual updates will be lumped into a &#8220;<a href="https://portal.msrc.microsoft.com/en-us/" target="_blank">Security Updates Guide</a>&#8221; published with each Patch Tuesday.</p>
<p>This change mirrors a shift in the way Microsoft is deploying updates. Last year Microsoft stopped making individual security updates available for home users, giving those users instead a single monthly security rollup that includes all available security updates.</p>
<p>Windows users and anyone else with Flash installed will need to make sure that Adobe Flash Player is updated (or suitably bludgeoned, more on that in a bit). Adobe&#8217;s Flash update addresses <a href="https://helpx.adobe.com/security/products/flash-player/apsb17-02.html" target="_blank">13 flaws</a> in the widely-installed browser plugin. The patch brings Flash to <em>v. 24.0.0.194 </em>for Windows, Mac and Linux users alike.<span id="more-37499"></span></p>
<p>If you have Flash installed, you should update, hobble or remove Flash as soon as possible. To see which version of Flash your browser may have installed, check out <a href="http://www.adobe.com/software/flash/about/" target="_blank">this page</a>. But the smartest option is probably to ditch the program once and for all and significantly increase the security of your system in the process. An extremely powerful and buggy program that binds itself to the browser, Flash is a favorite target of attackers and malware. For some ideas about how to hobble or do without Flash (as well as slightly less radical solutions) check out <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">A Month Without Adobe Flash Player</a>.</p>
<p><img class="alignleft size-full wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="211" height="180" />If you choose to keep and update Flash, please do it today. The most recent versions of Flash should be available from the <a href="https://get.adobe.com/flashplayer/" target="_blank">Flash home page.</a> Windows users who browse the Web with anything other than <strong>Internet Explorer</strong> may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>
<p><strong>Chrome </strong>and IE should auto-install the latest Flash version on browser restart (users may need to manually check for updates in and/or restart the browser to get the latest Flash version). My version of Chrome says it&#8217;s the latest one (<em>55.0.2883.87</em>) but the <a href="https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-chrome-os.html" target="_blank">Chrome Releases blog</a> says the latest stable version &#8212; <em>55.0.2883.105</em> includes the Flash fixes (among other security fixes for Chrome), which isn&#8217;t yet being offered. Adobe&#8217;s Web site tells me my Flash version is 24.0.0.186 (not the latest).</p>
<p>When in doubt with Chrome, click the vertical three dot icon to the right of the URL bar, select “Help,” then “About Chrome”: If there is an update available, Chrome should install it then. In either case, be sure to restart the browser after installing an update (if it doesn&#8217;t do that for you).</p>
<p>As ever, if you experience any issues applying these updates, please don&#8217;t hesitate to leave a note about the issue in the comments below. You might help someone else who&#8217;s having the same problem!</p>


feed_id: https://krebsonsecurity.com/?p=37412
title: Who is Anna-Senpai, the Mirai Worm Author?
uri: Who-is-Anna-Senpai-the-Mirai-Worm-Author
url: https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/
content:
<p>On September 22, 2016, this site was <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank">forced offline</a> for nearly four days after it was hit with “<strong>Mirai</strong>,” a malware strain that enslaves poorly secured Internet of Things (IoT) devices like wireless routers and security cameras into a botnet for use in large cyberattacks. Roughly a week after that assault, the individual(s) who launched that attack &#8212; using the name “<strong>Anna Senpai</strong>” &#8212; <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank">released the source code</a> for Mirai, spawning dozens of copycat attack armies online.</p>
<p>After months of digging, KrebsOnSecurity is now confident to have uncovered Anna Senpai’s real-life identity, and the identity of at least one co-conspirator who helped to write and modify the malware.</p>
<div id="attachment_36550" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/464e1dd6.mirai-hf.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/mirai-hf.png"><img class="wp-image-36550 size-medium" src="media/61e3129a.mirai-hf-580x232.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/mirai-hf-580x232.png" alt="The Hackforums post that includes links to the Mirai source code." width="580" height="232" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/10/mirai-hf-580x232.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/10/mirai-hf-768x308.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/10/mirai-hf-940x377.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Mirai co-author Anna-Senpai leaked the source code for Mirai on Sept. 30, 2016.</p></div>
<p>Before we go further, a few disclosures are probably in order. First, this is easily the longest story I&#8217;ve ever written on this blog. It&#8217;s lengthy because I wanted to walk readers through my process of discovery, which has taken months to unravel. The details help in understanding the financial motivations behind Mirai and the botnet wars that preceded it. Also, I realize there are a great many names to keep track of as you read this post, <a href="https://krebsonsecurity.com/who-is-anna-senpai-mirai-story-glossary/" target="_blank">so I&#8217;ve included a glossary</a>.</p>
<p>The story you&#8217;re reading now is the result of hundreds of hours of research.  At times, I was desperately seeking the missing link between seemingly unrelated people and events; sometimes I was inundated with huge amounts of information &#8212; much of it intentionally false or misleading &#8212; and left to search for kernels of truth hidden among the dross.  If you&#8217;ve ever wondered why it seems that so few Internet criminals are brought to justice, I can tell you that the sheer amount of persistence and investigative resources required to piece together who&#8217;s done what to whom (and why) in the online era is tremendous.</p>
<p>As noted in previous KrebsOnSecurity articles, botnets like Mirai are used to knock individuals, businesses, governmental agencies, and non-profits offline on a daily basis. These so-called &#8220;<strong>distributed denial-of-service</strong> (<strong>DDoS) </strong>attacks<strong> </strong>are digital sieges in which an attacker causes thousands of hacked systems to hit a target with so much junk traffic that it falls over and remains unreachable by legitimate visitors. While DDoS attacks typically target a single Web site or Internet host, they often result in widespread collateral Internet disruption.</p>
<p>A great deal of DDoS activity on the Internet originates from so-called &#8216;<a href="https://krebsonsecurity.com/tag/booter/" target="_blank">booter/stresser&#8217; services</a>, which are essentially DDoS-for-hire services which allow even unsophisticated users to launch high-impact attacks.  And as we will see, the incessant competition for profits in the blatantly illegal DDoS-for-hire industry can lead those involved down some very strange paths, indeed.</p>
<h4>THE FIRST CLUES</h4>
<p>The first clues to Anna Senpai’s identity didn’t become clear until I understood that Mirai was just the latest incarnation of an IoT botnet family that has been in development and relatively broad use for nearly three years.</p>
<p>Earlier this summer, my site was hit with several huge attacks from a collection of hacked IoT systems compromised by a family of botnet code that served as a precursor to Mirai. The malware went by several names, including “<strong>Bashlite</strong>,” “<strong>Gafgyt</strong>,” “<strong>Qbot</strong>,” “<strong>Remaiten</strong>,” and “<strong>Torlus</strong>.”</p>
<p>All of these related IoT botnet varieties infect new systems in a fashion similar to other well-known Internet worms &#8212; propagating from one infected host to another. And like those earlier Internet worms, sometimes the Internet scanning these systems perform to identify other candidates for inclusion into the botnet is so aggressive that it constitutes an unintended DDoS on the very home routers, Web cameras and DVRs that the bot code is trying to subvert and recruit into the botnet. This kind of self-defeating behavior will be familiar to those who recall the original <a href="https://en.wikipedia.org/wiki/Morris_worm" target="_blank">Morris Worm</a>, <a href="https://en.wikipedia.org/wiki/Nimda" target="_blank">NIMDA</a>, <a href="https://en.wikipedia.org/wiki/Code_Red_(computer_worm)" target="_blank">CODE RED</a>, <a href="https://en.wikipedia.org/wiki/Welchia" target="_blank">Welchia</a>, <a href="https://en.wikipedia.org/wiki/Blaster_(computer_worm)" target="_blank">Blaster</a> and <a href="https://en.wikipedia.org/wiki/SQL_Slammer" target="_blank">SQL Slammer</a> disruptions of yesteryear.</p>
<p>Infected IoT devices constantly scan the Web for other IoT things to compromise, wriggling into devices that are protected by little more than insecure factory-default settings and passwords. The infected devices are then forced to participate in DDoS attacks (ironically, many of the devices most commonly infected by Mirai and similar IoT worms are security cameras).</p>
<p>Mirai’s ancestors had so many names because each name corresponded to a variant that included new improvements over time. In 2014, a group of Internet hooligans operating under the banner “<strong>lelddos</strong>” very publicly used the code to launch large, sustained attacks that knocked many Web sites offline.</p>
<p>The most frequent target of the lelddos gang were Web servers used to host <strong><a href="http://Minecraft" target="_blank">Minecraft</a></strong>, a wildly popular computer game sold by <strong>Microsoft</strong> that can be played from any device and on any Internet connection.</p>
<p>The object of Minecraft is to run around and build stuff, block by large pixelated block. That may sound simplistic and boring, but an impressive number of people positively adore this game – particularly pre-teen males. Microsoft <a href="http://www.theverge.com/2016/6/2/11838036/minecraft-sales-100-million" target="_blank">has sold more than a 100 million copies of Minecraft</a>, and at any given time there are over a million people playing it online. Players can build their own worlds, or visit a myriad other blocky realms by logging on to their favorite Minecraft server to play with friends.</p>
<div id="attachment_37423" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-37423" src="media/e80d0f6a.minecraft-580x250.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/minecraft-580x250.png" alt="Image: Minecraft.net" width="580" height="250" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/minecraft-580x250.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/minecraft-768x330.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/01/minecraft-940x404.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/01/minecraft.png 1204w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Image: Minecraft.net</p></div>
<p>A large, successful Minecraft server with more than a thousand players logging on each day can easily earn the server’s owners upwards of $50,000 per month, mainly from players renting space on the server to build their Minecraft worlds, and purchasing in-game items and special abilities.</p>
<p>Perhaps unsurprisingly, the top-earning Minecraft servers eventually attracted the attention of ne’er-do-wells and extortionists like the lelddos gang. Lelddos would launch a huge DDoS attack against a Minecraft server, knowing that the targeted Minecraft server owner was likely losing thousands of dollars for each day his gaming channel remained offline.</p>
<p>Adding urgency to the ordeal, many of the targeted server’s loyal customers would soon find other Minecraft servers to patronize if they could not get their Minecraft fix at the usual online spot.</p>
<p><strong>Robert Coelho</strong> is vice president of <strong>ProxyPipe, Inc.</strong>, a San Francisco company that specializes in protecting Minecraft servers from attacks.</p>
<p>&#8220;The Minecraft industry is so competitive,&#8221; Coelho said. &#8220;If you’re a player, and your favorite Minecraft server gets knocked offline, you can switch to another server. But for the server operators, it&#8217;s all about maximizing the number of players and running a large, powerful server. The more players you can hold on the server, the more money you make. But if you go down, you start to lose Minecraft players very fast &#8212; maybe for good.&#8221;</p>
<p>In June 2014, ProxyPipe was hit with a 300 gigabit per second DDoS attack launched by lelddos, which had a penchant for publicly taunting its victims on Twitter just as it began launching DDoS assaults at the taunted.</p>
<div id="attachment_37433" style="width: 586px" class="wp-caption aligncenter"><a class="lightbox" href="media/072928c6.lelddostwitter.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/lelddostwitter.png"><img class="wp-image-37433 size-full" src="media/072928c6.lelddostwitter.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/lelddostwitter.png" alt="The hacker group &quot;lelddos&quot; tweeted at its victims before launching huge DDoS attacks against them." width="576" height="745" /></a><p class="wp-caption-text">The hacker group &#8220;lelddos&#8221; tweeted at its victims before launching huge DDoS attacks against them.</p></div>
<p>At the time, ProxyPipe was buying DDoS protection from Reston, Va. -based security giant <strong>Verisign</strong>. In a quarterly report published in 2014, Verisign called the attack the largest it had ever seen, although it didn’t name ProxyPipe in the report – referring to it only as a customer in the media and entertainment business.</p>
<p>Verisign said the 2014 attack was launched by a botnet of more than 100,000 hacked routers sold by a company called <strong>SuperMicro</strong>. Days before the huge attack on ProxyPipe, a security researcher <a href="http://blog.cari.net/carisirt-yet-another-bmc-vulnerability-and-some-added-extras/" target="_blank">published information</a> about a vulnerability in the SuperMicro devices that could allow them to be remotely hacked and commandeered for these sorts of attacks.</p>
<h4>THE CENTRALITY OF PROTRAF</h4>
<p>Coelho recalled that in mid-2015 his company’s Minecraft customers began coming under attack from a botnet made up of IoT devices infected with Qbot. He said the attacks were directly preceded by a threat made by a then-17-year-old <strong>Christopher &#8220;CJ&#8221; Sculti, Jr.</strong>, the owner and sole employee of a competing DDoS protection company called <strong>Datawagon</strong>.</p>
<p>Datawagon also courted Minecraft servers as customers, and its servers were hosted on Internet space claimed by yet another Minecraft-focused DDoS protection provider &#8212; <strong>ProTraf Solutions</strong>.</p>
<div id="attachment_37424" style="width: 243px" class="wp-caption alignright"><img class=" wp-image-37424" src="media/8f4fed71.cjlinkedin-580x782.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/cjlinkedin-580x782.png" alt="CJ Sculti, Jr." width="233" height="314" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/cjlinkedin-580x782.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/cjlinkedin.png 614w" sizes="(max-width: 233px) 100vw, 233px" /><p class="wp-caption-text">Christopher &#8220;CJ&#8221; Sculti, Jr.</p></div>
<p>According to Coelho, ProTraf was trying to woo many of his biggest Minecraft server customers away from ProxyPipe. Coelho said in mid-2015, Sculti reached out to him on Skype and said he was getting ready to disable Coelho’s Skype account. At the time, an exploit for a software weakness in Skype was being traded online, and this exploit could be used to remotely and instantaneously disable any Skype account.</p>
<p>Sure enough, Coelho recalled, his Skype account and two others used by co-workers were shut off just minutes after that threat, effectively severing a main artery of support for ProxyPipe’s customers – many of whom were accustomed to communicating with ProxyPipe via Skype.</p>
<p>“CJ messaged me about five minutes before the DDoS started, saying he was going to disable my skype,” Coelho said. “The scary thing about when this happens is you don’t know if your Skype account has been hacked and under control of someone else or if it just got disabled.”</p>
<p>Once ProxyPipe’s Skype accounts were disabled, the company’s servers were hit with a massive, constantly changing DDoS attack that disrupted ProxyPipe’s service to its Minecraft server customers. Coelho said within a few days of the attack, many of ProxyPipe’s most lucrative Minecraft servers had moved over to servers run protected by ProTraf Solutions.</p>
<p>“In 2015, the ProTraf guys hit us offline tons, so a lot of our customers moved over to them,” Coelho said. “We told our customers that we knew [ProTraf] were the ones doing it, but some of the customers didn’t care and moved over to ProTraf anyway because they were losing money from being down.”</p>
<p>I found Coelho’s story fascinating because it eerily echoed the events leading up to <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">my Sept. 2016 record 620 Gbps attack</a>. I, too, was contacted via Skype by Sculti &#8212; on two occasions. The first was on July 7, 2015, when Sculti reached out apropos of nothing to brag about scanning the Internet for IoT devices running default usernames and passwords, saying he had uploaded some kind of program to more than a quarter-million systems that his scans found.</p>
<p>Here’s a snippet of that conversation:</p>
<p>July 7, 2015:</p>
<p>21:37 CJ: http://krebsonsecurity.com/2015/06/crooks-use-hacked-routers-to-aid-cyberheists/<br />
21:37 CJ: vulnerable routers are a HUGE issue<br />
21:37 CJ: a few months ago<br />
21:37 CJ: I scanned the internet with a few sets of defualt logins<br />
21:37 CJ: for telnet<br />
21:37 CJ: and I was able to upload and execute a binary<br />
21:38 CJ: on 250k devices<br />
21:38 CJ: most of which were routers<br />
21:38 Brian Krebs: o_0</p>
<p>The second time I heard from Sculti on Skype was Sept. 20, 2016 &#8212; the day of <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">my 620 Gbps attack</a>. Sculti was angry over <a href="https://krebsonsecurity.com/2016/09/ddos-mitigation-firm-has-history-of-hijacks/" target="_blank">a story I’d just published</a> that mentioned his name, and he began rather saltily maligning the reputation of a source and friend who had helped me with that story.</p>
<p>Indignant on behalf of my source and annoyed at Sculti’s rant, I simply blocked his Skype account from communicating with mine and went on with my day. Just minutes after that conversation, however, my Skype account was flooded with thousands of contact requests from compromised or junk Skype accounts, making it virtually impossible to use the software for making phone calls or instant messaging.</p>
<p>Six hours after that Sept. 20 conversation with Sculti, the huge 620 Gbps DDoS attack commenced on this site.<span id="more-37412"></span></p>
<h4>WHO IS LELDDOS?</h4>
<p>Coelho said he believes the main members of lelddos gang were Sculti and the owners of ProTraf. Asked why he was so sure of this, he recounted a large lelddos attack in early 2015 against ProxyPipe that coincided with a scam in which large tracts of Internet address space were temporarily stolen from the company.</p>
<p>According to ProxyPipe, a swath of Internet addresses was hijacked from the company by <strong>FastReturn</strong>, another DDoS mitigation firm that also specialized in protecting Minecraft servers from attacks. <strong>Dyn</strong>, a company that closely tracks which blocks of Internet addresses are assigned to which organizations, confirmed the timing of the Internet address hijack that Coelho described.</p>
<p>A few months after that attack, the owner of FastReturn &#8212; a young man from Dubai named <a href="https://www.facebook.com/messages/ammarzuberi1" target="_blank">Ammar Zuberi</a> &#8212; went to work as a software developer for ProTraf. In the process, Zuberi transferred the majority of Internet addresses assigned to FastReturn over to ProTraf.</p>
<p>Zuberi told KrebsOnSecurity that he was not involved with lelddos, but he acknowledged that he did hijack ProxyPipe&#8217;s Internet address space before moving over to ProTraf.</p>
<p>&#8220;I was stupid and new to this entire thing and it was interesting to me how insecure the underlying ecosystem of the Internet was,&#8221; Zuberi said. &#8220;I just kept pushing the envelope to see how far I could get with that, I guess. I eventually realized though and got away from it, although that&#8217;s not really much of a justification.&#8221;</p>
<p>According to Zuberi, CJ Sculti Jr. was a member of lelddos, as were the two co-owners of ProTraf. This is interesting because not long after the September 2016 Mirai attack took this site offline, several sources who specialize in lurking on cybercrime forums shared information suggesting that the principal author of Bashlite/Qbot was a ProTraf employee: A 19-year-old computer whiz from Washington, Penn. named <strong>Josiah White</strong>.</p>
<p>White’s <a href="https://www.linkedin.com/in/josiah-white-16933811b" target="_blank">profile on LinkedIn</a> lists him as an “enterprise DDoS mitigation expert” at ProTraf, but for years he was better known to those in the hacker community under the alias “LiteSpeed.”</p>
<p>LiteSpeed is the screen name White used on <strong>Hackforums[dot]net</strong> – a sprawling English-language marketplace where mostly young, low-skilled hackers can buy and sell cybercrime tools and stolen goods with ease. Until <a href="http://blog.cari.net/carisirt-yet-another-bmc-vulnerability-and-some-added-extras/" target="_blank">very recently</a>, Hackforums also was the definitive place to buy and sell DDoS-for-hire services.</p>
<p>I contacted White to find out if the rumors about his authorship of Qbot/Bashlite were true. White acknowledged that he had written some of Qbot/Bashlite’s components &#8212; including the code segment that the malware uses to spread the infection to new machines. But White said he never intended for his code to be sold and traded online.</p>
<p>White claims that a onetime friend and Hackforums member nicknamed “Vyp0r” betrayed his trust and forced him to publish the code online by threatening to post White&#8217;s personal details online and to “swat” his home. Swatting is a potentially deadly hoax in which an attacker calls in a fake hostage situation or bomb threat at a residence or business with the intention of sending a team of heavily-armed police officers to the target’s address.</p>
<p>“Most of the stuff that I had wrote was for friends, but as I later realized, things on HF [Hackforums] tend to not remain private,” White wrote in an instant message to KrebsOnSecurity. “Eventually I learned they were reselling them in under-the-table deals, and so I just released everything to stop that. I made some mistakes when I was younger, and I realize that, but I&#8217;m trying to set my path straight and move on.”</p>
<h4>WHO IS PARAS JHA?</h4>
<p><a class="lightbox" href="media/516adf6d.paraslinkedin.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/paraslinkedin.png"><img class="aligncenter wp-image-37419 size-medium" src="media/1a62c7e1.paraslinkedin-580x670.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/paraslinkedin-580x670.png" alt="paraslinkedin" width="580" height="670" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/paraslinkedin-580x670.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/paraslinkedin.png 707w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>White’s employer ProTraf Solutions has only one other employee – 20-year-old President <strong>Paras Jha</strong>, from Fanwood, NJ. On his LinkedIn profile, Jha states that “Paras is a passionate entrepreneur driven by the want to create.&#8221; The profile continues:</p>
<blockquote><p>&#8220;Highly self-motivated, in 7th grade he began to teach himself to program in a variety of languages. Today, his skillset for software development includes C#, Java, Golang, C, C++, PHP, x86 ASM, not to mention web ‘browser languages’ such as Javascript and HTML/CSS.&#8221;</p></blockquote>
<p>Jha’s LinkedIn page also shows that he has extensive experience running Minecraft servers, and that for several years he worked for <strong>Minetime</strong>, one of the most popular Minecraft servers at the time.</p>
<p>After first reading Jha’s LinkedIn resume, I was haunted by the nagging feeling that I’d seen this rather unique combination of computer language skills somewhere else online. Then it dawned on me: The mix of programming skills that Jha listed in his LinkedIn profile is remarkably similar to the skills listed on Hackforums by none other than Mirai’s author &#8212; Anna-Senpai.</p>
<p>Prior to leaking the Mirai source code on HackForums at the end of September 2016, the majority of Anna-Senpai’s posts on Hackforums were meant to taunt other hackers on the forum who were using Qbot to build DDoS attack armies.</p>
<p>The best example of this is a thread posted to Hackforums on July 10, 2016 titled “Killing All Telnets,” in which Anna-Senpai boldly warns forum members that the malicious code powering his botnet contains a particularly effective “bot killer” designed to remove Qbot from infected IoT devices and to prevent systems infected with his malware from ever being reinfected with Qbot again.</p>
<div id="attachment_37426" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/aba13112.botcount.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/botcount.png"><img class="wp-image-37426 size-medium" src="media/f06863ac.botcount-580x253.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/botcount-580x253.png" alt="Anna-Senpai warns Qbot users that his new worm (relatively unknown by its name &quot;Mirai&quot; at the time) was capable of killing off IoT devices infected with Qbot." width="580" height="253" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/botcount-580x253.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/botcount-768x335.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/01/botcount-940x410.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Anna-Senpai warns Qbot users that his new worm (relatively unknown by its name &#8220;Mirai&#8221; at the time) was capable of killing off IoT devices infected with Qbot.</p></div>
<p>Initially, forum members dismissed Anna’s threats as idle taunts, but as the thread continues for page after page we can see from other forum members that his bot killer is indeed having its intended effect. [Oddly enough, it&#8217;s very common for the authors of botnet code to include patching routines to protect their newly-enslaved bots from being compromised by other miscreants.  Just like in any other market, there is a high degree of competition between cybercrooks who are constantly seeking to add more zombies to their DDoS armies, and they often resort to unorthodox tactics to knock out the competition.  As we&#8217;ll see, this kind of internecine warfare is a major element in this story.]</p>
<p>&#8220;When the owner of this botnet wrote a July 2016 Hackforums thread named &#8216;Killing all Telnets&#8217;, he was right,&#8221; <a href="https://www.flashpoint-intel.com/mirai-iot-understanding-ddos-impact/" target="_blank">wrote</a> <strong>Allison Nixon</strong> and <strong>Pierre Lamy</strong>, threat researchers for New York City-based security firm <strong>Flashpoint</strong>. &#8220;Our intelligence around that time reflected a massive shift away from the traditional gafgyt infection patterns and towards a different pattern that refused to properly execute on analysts’ machines. This new species choked out all the others.&#8221;</p>
<p>It wasn’t until after I’d spoken with Jha&#8217;s business partner Josiah White that I began re-reading every one of Anna-Senpai’s several dozen posts to Hackforums. The one that made Jha&#8217;s programming skills seem familiar came on July 12, 2016 &#8212; a week after posting his “Killing All Telnets” discussion thread &#8212; when Anna-Senpai contributed to a Hackforums thread started by a hacker group calling itself “Nightmare.”</p>
<p>Such groups or hacker cliques are common on Hackforums, and forum members can apply for membership by stating their skills and answering a few questions. Anna-Senpai posted his application for membership into this thread among dozens of others, describing himself thusly:</p>
<blockquote><p>“<strong>Age:</strong> 18+</p>
<p><strong>Location and Languages Spoken:</strong> English</p>
<p><strong>Which of the aforementioned categories describe you the best?:</strong> Programmer / Development</p>
<p><strong>What do you Specialize in? (List only):</strong> Systems programming / general low level languages (C + ASM)</p>
<p><strong>Why should we choose you over other applicants?:</strong> I have 8 years of development under my belt, and I&#8217;m very familiar with programming in a variety of languages, including ASM, C, Go, Java, C#, and PHP. I like to use this knowledge for personal gain.”</p></blockquote>
<p>The Hackforums post shows Jha and Anna-Senpai have the exact same programming skills. Additionally, according to an analysis of Mirai by security firm <strong>Incapsula</strong>, the malicious software used to control a botnet powered by Mirai is coded in Go (a.k.a. “Golang”), a <a href="http://www.makeuseof.com/tag/10-programming-languages-heard" target="_blank">somewhat esoteric</a> programming language developed by Google in 2007 that saw <a href="https://tech.slashdot.org/story/16/10/16/2226253/googles-go-language-surges-in-popularity" target="_blank">a surge in popularity in 2016</a>. Incapsula also said the malcode that gets installed on IoT bots is coded in C.</p>
<p><a class="lightbox" href="media/49e4b2df.anna_senpai_intro_on_hackforums.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/anna_senpai_intro_on_hackforums.png"><img class="aligncenter wp-image-37420 size-medium" src="media/4713cb64.anna_senpai_intro_on_hackforums-580x202.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/anna_senpai_intro_on_hackforums-580x202.png" alt="anna_senpai_intro_on_hackforums" width="580" height="202" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/anna_senpai_intro_on_hackforums-580x202.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/anna_senpai_intro_on_hackforums-768x267.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/01/anna_senpai_intro_on_hackforums-940x327.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<h4>DREADIS[NOT]COOL</h4>
<p>I began to dig deeper into Paras Jha’s history and footprint online, and discovered that his father in October 2013 registered a vanity domain for his son, <strong>parasjha.info</strong>. That site is no longer online, but a <a href="https://web.archive.org/web/20140122005106/http://parasjha.info/" target="_blank">historic version of it cached</a> by the indispensable <strong>Internet Archive</strong> includes a resume of Jha’s early work with various popular Minecraft servers. Here&#8217;s a autobiographical snippet from parasjha.info:</p>
<blockquote><p>“My passion is to utilize my skills in programming and drawing to develop entertaining games and software for the online game ‘Minecraft. Someday, I plan to start my own enterprise focused on the gaming industry targeted towards game consoles and the mobile platform. To further my ideas and help the gaming community, I have released some of my code to open source projects on websites centered on public coding under the handle <a href="https://github.com/dreadiscool" target="_blank">dreadiscool</a>.”</p></blockquote>
<p>A <a href="https://www.google.com/search?q=%22dreadiscool%22&amp;oq=%22dreadiscool%22&amp;aqs=chrome.0.69i59j69i65l2j0l3.2751j0j4&amp;sourceid=chrome&amp;ie=UTF-8" target="_blank">Google search for this rather unique username “dreadiscool”</a> turns up accounts by the same name at dozens of forums dedicated to computer programming and Minecraft. In many of those accounts, the owner is clearly frustrated by incessant DDoS attacks targeting his Minecraft servers, and appears eager for advice on how best to counter the assaults.</p>
<p>From Dreadiscool’s various online postings, it seems clear that at some point Jha decided it might be more profitable and less frustrating to defend Minecraft servers from DDoS attacks, as opposed to trying to maintain the servers themselves.</p>
<p>“My experience in dealing with DDoS attacks led me to start a server hosting company focused on providing solutions to clients to mitigate such attacks,” Jha wrote on his vanity site.</p>
<p>Some of the more recent Dreadiscool posts date to November 2016, and many of those posts are lengthy explanations of highly technical subjects. The tone of voice in these posts is far more confident and even condescending than the Dreadiscool from years earlier, covering a range of subjects from programming to DDoS attacks.</p>
<div id="attachment_37427" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/828966b6.dread-spigot.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/dread-spigot.png"><img class="wp-image-37427 size-medium" src="media/0f19ab44.dread-spigot-580x429.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/dread-spigot-580x429.png" alt="Dreadiscool's account on Spigot Minecraft forum since 2013 includes some interesting characters photoshopped into this image." width="580" height="429" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/dread-spigot-580x429.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/dread-spigot-768x569.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/01/dread-spigot-940x696.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/01/dread-spigot.png 1140w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Dreadiscool&#8217;s account on Spigot Minecraft forum since 2013 includes some interesting characters photoshopped into this image.</p></div>
<p>For example, Dreadiscool has been an active member of the Minecraft forum <strong>spigotmc.org</strong> since 2013. <a href="https://archive.is/lsV3L" target="_blank">This user’s avatar</a> (pictured above) on spigotmc.org is an altered image taken from the 1994 Quentin Tarantino cult hit “<a href="http://www.imdb.com/title/tt0110912/" target="_blank">Pulp Fiction</a>,” specifically from a scene in which the gangster characters Jules and Vincent are pointing their pistols in the same direction. However, the heads of both actors have been digitally altered to include someone else’s faces.</p>
<p>Pasted over the head of John Travolta&#8217;s character (left) is a real-life picture of Vyp0r &#8212; the Hackforums nickname of the guy that ProTraf’s Josiah White said threatened him into releasing the source code for Bashlite. On the shoulders of Samuel L. Jackson&#8217;s body is the face of <strong>Tucker Preston</strong>, co-founder of <a href="https://krebsonsecurity.com/tag/backconnect-llc/" target="_blank">BackConnect Security</a> &#8212; a competing DDoS mitigation provider that also <a href="https://krebsonsecurity.com/2016/09/ddos-mitigation-firm-has-history-of-hijacks/" target="_blank">has a history of hijacking Internet address ranges from other providers</a>.</p>
<p>Pictured below and to the left of Travolta and Jackson&#8217;s characters &#8212; seated on the bed behind them &#8212; is &#8220;Yamada,&#8221; a Japanese animation (&#8220;anime&#8221;) character featured in the anime movie <a href="https://myanimelist.net/anime/7817/B_Gata_H_Kei" target="_blank">B Gata H Hei</a>.</p>
<p>Turns out, there is a Dreadiscool user on <strong>MyAnimeList.net</strong>, a site where members proudly list the various anime films they have watched. Dreadiscool says B Gata H Kei is one <a href="https://myanimelist.net/animelist/dreadiscool?status=2" target="_blank">of nine anime film series he has watched</a>. Among the other eight? The anime series <a href="https://myanimelist.net/anime/10620/Mirai_Nikki_TV" target="_blank">Mirai Nikki</a>, from which the Mirai malware derives its name.</p>
<p><a href="https://www.reddit.com/user/dreadiscool/" target="_blank">Dreadiscool&#8217;s Reddit profile</a> also is very interesting, and most of the recent posts there relate to major DDoS attacks going on at the time, including a series of DDoS attacks on Rutgers University. More on Rutgers later.</p>
<h4>A CHAT WITH ANNA-SENPAI</h4>
<p>At around the same time as the record 620 Gbps attack on KrebsOnSecurity, French Web hosting giant <strong>OVH</strong> suffered an even larger attack &#8212; launched by the very same Mirai botnet used to attack this site. Although this fact has been widely reported in the news media, the reason for the OVH attack may not be so well known.</p>
<p>According to <a href="https://www.google.com/url?q=https%3A%2F%2Ftwitter.com%2Folesovhcom%2Fstatus%2F778832013503631360&amp;sa=D&amp;sntz=1&amp;usg=AFQjCNEo0a-EIU9DBdmGqRu0d6VSM0yEZw" target="_blank">a tweet</a> from OVH founder and chief technology officer <strong>Octave Klaba</strong>, the target of that massive attack also was a Minecraft server (although Klaba mistakenly called the target “mindcraft servers” in his tweet).</p>
<div id="attachment_37441" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/f7ad1827.klabatweet.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/klabatweet.png"><img class="wp-image-37441 size-medium" src="media/1c0388b1.klabatweet-580x367.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/klabatweet-580x367.png" alt="A tweet from OVH founder and CTO, stating the intended target of Sept. 2016 Mirai DDoS on his company." width="580" height="367" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/klabatweet-580x367.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/klabatweet-768x485.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/01/klabatweet-940x594.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/01/klabatweet.png 973w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A tweet from OVH founder and CTO, stating the intended target of Sept. 2016 Mirai DDoS on his company.</p></div>
<p>Turns out, in the days following the attack on this site and on OVH, Anna-Sempai had trained his Mirai botnet on Coelho’s ProxyPipe, completely knocking his DDoS mitigation service offline for the better part of a day and causing problems for many popular Minecraft servers.</p>
<p>Unable to obtain more bandwidth and unwilling to sign an expensive annual contract with a third-party DDoS mitigation firm, Coelho turned to the only other option available to get out from under the attack: Filing abuse complaints with the Internet hosting firms that were responsible for providing connectivity to the control server used to orchestrate the activities of the Mirai botnet.</p>
<p>“We did it because we had no other options, and because all of our customers were offline,” Coelho said. “Even though no other DDoS mitigation company was able to defend against these attacks [from Mirai], we still needed to defend against it because our customers were starting to move to other providers that attracted fewer attacks.”</p>
<p>After scouring a list of Internet addresses tied to bots used in the attack, Coelho said he was able to trace the control server for the Mirai botnet back to a hosting provider in Ukraine. That company &#8212; <strong>BlazingFast[dot]io</strong> &#8212; has <a href="https://fatalityforum.net/printthread.php?tid=6789" target="_blank">a reputation</a> for hosting botnet control networks.</p>
<p>Getting no love from BlazingFast, Coelho said he escalated his complaint to <strong>Voxility</strong>, a company that was providing DDoS protection to BlazingFast at the time.</p>
<p>“Voxility acknowledged the presence of the control server, and said they null-routed [removed] it, but they didn’t,” Coelho said. “They basically lied to us and didn’t reply to any other emails.”</p>
<p>Undeterred, Coelho said he then emailed the ISP that was upstream of BlazingFast, but received little help from that company or the next ISP further upstream. Coelho said the fifth ISP upstream of BlazingFast, however &#8212; Internet provider <strong>Telia Sonera</strong> &#8212; confirmed his report, and promptly had the Mirai botnet’s control server killed.</p>
<p>As a result, many of the systems infected with Mirai could no longer connect to the botnet’s control servers, drastically reducing the botnet’s overall firepower.</p>
<p>“The action by Telia cut the size of the attacks launched by the botnet down to 80 Gbps,” well within the range of ProxyPipe&#8217;s in-house DDoS mitigation capabilities, Coelho said.</p>
<p>Incredibly, on Sept. 28, Anna-Senpai himself would reach out to Coelho via Skype. Coelho shared a copy of that chat conversation with KrebsOnSecurity. The log shows that Anna correctly guessed ProxyPipe was responsible for the abuse complaints that kneecapped Mirai. Anna-Senpai said he guessed ProxyPipe was responsible after reading a comment on a KrebsOnSecurity blog post from a reader who shared the same username as Coelho’s business partner.</p>
<p>In the following chat, Coelho is using the Skype nickname “katie.onis.”</p>
<p>[10:23:08 AM] live:anna-senpai: ^<br />
[10:26:08 AM] katie.onis: hi there.<br />
[10:26:52 AM] katie.onis: How can I help you?<br />
[10:28:06 AM] live:anna-senpai: hi<br />
[10:28:45 AM] live:anna-senpai: you know i had my suspicions, but this one was proof</p>
<p><a href="http://imgur.com/E1yFJOp" target="_blank">http://imgur.com/E1yFJOp</a> [this is a benign/safe link to a screenshot of some comments on KrebsOnSecurity.com]</p>
<p>[10:28:59 AM] live:anna-senpai: don&#8217;t get me wrong, im not even mad, it was pretty funny actually. nobody has ever done that to my c2 [Mirai &#8220;command and control&#8221; server]<br />
[10:29:25 AM] live:anna-senpai: (goldmedal)<br />
[10:29:29 AM] katie.onis: ah you&#8217;re mistaken, that&#8217;s not us.<br />
[10:29:33 AM] katie.onis: but we know who it is<br />
[10:29:42 AM] live:anna-senpai: eric / 9gigs<br />
[10:29:47 AM] katie.onis: no, 9gigs is erik<br />
[10:29:48 AM] katie.onis: not eric<br />
[10:29:53 AM] katie.onis: different people<br />
[10:30:09 AM] live:anna-senpai: oh?<br />
[10:30:17 AM] katie.onis: yep<br />
[10:30:39 AM] live:anna-senpai: is he someone related to you guys?<br />
[10:30:44 AM] katie.onis: not related to us, we just know him<br />
[10:30:50 AM] katie.onis: anyway, we&#8217;re not interested in any harm, we simply don&#8217;t want attacks against us.<br />
[10:31:16 AM] live:anna-senpai: yeah i figured, i added you because i wanted to tip my hat if that was actually you lol<br />
[10:31:24 AM] katie.onis: we didn&#8217;t make that dumb post<br />
[10:31:26 AM] katie.onis: if that is what you are asking<br />
[10:31:30 AM] katie.onis: but yes, we were involved in doing that.<br />
[10:31:47 AM] live:anna-senpai: so you got it nulled, but some other eric is claiming credit for it?<br />
[10:31:52 AM] katie.onis: seems so.<br />
[10:31:52 AM] live:anna-senpai: eric with a c<br />
[10:31:56 AM] live:anna-senpai: lol<br />
[10:32:17 AM] live:anna-senpai: can&#8217;t say im surprised, tons of people take credit for things that they didn&#8217;t do if nobody else takes credit for<br />
[10:32:24 AM] katie.onis: we&#8217;re not interested in taking credit<br />
[10:32:30 AM] katie.onis: we just wanted the attacks to get smaller</p>
<h4>NOTICE AND TAKEDOWN</h4>
<p>One reason Anna-Senpai may have been enamored of Coelho&#8217;s approach to taking down Mirai is that Anna-Senpai had spent the previous month doing exactly the same thing to criminals running IoT botnets powered by Mirai&#8217;s top rival &#8212; Qbot.</p>
<p>A month before this chat between Coelho and Anna-Senpai, Anna is busy sending abuse complaints to various hosting firms, warning them that they are hosting huge IoT botnet control channels that needed to be shut down. This was clearly just part of an extended campaign by the Mirai botmasters to eliminate other IoT-based DDoS botnets that might compete for the same pool of vulnerable IoT devices. Anna confirmed this in his chat with Coelho:</p>
<p>[10:50:36 AM] live:anna-senpai: i have good killer so nobody else can assemble a large net<br />
[10:50:53 AM] live:anna-senpai: i monitor the devices to see for any new threats<br />
[10:51:33 AM] live:anna-senpai: and when i find any new host, i get them taken down</p>
<p>The ISPs or hosting providers that received abuse complaints from Anna-Senpai were all encouraged to reply to the email address <strong>ogmemes123123@gmail.com</strong> for questions and/or confirmation of the takedown. ISPs that declined to act promptly on Anna-Senpai&#8217;s Qbot email complaints soon found themselves on the receiving end of enormous DDoS attacks from Mirai.</p>
<p><strong>Francisco Dias</strong>, owner of hosting provider <strong>Frantech</strong>, found out firsthand what it would cost to ignore one of Anna&#8217;s abuse reports. In mid-September 2016, Francisco accidentally got into an Internet fight with Anna-Senpai.  The Mirai botmaster was using the nickname &#8220;<strong>jorgemichaels</strong>&#8221; at the time &#8212; and Jorgemichaels was talking trash on <strong>LowEndTalk.com</strong>, a discussion forum for vendors of low-costing hosting.</p>
<p>Specifically, Jorgemichaels <a href="https://www.lowendtalk.com/discussion/comment/1851848/#Comment_1851848" target="_blank">takes Francisco to task</a> publicly on the forum for ignoring one of his Qbot abuse complaints. Francisco tells Jorgemichaels to file a complaint with the police if it&#8217;s so urgent. Jorgemichaels tells Francisco to shut up, and when Francisco is silent for a while Jorgemichaels gloats that Francisco learned his place. Francisco explains his further silence on the thread by saying he&#8217;s busy supporting customers, to which Jorgemichaels replies, &#8220;Sounds like you just got a lot more customers to help. Don&#8217;t mess with the underworld francisco or it will harm your business.&#8221;</p>
<p>Shortly thereafter, Frantech is systematically knocked offline after being attacked by Mirai. Below is a fascinating snippet from a private conversation between Francisco and Anna-Senpai/Jorgemichaels, in which Francisco kills the reported Qbot control server to make Anna/Jorgemichaels call off the attack.</p>
<div id="attachment_37652" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/056f1924.gm-fran.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/gm-fran.png"><img class="wp-image-37652 size-medium" src="media/d0d6fd23.gm-fran-580x548.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/gm-fran-580x548.png" alt="Using the nickname &quot;jorgemichaels&quot; on LowEndTalk, Anna-Senpai reaches out to Francisco Dias after Dias ignores Anna's abuse complaint. Francisco agrees to kill the Qbot control server after being walloped with Mirai." width="580" height="548" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/gm-fran-580x548.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/gm-fran-768x725.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/01/gm-fran.png 895w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Using the nickname &#8220;jorgemichaels&#8221; on LowEndTalk, Anna-Senpai reaches out to Francisco Dias after Dias ignores Anna&#8217;s abuse complaint. Francisco agrees to kill the Qbot control server only after being walloped with Mirai.</p></div>
<p>Back to the chat between Anna-Senpai and Coelho at the end of Sept 2016.  Anna-Senpai tells Coelho that the attacks against ProxyPipe aren’t personal; they&#8217;re just business. Anna says he has been renting out “net spots” &#8212; sizable chunks of his Mirai botnet &#8212; to other hackers who use them in their own attacks for pre-arranged periods of time.</p>
<p>By way of example, Anna brags that as he and Coelho are speaking, the owners of a large Minecraft server were paying him to launch a crippling DDoS against <strong>Hypixel</strong>, currently the world&#8217;s <a href="http://minecraft-mp.com/servers/players/" target="_blank">most popular</a> Minecraft server. KrebsOnSecurity confirmed with Hypixel that they were <a href="https://hypixel.net/threads/network-issues-27th-30th-september-2016.876087/" target="_blank">indeed under a massive attack from Mirai between Sept. 27 and 30</a>.</p>
<p>[12:24:00 PM] live:anna-senpai: right now i just have a script sitting there hitting them for 45s every 20 minutes<br />
[12:24:09 PM] live:anna-senpai: enough to drop all players and make them rage</p>
<p>Coelho told KrebsOnSecurity that the on-again, off-again attack DDoS method that Anna described using against Hypixel was designed not just to cost Hypixel money. The purpose of that attack method, he said, was to aggravate and annoy Hypixel’s customers so much that they might take their business to a competing Minecraft server.</p>
<p>“It’s not just about taking it down, it’s about making everyone who is playing on that server crazy mad,” Coelho explained. “If you launch the attack every 20 minutes for a short period of time, you basically give the players just enough time to get back on the server and involved in another game before they’re disconnected again.”</p>
<p>Anna-Senpai told Coelho that paying customers also were the reason for the 620 Gbps attack on KrebsOnSecurity. Two weeks prior to that attack, I published the results of a months-long investigation revealing that “<strong>vDOS</strong>” &#8212; one of the largest and longest-running DDoS-for-hire services &#8212; <a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">had been hacked, exposing details about the services owners and customers</a>.</p>
<p>The story noted that vDOS earned its proprietors more than $600,000 and was being run by two 18-year-old Israeli men who went by the hacker aliases “applej4ck” and “p1st0”. Hours after that piece ran, <a href="https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/" target="_blank">Israeli authorities arrested both men</a>, and vDOS &#8212; which had been in operation for four years &#8212; was shuttered for good.</p>
<p>[10:47:42 AM] live:anna-senpai: i sell net spots, starting at $5k a week<br />
[10:47:50 AM] live:anna-senpai: and one client was upset about applejack arrest<br />
[10:48:01 AM] live:anna-senpai: so while i was gone he was sitting on them for hours with gre and ack<br />
[10:48:14 AM] live:anna-senpai: when i came back i was like oh fuck<br />
[10:48:16 AM] live:anna-senpai: and whitelisted the prefix<br />
[10:48:24 AM] live:anna-senpai: but then krebs tweeted that akamai is kicking them off<br />
[10:48:31 AM] live:anna-senpai: fuck me<br />
[10:48:43 AM] live:anna-senpai: he was a cool guy too, i like his article</p>
<p>[SIDE NOTE: If true, it&#8217;s ironic that someone would hire Anna-Senpai to attack my site in retribution for the vDOS story. That&#8217;s because the firepower behind applej4ck’s vDOS service was generated in large part by a botnet of IoT systems infected with a Qbot variant &#8212; the very same botnet strain that Anna-Senpai and Mirai were busy killing and erasing from the Internet.]</p>
<p>Coelho told KrebsOnSecurity that if his side of the conversation reads like he was being too conciliatory to his assailant, that’s because he was wary of giving Anna a reason to launch another monster attack against ProxyPipe. After all, Coelho said, the Mirai attacks on ProxyPipe caused many customers to switch to other Minecraft servers, and Coelho estimates the attack cost the company between $400,000 and $500,000.</p>
<p>Nevertheless, about halfway through the chat Coelho gently confronts Anna on the consequences of his actions.</p>
<p>[10:54:17 AM] katie.onis: People have a genuine reason to be unhappy though about large attacks like this<br />
[10:54:27 AM] live:anna-senpai: yeah<br />
[10:54:32 AM] katie.onis: There&#8217;s really nothing anyone can do lol<br />
[10:54:36 AM] live:anna-senpai: <img src="media/fd7c145d.1f61b.png" data-original-source="http://s.w.org/images/core/emoji/72x72/1f61b.png" alt="&#x1f61b;" class="wp-smiley" style="height: 1em; max-height: 1em;" /><br />
[10:54:38 AM] katie.onis: And it does affect their lives<br />
[10:55:10 AM] live:anna-senpai: well, i stopped caring about other people a long time ago<br />
[10:55:18 AM] live:anna-senpai: my life experience has always been get fucked over or fuck someone else over<br />
[10:55:52 AM] katie.onis: My experience with [ProxyPipe] thus far has been<br />
[10:55:54 AM] katie.onis: Do nothing bad to anyone<br />
[10:55:58 AM] katie.onis: And still get screwed over<br />
[10:55:59 AM] katie.onis: Haha</p>
<p>The two even discussed anime after Anna-Senpai guessed that Coelho might be a fan of the genre. Anna-Senpai says he watched the anime series &#8220;Gate,&#8221; a reference to the above-mentioned <a href="https://myanimelist.net/anime/7817/B_Gata_H_Kei" target="_blank">B Gata H Hei</a> that Dreadiscool included in the list of anime film series he&#8217;s watched. Anna also confirms that the name for his bot malware was derived from the anime series Mirai Nikki.</p>
<p>[5:25:12 PM] live:anna-senpai: i rewatched mirai nikki recently<br />
[5:25:22 PM] live:anna-senpai: (it was the reason i named my bot mirai lol)</p>
<h4>DREADISCOOL = ANNA = JHA?</h4>
<p>Coelho said when Anna-Senpai first reached out to him on Skype, he had no clue about the hacker’s real-life identity. But a few weeks after that chat conversation with Anna-Senpai, Coelho’s business partner (the Eric referenced in the first chat segment above) said he noticed that <a href="https://github.com/0x27/linux.mirai/blob/master/mirai/bot/attack_gre.c" target="_blank">some of the code in Mirai</a> looked awfully similar to code that Dreadiscool had <a href="https://github.com/dreadiscool/LastProxy/blob/master/src/network.c" target="_blank">posted to his Github account</a>.</p>
<p>“He started to come to the conclusion that maybe Anna was Paras,” Coelho said. “He gave me a lot of ideas, and after I did my own investigation I decided he was probably right.”</p>
<div id="attachment_37656" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/92ab05cd.MIRAIconnections.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/MIRAIconnections.png"><img class="wp-image-37656 size-medium" src="media/f5e33563.MIRAIconnections-580x459.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/MIRAIconnections-580x459.png" alt="An incomplete &quot;mindmap&quot; I put together as I started piecing together my research." width="580" height="459" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/MIRAIconnections-580x459.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/MIRAIconnections-768x607.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/01/MIRAIconnections-940x743.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/01/MIRAIconnections.png 1156w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">An incomplete &#8220;mindmap&#8221; I put together as I started to assemble research.</p></div>
<p>Coelho said he’s known Paras Jha for more than four years, having met him online when Jha was working for Minetime &#8212; which ProxyPipe was protecting from DDoS attacks at the time.</p>
<p>“We talked a lot back then and we used to program a lot of projects together,” Coelho said. “He’s really good at programming, but back then he wasn’t. He was a little bit behind, and I was teaching him most everything.”</p>
<p>According to Coelho, as Jha became more confident in his coding skills, he also grew more arrogant, belittling others online who didn’t have as firm a grasp on subjects such as programming and DDoS mitigation.</p>
<p><span class="pullquote pqright">“He likes to be recognized for his knowledge, being praised and having other people recognize that,” Coelho said of Jha. “He brags too much, basically.”</span></p>
<p>Coelho said not long after Minetime was hit by a DDoS extortion attack in 2013, Paras joined Hackforums and fairly soon after stopped responding to his online messages.</p>
<p>“He just kind of dropped off the face of the earth entirely,” he said. “When he started going on Hackforums, I didn’t know him anymore. He became a different person.”</p>
<p>Coelho said he doesn’t believe his old friend wished him harm, and that Jha was probably pressured into attacking ProxyPipe.</p>
<p>“In my opinion he’s still a kid, in that he gets peer-pressured a lot,” Coelho said. “If he didn’t [launch the attack] not only would he feel super excluded, but these people wouldn’t be his friends anymore, they could out him and screw him over. I think he was pretty much in a really bad position with the people he got involved with.”</p>
<h4>THE RUTGERS DDOS ATTACKS</h4>
<p>On Dec. 16, security vendor <strong>Digital Shadows</strong> presented <a href="https://youtu.be/gR4p95-xsHY?t=132" target="_blank">a Webinar</a> that focused on clues about the Mirai author’s real life identity. According to their analysis, before the Mirai author was known as Anna-Senpai on Hackforums, he used the nickname “Ogmemes123123” (this also was the alias of the Skype username that contacted Coelho), and the email address ogmemes123123@gmail.com (recall this is the same email address Anna-Senpai used in his alerts to various hosting firms about the urgent need to take down Qbot control servers hosted on their networks).</p>
<p>Digital Shadows noted that the Mirai author appears to have used another nickname: “OG_Richard_Stallman,” a likely reference to the <a href="https://en.wikipedia.org/wiki/Richard_Stallman" target="_blank">founder of the Free Software Foundation</a>. The ogmemes123123@gmail.com account was used to register <a href="https://www.facebook.com/profile.php?id=100012716136420&amp;fref=ts" target="_blank">a Facebook account in the name of OG_Richard Stallman</a>.</p>
<p>That Facebook account states that OG_Richard_Stallman began studying computer engineering at New Brunswick, NJ-based Rutgers University in 2015.</p>
<p>As it happens, Paras Jha is a student at Rutgers University. This is especially notable because Rutgers has been dealing with a series of DDoS attacks on its network since the fall semester of 2015 &#8212; more than a half dozen incidents in all. With each DDoS, the attacker would taunt the university in online posts and media interviews, encouraging the school to spend the money to purchase some kind of DDoS mitigation service.</p>
<p><a class="lightbox" href="media/91ab65a9.RUTGERSDDOS.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/RUTGERSDDOS.png"><img class="aligncenter wp-image-37428 size-medium" src="media/03dc4f5c.RUTGERSDDOS-580x430.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/RUTGERSDDOS-580x430.png" alt="rutgersddos" width="580" height="430" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/RUTGERSDDOS-580x430.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/RUTGERSDDOS-768x569.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/01/RUTGERSDDOS-940x697.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/01/RUTGERSDDOS.png 1238w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>Using the nicknames  &#8220;<a href="https://www.reddit.com/r/rutgers/comments/4qvc4g/ddos_on_rutgers/" target="_blank">og_richard_stallman</a>,&#8221; “<strong>exfocus</strong>” and “<strong>ogexfocus</strong>,” the person who attacked Rutgers more than a half-dozen times took to Reddit and <a href="http://www.twitter.com/ogexfocus" target="_blank">Twitter</a> to claim credit for the attacks. Exfocus even created his own <a href="https://www.reddit.com/r/rutgers/comments/3mnxyp/im_exfocus_ama/" target="_blank">“Ask Me Anything” interview</a> on Reddit to <a href="https://www.reddit.com/r/rutgers/comments/4qvc4g/ddos_on_rutgers/" target="_blank">discuss the Rutgers attacks</a>.</p>
<p>Exfocus also <a href="http://apollonsky.me/exfocus-take-down-rutgers/" target="_blank">gave an interview</a> to a New Jersey-based blogger, claiming he got paid $500 an hour to DDoS the university with as many as 170,000 bots. Here are a few snippets from that interview, in which he blames the attacks on a &#8220;client&#8221; who is renting his botnet:</p>
<blockquote><p>&#8220;<strong>Are you for real? Why would you do an interview with us if you’re getting paid?</strong></p>
<p>Normally I don’t show myself, but the entity paying me has something against the school. They want me to “make a splash”.</p>
<p><strong>Why do you have a twitter account where you publically broadcast patronizing messages. Are you worried that this increases the risk of things getting back to you?</strong></p>
<p>Public twitter is on clients request. The client hates the school for whatever reason. They told me to say generic things like that I hate the bus system and etc.</p>
<p><strong>Have you ever attacked RU before?</strong></p>
<p>During freshman registration the client requested it also – he didn’t want any publicity then though.</p>
<p><strong>What are your plans for the future in terms of DDOSing and attacking the Rutgers cyber infrastructure?</strong></p>
<p>When I stop getting paid – I’ll stop DDosing lol. I’m hoping that RU will sign on some ddos mitigation provider. I get paid extra if that happens.</p>
<p><strong>At some point you said you were at the Livingston student center – outside of Sbarro. In this interview you said that you aren’t affiliated directly with Rutgers, did you lie then?</strong></p>
<p>Yes&#8221;</p></blockquote>
<p>An online search for the Gmail address used by Anna-Senpai and OG_Richard_Stallman turns up a Pastebin post from July 1, 2016, in which <a href="https://archive.is/7088J" target="_blank">an anonymous Pastebin user creates a “dox” of OG_Richard_Stallman</a>. Doxing refers to the act of publishing someone’s personal information online and/or connecting an online alias to a real life identity.</p>
<p>The dox said OG_Richard_Stallman was connected to an address and phone number of an individual living in Turkey. But this is almost certainly a fake dox intended to confuse cybercrime investigators. Here&#8217;s why:</p>
<p>A Google search shows that this same address and phone number <a href="https://archive.is/T9OVm" target="_blank">showed up in another dox on Pastebin from almost three years earlier</a> &#8212; June 2013 &#8212; intended to expose or confuse the identity of a Hackforums user known as LiteSpeed. Recall that LiteSpeed is the same alias that ProTraf’s Josiah White acknowledged using on Hackforums.</p>
<h4>EXTORTION ATTEMPTS BY OG_RICHARD_STALLMAN</h4>
<p>This OG_Richard_Stallman identity is connected to Anna-Senpai by another person we&#8217;ve heard from already: Francisco Dias, whose Frantech ISP was attacked by Anna-Senpai and Mirai in mid-September. Francisco told KrebsOnSecurity that in early August 2016 he began receiving extortion emails from a Gmail address associated with a OG_Richard_Stallman.</p>
<p>&#8220;This guy using the Richard Stallman name added me on Skype and basically said &#8216;I&#8217;m going to knock all of your [Internet addresses] offline until you pay me&#8217;,&#8221; Dias recalled. &#8220;He told me the up front cost to stop the attack was 10 bitcoins [~USD $5,000 at the time], and if I didn&#8217;t pay within four hours after the attack started the fee would double to 20 bitcoins.&#8221;</p>
<p>Dias said he didn&#8217;t pay the demand and eventually OG_Richard_Stallman called off the attack. But he said for a while the attacks were powerful enough to cause problems for Frantech&#8217;s Internet provider.</p>
<p>&#8220;He was hitting us so hard with Mirai that he was dropping large parts of Hurricane Electric and causing problems at their Los Angeles point of presence,&#8221; Dias said. &#8220;I basically threw everything behind [DDoS mitigation provider] Voxility, and eventually Stallman buggered off.&#8221;</p>
<p>The OG_Richard_Stallman identity also was tied to similar extortion attacks at the beginning of August against one hosting firm that had briefly been one of ProTraf&#8217;s customers in 2016. The company declined to be quoted on the record, but said it stopped doing business with Protraf in mid-2016 because they were unhappy with the quality of service.</p>
<p>The Internet provider said not long after that it received an extortion demand from the &#8220;OG_Richard_Stallman&#8221; character for $5,000 in Bitcoin to avoid a DDoS attack. One of the company&#8217;s researchers contacted the extortionist via the ogmemes123123@gmail.com address supplied in the email, but posing as someone who wished to hire some DDoS services.</p>
<p>OG_Richard_Stallman told the researcher that he could guarantee 350 Gbps of attack traffic and that the target would go down or the customer would receive a full refund. The price for the attack? USD $100 worth of Bitcoin for every five minutes of attack time.</p>
<p>My source at the hosting company said his employer declined to pay the demand, and subsequently got hit with an attack from Mirai that clocked in at more than 300 Gbps.</p>
<p>&#8220;Clearly, the attacker is very technical, as they attacked every single [Internet address] within the subnet, and after we brought up protection, he started attacking upstream router interfaces,&#8221; the source said on condition of anonymity.</p>
<p>Asked who they thought might be responsible for the attacks, my source said his employer immediately suspected ProTraf. That&#8217;s because the Mirai attack also targeted the Internet address for the company&#8217;s home page, but that Internet address was hidden by DDoS mitigation firm Cloudflare. However, ProTraf knew about the secret address from its previous work with the company, the source explained.</p>
<p>&#8220;We believe it&#8217;s Protraf&#8217;s staff or someone related to Protraf,&#8221; my source said.</p>
<div id="attachment_37688" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/e5583c21.chatwithstallman.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/chatwithstallman.png"><img class="wp-image-37688 size-medium" src="media/e842178b.chatwithstallman-580x388.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/chatwithstallman-580x388.png" alt="A source at an Internet provider agreed to share information about an extortion demand his company received from Richard Stallman in August 2016. Here he is contacting Stallman directly and pretending to be someone interested in hiring Stallman/Anna-Senpai to attack others." width="580" height="388" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/chatwithstallman-580x388.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/chatwithstallman-768x514.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/01/chatwithstallman-940x629.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/01/chatwithstallman.png 1150w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A source at an Internet provider agreed to share information about an extortion demand his company received from OG_Richard_Stallman in August 2016. Here he is contacting the Stallman character directly and pretending to be someone interested in renting a botnet. Notice the source brazenly said he wanted to DDoS ProTraf.</p></div>
<h4>DDOS CONFESSIONS</h4>
<p>After months of gathering information about the apparent authors of Mirai, I heard from Ammar Zuberi, once a co-worker of ProTraf President Paras Jha.</p>
<p>Zuberi told KrebsOnSecurity that Jha admitted he was responsible for both Mirai and the Rutgers DDoS attacks. Zuberi said when he visited Jha at his Rutgers University dorm in October 2015, Paras bragged to him about launching the DDoS attacks against Rutgers.</p>
<p>&#8220;He was laughing and bragging about how he was going to get a security guy at the school fired, and how they raised school fees because of him,&#8221; Zuberi recalled.  &#8220;He didn&#8217;t really say why he did it, but I think he was just sort of experimenting with how far he could go with these attacks.&#8221;</p>
<p>Zuberi said he didn&#8217;t realize how far Jha had gone with his DDoS attacks until he confronted him about it late last year. Zuberi said he was on his way to see his grandmother in Arizona at the end of November 2016, and he had a layover in New York. So he contacted Jha and arranged to spend the night at Jha&#8217;s home in Fanwood, New Jersey.</p>
<p>As I noted in <a href="https://krebsonsecurity.com/2016/10/spreading-the-ddos-disease-and-selling-the-cure/" target="_blank">Spreading the DDoS Disease and Selling the Cure</a>, Anna-Senpai leaked the Mirai code on a domain name (santasbigcandycane[dot]cx) that was registered via <strong>Namecentral</strong>, an extremely obscure domain name registrar which had previously been used to register fewer than three dozen other domains over a three-year period.</p>
<p>According to Zuberi, only five people knew about the existence of Namecentral: himself, CJ Sculti, Paras Jha, Josiah White and Namecentral&#8217;s owner <strong>Jesse Wu</strong> (19-year-old Wu features prominently in the DDoS Disease story linked in the previous paragraph).</p>
<p><span class="pullquote pqleft">&#8220;When I saw that the Mirai code had been leaked on that domain at Namecentral, I straight up asked Paras at that point, &#8216;Was this you?,&#8217; and he smiled and said yep,&#8221; Zuberi recalled.</span> &#8220;Then he told me he&#8217;d recently heard from an FBI agent who was investigating Mirai, and he showed me some text messages between him and the agent. He was pretty proud of himself, and was bragging that he led the FBI on a wild goose chase.&#8221;</p>
<p>Zuberi said he hasn&#8217;t been in contact with Jha since visiting his home in November. Zuberi said he believes Jha wrote most of the code that Mirai uses to control the individual bot-infected IoT devices, since it was written in Golang and Jha&#8217;s partner White didn&#8217;t code well in this language. Zuberi said he thought White&#8217;s role was mainly in developing the spreading code used to infect new IoT devices with Mirai, since that was written in C &#8212; a language White excelled at.</p>
<p>In the time since most of the above occurred, the Internet address ranges previously occupied by ProTraf have been withdrawn. ProxyPipe&#8217;s Coelho said it could be that the ProTraf simply ran out of money.</p>
<p>ProTraf&#8217;s Josiah White explained the disappearance of ProTraf&#8217;s Internet space as part of an effort to reboot the company.</p>
<p>&#8220;We [are] in the process of restructuring and refocusing what we are doing,&#8221; White told KrebsOnSecurity.</p>
<p>Jha did not respond to requests for comment.</p>
<p>Rutgers University did not respond to requests for comment.</p>
<p>The FBI officials could not be immediately reached for comment.</p>
<p>A copy of the entire chat between Anna-Senpai and ProxyPipe&#8217;s Coelho is available <a href="https://krebsonsecurity.com/wp-content/uploads/2017/01/annasenpaichat.txt" target="_blank">here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=37808
title: ATM ‘Shimmers’ Target Chip-Based Cards
uri: ATM-Shimmers-Target-Chip-Based-Cards
url: https://krebsonsecurity.com/2017/01/atm-shimmers-target-chip-based-cards/
content:
<p>Several readers have called attention to <a href="http://coquitlam.bc.rcmp-grc.gc.ca/ViewPage.action?siteNodeId=2115&amp;languageId=1&amp;contentId=49796" target="_blank">warnings</a> coming out of Canada about a supposedly new form of card skimming called &#8220;shimming&#8221; that targets chip-based credit and debit cards. Shimming attacks are not new (KrebsOnSecurity first wrote about them <a href="https://krebsonsecurity.com/2015/08/chip-card-atm-shimmer-found-in-mexico/" target="_blank">in August 2015</a>), but they are likely to become more common as a greater number of banks in the United States shift to issuing chip-based cards. Here&#8217;s a brief primer on shimming attacks, and why they succeed.</p>
<div id="attachment_37814" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-37814" src="media/4c24376a.ca-shim-580x325.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/ca-shim-580x325.png" alt="Several shimmers recently found inside Canadian ATMs. Source: RCMP." width="580" height="325" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/ca-shim-580x325.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/ca-shim.png 758w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Several shimmers recently found inside Canadian point-of-sale devices. Source: RCMP.</p></div>
<p>Most skimming devices made to steal credit card data do so by recording the data stored in plain text on the magnetic stripe on the backs of cards. A shimmer, on the other hand, is so named because it acts a shim that sits between the chip on the card and the chip reader in the ATM or point-of-sale device — recording the data on the chip as it is read by the underlying machine.</p>
<p>Data collected by shimmers cannot be used to fabricate a chip-based card, but it could be used to clone a magnetic stripe card. Although the data that is typically stored on a card’s magnetic stripe is replicated inside the chip on chip-enabled cards, the chip contains an additional security components not found on a magnetic stripe.</p>
<p>One of those is a component known as an integrated circuit card verification value or “iCVV” for short &#8212; also known as a &#8220;dynamic CVV.&#8221; The iCVV differs from the card verification value (CVV) stored on the physical magnetic stripe, and protects against the copying of magnetic-stripe data from the chip and using that data to create counterfeit magnetic stripe cards.</p>
<div id="attachment_37813" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-37813" src="media/f5a2cfc9.ca-shim2-580x415.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/ca-shim2-580x415.png" alt="A close-up of a shimmer found on a Canadian ATM. Source: RCMP." width="580" height="415" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/ca-shim2-580x415.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/ca-shim2-768x549.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/01/ca-shim2-940x672.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/01/ca-shim2.png 969w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A close-up of a shimmer found inside a point-of-sale device in Canada. Source: RCMP.</p></div>
<p>The reason shimmers exist at all is that some banks have apparently not correctly implemented the chip card standard, known as EMV (short for Europay, Mastercard and Visa).</p>
<p>&#8220;The only way for this attack to be successful is if a [bank card] issuer neglects to check the CVV when authorizing a transaction,&#8221; ATM giant <strong>NCR Corp.</strong> wrote in a 2016 alert to customers. &#8220;All issuers MUST make these basic checks to prevent this category of fraud. Card Shimming is not a vulnerability with a chip card, nor with an ATM, and therefore it is not necessary to add protection mechanisms against this form of attack to the ATM.&#8221;<span id="more-37808"></span></p>
<p>Here&#8217;s a look at the shimmer I wrote about back in August 2015, which was discovered inside an ATM in Mexico.</p>
<div id="attachment_31892" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-31892" src="media/97b3b71f.shimalone-580x591.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/08/shimalone-580x591.png" alt="This card 'shimming' device is made to read chip-enabled cards and can be inserted directly into the ATM's card acceptance slot." width="580" height="591" srcset="http://krebsonsecurity.com/wp-content/uploads/2015/08/shimalone-580x591.png 580w, http://krebsonsecurity.com/wp-content/uploads/2015/08/shimalone.png 760w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">This card &#8216;shimming&#8217; device is made to read chip-enabled cards and can be inserted directly into the ATM&#8217;s card acceptance slot.</p></div>
<p>This shimming device was removed from an ATM in Europe in 2015:</p>
<div id="attachment_37812" style="width: 451px" class="wp-caption aligncenter"><img class="size-full wp-image-37812" src="media/881fdf22.shimmereast.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/shimmereast.png" alt="An ATM shimmer. Source: European ATM Security Team (EAST)." width="441" height="299" /><p class="wp-caption-text">An ATM shimmer. Source: European ATM Security Team (EAST).</p></div>
<p>Once you understand how stealthy these ATM fraud devices are, it’s difficult to use a cash machine without wondering whether the thing is already hacked. The truth is most of us probably have a better chance of getting physically mugged after withdrawing cash than encountering a skimmer in real life. However, here are a few steps we can all take to minimize the success of skimmer gangs.</p>
<p>-Cover the PIN pad while you enter your PIN.</p>
<p>-Keep your wits about you when you’re at the ATM, and avoid dodgy-looking and standalone cash machines in low-lit areas, if possible.</p>
<p>-Stick to ATMs that are physically installed in a bank. Stand-alone ATMs are usually easier for thieves to hack into.</p>
<p>-Be especially vigilant when withdrawing cash on the weekends; thieves tend to install skimming devices on a weekend — when they know the bank won’t be open again for more than 24 hours.</p>
<p>-Keep a close eye on your bank statements, and dispute any unauthorized charges or withdrawals immediately.</p>
<p>If you liked this piece and want to learn more about skimming devices, check out my series <a href="https://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers</a>.</p>


feed_id: https://krebsonsecurity.com/?p=37823
title: A Shakeup in Russia’s Top Cybercrime Unit
uri: A-Shakeup-in-Russia-s-Top-Cybercrime-Unit
url: https://krebsonsecurity.com/2017/01/a-shakeup-in-russias-top-cybercrime-unit/
content:
<p>A chief criticism I heard from readers of my book, <em><a href="https://www.amazon.com/Spam-Nation-Organized-Cybercrime---Epidemic/dp/1402295618/ref=sr_1_1?ie=UTF8&amp;qid=1400765293&amp;sr=8-1&amp;keywords=spam+nation" target="_blank">Spam Nation: The Inside Story of Organized Cybercrime</a></em>, was that it dealt primarily with petty crooks involved in petty crimes, while ignoring more substantive security issues like government surveillance and cyber war. But now it appears that the chief antagonist of <em>Spam Nation</em> is at the dead center of an international scandal involving the hacking of U.S. state electoral boards in Arizona and Illinois, the sacking of Russia&#8217;s top cybercrime investigators, and the slow but steady leak of unflattering data on some of Russia&#8217;s most powerful politicians.</p>
<div id="attachment_37848" style="width: 188px" class="wp-caption alignright"><img class="size-full wp-image-37848" src="media/e97ed646.mikhaylov.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/mikhaylov.png" alt="Sergey Mikhaylov" width="178" height="182" /><p class="wp-caption-text">Sergey Mikhaylov</p></div>
<p>In a major shakeup that could have lasting implications for transnational cybercrime investigations, it&#8217;s emerged that Russian authorities last month arrested <strong>Sergey Mikhaylov</strong> &#8212; the deputy chief of the country&#8217;s top anti-cybercrime unit &#8212; as well as <strong>Ruslan Stoyanov</strong>, a senior employee at Russian security firm <strong>Kaspersky Lab. </strong></p>
<p>In a statement released to media, Kaspersky said the charges against Stoyanov predate his employment at the company beginning in 2012. Prior to Kaspersky, Stoyanov served as deputy director at a cybercrime investigation firm called <strong>Indrik</strong>, and before that as a major in the Russian Ministry of Interior&#8217;s Moscow Cyber Crime Unit.</p>
<p>In a move straight out of a Russian spy novel, Mikhaylov reportedly was arrested while in the middle of a meeting, escorted out of the room with a bag thrown over his head. Both men are being tried for treason. As a result, the government&#8217;s case against them is classified, and it&#8217;s unclear exactly what they are alleged to have done.</p>
<p>However, many Russian media outlets now report that the men are suspected of leaking information to Western investigators about investigations, and of funneling personal and often embarrassing data on Russia&#8217;s political elite to <a href="http://www.bbc.co.uk/monitoring/russias-humpty-dumpty-blog-spills-the-beans" target="_blank">a popular blog</a> called Humpty Dumpty (<a href="https://b0ltai.org/" target="_blank">Шалтай-Болтай</a>).<span id="more-37823"></span></p>
<p>According to information obtained by KrebsOnSecurity, the arrests may very well be tied to a long-running grudge held by <strong>Pavel Vrublevsky</strong>, a Russian businessman who for years paid most of the world&#8217;s top spammers and virus writers to pump malware and hundreds of billions of junk emails into U.S. inboxes.</p>
<div id="attachment_37847" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/3a3b95c5.shaltay.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/shaltay.png"><img class="wp-image-37847 size-medium" src="media/2f59d889.shaltay-580x329.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/shaltay-580x329.png" alt="The Twitter page of the blog Shaltay Boltay (Humpty Dumpty)." width="580" height="329" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/shaltay-580x329.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/shaltay-768x435.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/01/shaltay.png 898w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The Twitter page of the blog Shaltay Boltay (Humpty Dumpty).</p></div>
<p>In September 2016, Arlington, Va.-based security firm <strong>ThreatConnect</strong> published a report that included Internet addresses that were used as staging grounds in the U.S. state election board hacks [full disclosure: ThreatConnect has been an advertiser on this blog]. That report was based in part on <a href="media/f364682a.boe_flash_aug_2016_final.pdf" data-original-source="https://s.yimg.com/dh/ap/politics/images/boe_flash_aug_2016_final.pdf" target="_blank">an August 2016 alert from the FBI</a> (PDF), and noted that most of the Internet addresses were assigned to a Russian hosting firm called <strong>King-Servers[dot]com</strong>.</p>
<p>King-Servers is owned by a 26-year-old Russian named <a href="https://www.nytimes.com/2016/09/28/world/europe/russia-hacker-vladimir-fomenko-king-servers.html" target="_blank">Vladimir Fomenko</a>. As I observed in this month&#8217;s <a href="https://krebsonsecurity.com/2017/01/the-download-on-the-dnc-hack/" target="_blank">The Download on the DNC Hack</a>, Fomenko issued a statement in response to being implicated in the ThreatConnect and FBI reports. Fomenko&#8217;s statement &#8212; written in Russian &#8212; said he did not know the identity of the hackers who used his network to attack U.S. election-related targets, but that those same hackers still owed his company USD $290 in unpaid server bills.</p>
<p>A English-language translation of that statement was <a href="https://chronopay.com/blog/2016/09/15/chronopay-pomogaet-king-servers-com/" target="_blank">simultaneously published</a> on <strong>ChronoPay.com</strong>, Vrublevsky&#8217;s payment processing company.</p>
<p>“The analysis of the internal data allows King Servers to confidently refute any conclusions about the involvement of the Russian special services in this attack,” Fomenko said in his statement, which credits ChronoPay for the translation. “The company also reported that the attackers still owe the company $US290 for rental services and King Servers send an invoice for the payment to Donald Trump &amp; Vladimir Putin, as well as the company reserves the right to send it to any other person who will be accused by mass media of this attack.”</p>
<div id="attachment_37849" style="width: 211px" class="wp-caption alignleft"><img class=" wp-image-37849" src="media/031e56f3.vrub-jan27.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/vrub-jan27.png" alt="ChronoPay founder and owner Pavel Vrublevsky." width="201" height="331" /><p class="wp-caption-text">ChronoPay founder and owner Pavel Vrublevsky.</p></div>
<p>I mentioned Vrublevsky in that story because I knew Fomenko (a.k.a. &#8220;<a href="media/9602fa93.KingServersCrutop.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/KingServersCrutop.png" target="_blank">Die$el</a>&#8220;) and he were longtime associates; both were prominent members of <strong>Crutop[dot]nu</strong>, a cybercrime forum that Vrublevsky (a.k.a. &#8220;<a href="https://krebsonsecurity.com/2011/06/organization-chart-reveals-chronopay%E2%80%99s-links-to-shady-internet-projects/" target="_blank">Redeye</a>&#8220;) owned and operated for years. In addition, I recognized Vrublevsky&#8217;s voice and dark humor in the statement, and thought it was interesting that Vrublevsky was inserting himself into all the alleged election-hacking drama.</p>
<p>That story also noted how common it was for Russian intelligence services to recruit Russian hackers who were already in prison &#8212; by commuting their sentences in exchange for helping the government hack foreign adversaries. In 2013, Vrublevsky was <a href="https://www.google.com/url?sa=t&amp;rct=j&amp;q=&amp;esrc=s&amp;source=web&amp;cd=1&amp;cad=rja&amp;uact=8&amp;ved=0ahUKEwj1gdq6-OXRAhUTziYKHRjVC0kQFggbMAA&amp;url=https%3A%2F%2Fkrebsonsecurity.com%2F2013%2F08%2Fpavel-vrublevsky-sentenced-to-2-5-years%2F&amp;usg=AFQjCNF3oRge-uitJfeLr0cTLQb8GbOGMg&amp;sig2=-cUyK7-I7swu7YY6JZyYBg&amp;bvm=bv.145822982,d.eWE" target="_blank">convicted</a> of <a href="https://krebsonsecurity.com/2012/06/who-is-the-festi-botmaster/" target="_blank">hiring his most-trusted spammer</a> and malware writer to attack one of ChronoPay&#8217;s chief competitors, but he was inexplicably released a year earlier than his two-and-a-half year sentence required.</p>
<p>Meanwhile, the malware author that Vrublevsky hired to launch the attack which later landed them both in jail <a href="https://www.nytimes.com/2016/12/29/world/europe/how-russia-recruited-elite-hackers-for-its-cyberwar.html?_r=0" target="_blank">told <em>The New York Times</em></a> last month that he&#8217;d also been approached while in prison by someone offering to commute his sentence if he agreed to hack for the Russian government, but that he&#8217;d refused and was forced to serve out his entire sentence.</p>
<p>My book <em>Spam Nation</em> <a href="https://krebsonsecurity.com/?s=pharma+wars+botmaster&amp;x=0&amp;y=0" target="_blank">identified most of the world&#8217;s top spammers and virus writers by name</a>, and I couldn&#8217;t have done that had someone in Russian law enforcement not leaked to me and to the FBI tens of thousands of email messages and documents <a href="https://krebsonsecurity.com/2010/12/russian-e-payment-giant-chronopay-hacked/" target="_blank">stolen</a> from ChronoPay&#8217;s offices.</p>
<p>To this day I don&#8217;t know the source of those stolen documents and emails. They included spreadsheets chock full of bank account details tied to some of the world&#8217;s most active cybercriminals, and to <a href="media/b5e62180.CPcompanies.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2011/11/CPcompanies.png" target="_blank">a vast network of shell corporations</a> created by Vrublevsky and ChronoPay to <a href="https://krebsonsecurity.com/2010/05/following-the-money-part-ii/" target="_blank">help launder the proceeds from his pharmacy, spam and fake antivirus operations</a>.</p>
<p>Fast-forward to this past week: Multiple Russian media outlets covering the treason case <a href="https://www.novayagazeta.ru/articles/2017/01/26/71296-troyanskiy-kod" target="_blank">mention</a> that King-Servers and its owner Fomenko rented the servers from a Dutch company controlled by Vrublevsky.</p>
<p>Both Fomenko and Vrublevsky deny this, but the accusations got me looking more deeply through my huge cache of leaked ChronoPay emails for any mention of Mikhaylov or Stoyanov &#8212; the cybercrime investigators arrested in Russia last week and charged with treason. I also looked because in phone interviews in 2011 Vrublevsky told me he suspected both men were responsible for leaking his company&#8217;s emails to me, to the FBI, and to <strong>Kimberly Zenz</strong>, a senior threat analyst who works for the security firm <strong>iDefense </strong>(now owned by <strong>Verisign</strong>).</p>
<p>In that conversation, Vrublevsky said he was convinced that Mikhaylov was taking information gathered by Russian government cybercrime investigators and feeding it to U.S. law enforcement and intelligence agencies and to Zenz. Vrublevsky told me then that if ever he could prove for certain Mikhaylov was involved in leaking incriminating data on ChronoPay, he would have someone &#8220;tear him a new asshole.&#8221;</p>
<p>As it happens, an email that Vrublevsky wrote to a ChronoPay employee in 2010 eerily presages the arrests of Mikhaylov and Stoyanov, voicing Vrublevsky&#8217;s suspicion that the two men were closely involved in leaking ChronoPay emails and documents <em>that were seized by Mikhaylov&#8217;s own division</em> &#8212; the <strong>Information Security Center</strong> (CDC) of the Russian <strong>Federal Security Service</strong> (FSB). A copy of that email is shown in Russian in the screen shot below. A translated version of the message text is available <a href="media/7ec8de8b.CPemailtranslated.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/01/CPemailtranslated.pdf" target="_blank">here</a> (PDF).</p>
<div id="attachment_37811" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/1929204a.Psha-mikh.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/Psha-mikh.png"><img class="wp-image-37811 size-medium" src="media/1159a246.Psha-mikh-580x214.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/Psha-mikh-580x214.png" alt="A copy of an email Vrublevsky sent to a ChronoPay co-worker about his suspicions that Mikhaylov and Stoyanov were leaking government secrets." width="580" height="214" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/Psha-mikh-580x214.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/Psha-mikh-768x283.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/01/Psha-mikh-940x346.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/01/Psha-mikh.png 1276w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A copy of an email Vrublevsky sent to a ChronoPay co-worker about his suspicions that Mikhaylov and Stoyanov were leaking government secrets.</p></div>
<p>In it, Vrublevsky claims Zenz was dating a Russian man who worked with Stoyanov at Indrik &#8212; the company that both men worked at before joining Kaspersky &#8212; and that Stoyanov was feeding her privileged information about important Russian hackers.</p>
<p>&#8220;Looks like Sergey and Ruslan were looking for various &#8216;scapegoats&#8217; who were easy to track down and who had a lot of criminal evidence collected against them, and then reported them to iDefense through Kimberly,&#8221; Vrublevsky wrote to a ChronoPay subordinate in an email dated Sept. 11, 2010. &#8220;This was done so that iDefense could get some publicity for themselves by turning this into a global news story. Then the matter was reported by US intelligence to Russia, and then got on Sergey&#8217;s desk who made a big deal out of it and then solved the case brilliantly, gaining favors with his bosses. iDefense at the same time was getting huge grants to fight Russian cyberthreats.&#8221;</p>
<p>Based on how long Vrublevsky has been <a href="http://www.redeye-blog.com/news/eng/fsbcibsereja-eto-prosto-kladez-znanij-kakoj-to.html" target="_blank">trying to sell this narrative</a>, it seems he may have <a href="https://krebsonsecurity.com/2011/08/pharma-wars-purchasing-protection/" target="_blank">finally found a buyer</a>.</p>
<p>Verisign&#8217;s Zenz said she did date a Russian man who worked with Stoyanov, but otherwise called Vrublevsky&#8217;s accusations a fabrication. Zenz said she&#8217;s uncertain if Vrublevsky has enough political clout to somehow influence the filing of a treason case against the two men, but that she suspects the case has more to do with ongoing and very public recent infighting within the Russian FSB.</p>
<p>“It is hard for me imagine how Vrublevsky would be so powerful as to go after the people that investigated him on his own,&#8221; Zenz told KrebsOnSecurity. &#8220;Perhaps the infighting going on right now among the security forces already weakened Mikhaylov enough that Vrublevsky was able to go after him. Leaking communications or information to the US is a very extreme thing to have done. However, if it really did happen, then Mikhaylov would be very weak, which could explain how Vrublevsky would be able to go after him.”</p>
<p>Nevertheless, Zenz said, the Russian government&#8217;s treason case against Mikhaylov and Stoyanov is likely to have a chilling effect on the sharing of cyber threat information among researchers and security companies, and will almost certainly create problems for Kaspersky&#8217;s image abroad.</p>
<p>“This really weakens the relationship between Kaspersky and the FSB,&#8221; Zenz said. &#8220;It pushes Kaspersky to formalize relations and avoid the informal cooperation upon which cybercrime investigations often rely, in Russia and globally. It is also likely to have a chilling effect on such cooperation in Russia. This makes people ask, “If I share information on an attack or malware, can I be charged with treason?&#8217;”</p>
<p>Vrublevsky declined to comment for this story. King Servers&#8217; Fomenko could not be immediately reached for comment.</p>


feed_id: https://krebsonsecurity.com/?p=37821
title: Shopping for W2s, Tax Data on the Dark Web
uri: Shopping-for-W2s-Tax-Data-on-the-Dark-Web
url: https://krebsonsecurity.com/2017/01/shopping-for-w2s-tax-data-on-the-dark-web/
content:
<p>The 2016 tax season is now in full swing in the United States, which means scammers are once again assembling vast dossiers of personal data and preparing to file fraudulent tax refund requests on behalf of millions of Americans. But for those lazy identity thieves who can&#8217;t be bothered to phish or steal the needed data, there is now another option: Buying stolen W-2 tax forms from other crooks who have phished the documents wholesale from corporations.</p>
<div id="attachment_37912" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/ff9b6f83.w2shop-140.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/w2shop-140.png"><img class="wp-image-37912 size-medium" src="media/fd2cee1c.w2shop-140-580x487.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/w2shop-140-580x487.png" alt="A cybercriminal shop selling 2016 W-2 tax data." width="580" height="487" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/w2shop-140-580x487.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/w2shop-140-768x645.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/01/w2shop-140-940x790.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/01/w2shop-140.png 1107w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A cybercriminal shop selling 2016 W-2 tax data.</p></div>
<p>Pictured in the screenshot above is a cybercriminal shop which sells the usual goods &#8212; stolen credit card data, PayPal account logins, and access to hacked computers. But hidden beneath the &#8220;other&#8221; category of goods for sale by this fraud bazaar is an option I&#8217;ve not previously encountered on these ubiquitous, cookie-cutter stores: A menu item advertising &#8220;W-2 2016.&#8221;</p>
<p>This particular shop &#8212; the name of which is being withheld so as not to provide it with free advertising &#8212; currently includes raw W-2 tax form data on more than 3,600 Americans, virtually all of whom apparently reside in Florida. The data in each record includes the taxpayer&#8217;s employer name, employer ID, address, taxpayer address, Social Security number and information about 2016 wages and taxes withheld.</p>
<p>Each W-2 record costs the <strong>Bitcoin</strong> equivalent of between $4 and $20. W-2 records for employees with higher-than-average wages in the 2016 tax year cost more, ostensibly because thieves stand to reap a higher tax refund from those W-2&#8217;s if they successfully trick the <strong>Internal Revenue Service</strong> and/or the states into approving a fraudulent refund in the victim&#8217;s name.</p>
<p>Tax refund fraud affects hundreds of thousands, if not millions, of U.S. citizens annually. Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. <span class="pullquote pqright">Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS.</span></p>
<p>Tax data can be phished directly from consumers via phony emails spoofing the IRS or employers. But more often, the information is stolen in bulk from employers. In a typical scenario, the thieves target people who work in HR and payroll departments at corporations, and <a href="https://krebsonsecurity.com/2016/02/phishers-spoof-ceo-request-w2-forms/" target="_blank">spoof an email from a higher-up</a> in the company asking for all employee W-2 data to be included in a single file and emailed immediately.</p>
<p>Incredibly, this scam tricks countless organizations into giving away all employee W-2 data directly to identity thieves who use it (or, in this case, sell it) for tax refund fraud. Earlier this month, solar panel maker <strong>Sunrun</strong> <a href="http://www.sfgate.com/business/article/Sunrun-hack-nabs-employee-W-2-tax-forms-10889441.php" target="_blank">disclosed</a> that a spear phishing attack exposed W-2 tax form data on more than 3,400 employees.</p>
<p>In this case, however, it does not appear the cybercrime shop obtained the W-2&#8217;s through phishing employers. It cost roughly $25 worth of Bitcoin to reveal the likely common thread among all 3,600+ Floridians being exploited by this shop: A local tax preparation firm that got hacked or phished.<span id="more-37821"></span></p>
<p>Two tax records that a source purchased from the shop listed <strong>Kirai Restaurant Group LLC</strong> in Fort Lauderdale, Fla. <strong>Kirsta Grauberger</strong>, managing partner of that organization&#8217;s physical property &#8212; the Market 17 &amp; Day Market Kitchen &#8212; confirmed that the two W-2 records were tied to two employees.</p>
<p>But Grauberger said her company has employed fewer than 150 employees total since it opened for business six years ago. So which other company or companies account for the remaining 3,450 employees whose W-2 are for sale by this shop?</p>
<p>Grauberger told KrebsOnSecurity that her firm doesn&#8217;t even handle employee tax forms, and that her company outsourced that entire process to a local tax preparation firm called <strong>The Payroll Professionals</strong>.</p>
<p>W-2 information also was on sale for employees of a doctor&#8217;s office in Boca Raton, Fla. The medical office told KrebsOnSecurity that it, too, managed its payroll through the same third-party payroll management firm.</p>
<p>A man answering the phone at Payroll Professionals who would only give his name as &#8220;Robert&#8221; said the company was &#8220;aware of the potential hacking&#8221; and was in the process of informing its clients.</p>
<p>According to <a href="http://krebsonsecurity.com/2016/01/ftc-tax-fraud-behind-47-spike-in-id-theft/" target="_blank">recent stats</a> from the <strong>Federal Trade Commission</strong>, tax refund fraud was responsible for a nearly 50 percent increase in consumer identity theft complaints in 2015. <em>The best way to avoid becoming a victim of tax refund fraud is to file your taxes before the fraudsters can.</em></p>
<p>See last year&#8217;s <a href="http://krebsonsecurity.com/2015/12/dont-be-a-victim-of-tax-refund-fraud-in-16/" target="_blank">Don’t Be A Victim of Tax Refund Fraud in ’16</a> for more tips on avoiding this ID theft headache. But here are the main takeaways from that story:</p>
<p><strong>-File before the fraudsters do it for you</strong> – Your primary defense against becoming the next victim is to file your taxes at the state and federal level as quickly as possible. Remember, it doesn’t matter whether or not the IRS owes you money: Thieves can still try to impersonate you and claim that they do, leaving you to sort out the mess with the IRS later.</p>
<p><strong>-Get on a schedule to request a free copy of your credit report.</strong> By law, consumers are entitled to a free copy of their report from each of the major bureaus once a year. Put it on your calendar to request a copy of your file every three to four months, each time from a different credit bureau. Dispute any unauthorized or suspicious activity. This is where credit monitoring services are useful: Part of their service is to help you sort this out with the credit bureaus, so if you’re signed up for credit monitoring make them do the hard work for you.</p>
<p>–<strong>Monitor, then freeze.</strong> Take advantage of any free credit monitoring available to you, and <a href="http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">then freeze your credit file</a> with the four major bureaus. A freeze can help you stop ID thieves from opening new lines of credit in your name. <a href="http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">Instructions for doing that are here</a>. However, note that neither a credit freeze nor credit monitoring will stop ID thieves from filing a fraudulent refund request with the IRS in your name. Again, your best bet to prevent this is to file your taxes before the fraudsters can do it for you.</p>
<p><strong>-File form 14039 and request an IP PIN from the government.</strong> This form requires consumers to state they believe they’re likely to be victims of identity fraud. Even if thieves haven’t tried to file your taxes for you yet, virtually all Americans have been touched by incidents that could lead to ID theft — even if we just look at breaches announced in the past year alone.</p>


feed_id: https://krebsonsecurity.com/?p=37923
title: IRS: Scam Blends CEO Fraud, W-2 Phishing
uri: IRS-Scam-Blends-CEO-Fraud-W-2-Phishing
url: https://krebsonsecurity.com/2017/02/irs-scam-blends-ceo-fraud-w-2-phishing/
content:
<p>Most regular readers here are familiar with <strong>CEO fraud</strong> &#8212; e-mail scams in which the attacker spoofs the boss and tricks an employee at the organization into wiring funds to the fraudster. Loyal readers also have heard an earful about <strong>W-2 phishing</strong>, in which crooks impersonate the boss and request a copy of all employee tax forms. According to a new &#8220;urgent alert&#8221; issued by the <strong>U.S. Internal Revenue Service</strong>, scammers are now combining both schemes and targeting a far broader range of organizations than ever before.</p>
<p><img class="alignright size-full wp-image-37128" src="media/482749be.athook.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/athook.png" alt="athook" width="194" height="375" />The IRS said phishers are off to a much earlier start this year than in tax years past, trying to siphon W-2 data that can be used to file fraudulent refund requests on behalf of taxpayers. The agency warned that thieves also appear to be targeting a wider range of organizations in these W-2 phishing schemes, including school districts, healthcare organizations, chain restaurants, temporary staffing agencies, tribal organizations and nonprofits.</p>
<p>Perhaps because they are already impersonating the boss, the W-2 phishers feel like they&#8217;re leaving money on the table if they don&#8217;t also try to loot the victim organization&#8217;s treasury: According to the IRS, W-2 phishers very often now follow up with an “executive” email to the payroll or comptroller requesting that a wire transfer be made to a certain account.</p>
<p>&#8220;This is one of the most dangerous email phishing scams we&#8217;ve seen in a long time,&#8221; IRS Commissioner <strong>John Koskinen</strong> said. &#8220;Although not tax related, the wire transfer scam is being coupled with the W-2 scam email, and some companies have lost both employees’ W-2s and thousands of dollars.&#8221;</p>
<p>The <strong>Federal Bureau of Investigation</strong> (FBI) has been keeping a running tally of the financial devastation visited on companies via CEO fraud scams. In June 2016, the FBI <a href="https://www.ic3.gov/media/2016/160614.aspx" target="_blank">estimated</a> that crooks had stolen nearly $3.1 billion from more than 22,000 victims of these wire fraud schemes.</p>
<p>First surfacing <a href="https://krebsonsecurity.com/2016/02/phishers-spoof-ceo-request-w2-forms/" target="_blank">in February 2016</a>, the W-2 phishing scams also have netted thieves plenty of victims. At one point last year I was hearing from almost one new W-2 phishing victim each day. Some of the more prominent companies victimized by W-2 scams last year included <a href="https://krebsonsecurity.com/2016/03/seagate-phish-exposes-all-employee-w-2s/" target="_blank">Seagate Technology</a>, <a href="https://krebsonsecurity.com/2016/03/thieves-phish-moneytree-employee-tax-data/" target="_blank">Moneytree</a>, <a href="https://krebsonsecurity.com/2016/03/phishing-victims-muddle-tax-fraud-fight/" target="_blank">Sprouts Farmer&#8217;s Market, and EWTN Global Catholic Network</a>.<span id="more-37923"></span></p>
<p>As noted earlier this week, scammers also <a href="https://krebsonsecurity.com/2017/01/shopping-for-w2s-tax-data-on-the-dark-web/" target="_blank">are now selling 2016 employee W-2 forms</a> that were phished or otherwise stolen from victim organizations, peddling individual W-2 tax records for between $4 and $20 apiece.</p>
<p>Tax refund fraud affects hundreds of thousands, if not millions, of U.S. citizens annually. Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. <span class="pullquote pqleft">Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS.</span></p>
<p>The IRS says organizations receiving a W-2 scam email should forward it to <a href="mailto:phishing@irs.gov">phishing@irs.gov</a> and place “W2 Scam” in the subject line. Organizations that receive the scams or fall victim to them should file a complaint with the <a href="https://www.ic3.gov/default.aspx" target="_blank">Internet Crime Complaint Center</a> (IC3,) operated by the FBI.</p>
<p>Employees whose Forms W-2 have been stolen should review the recommended actions by the Federal Trade Commission at <a href="http://www.identitytheft.gov" target="_blank">www.identitytheft.gov</a> or the IRS at <a href="http://www.irs.gov/identitytheft" target="_blank">www.irs.gov/identitytheft</a>. Employees should file a <a href="media/d356facd.f14039.pdf" data-original-source="https://www.irs.gov/pub/irs-pdf/f14039.pdf" target="_blank">Form 14039</a> (PDF) Identity Theft Affidavit, if the employee’s own tax return rejects because of a duplicate Social Security number or if instructed to do so by the IRS.</p>
<p>W-2 forms are prized by ID thieves because they feature virtually all of the data needed to file a fraudulent tax refund request with the IRS in a victim&#8217;s name, including the employer name, employer ID, address, taxpayer address, Social Security number and information about 2016 wages and taxes withheld.</p>
<p>According to <a href="http://krebsonsecurity.com/2016/01/ftc-tax-fraud-behind-47-spike-in-id-theft/" target="_blank">recent stats</a> from the <strong>Federal Trade Commission</strong>, tax refund fraud was responsible for a nearly 50 percent increase in consumer identity theft complaints in 2015. <em>The best way to avoid becoming a victim of tax refund fraud is to file your taxes before the fraudsters can. </em></p>
<p>The FBI urges businesses to adopt two-step or two-factor authentication for email, where available, and to establish other communication channels — such as telephone calls — to verify significant banking transactions. Businesses are also advised to exercise restraint when publishing information about employee activities on their Web sites or through social media, as attackers perpetrating CEO fraud schemes often will try to discover information about when executives at the targeted organization will be traveling or otherwise out of the office.</p>


feed_id: https://krebsonsecurity.com/?p=37945
title: How Google Took on Mirai, KrebsOnSecurity
uri: How-Google-Took-on-Mirai-KrebsOnSecurity
url: https://krebsonsecurity.com/2017/02/how-google-took-on-mirai-krebsonsecurity/
content:
<p>The third week of September 2016 was a dark and stormy one for KrebsOnSecurity. Wave after wave of huge denial-of-service attacks flooded this site, forcing me to pull the plug on it until I could secure protection from further assault. The site resurfaced three days later under the aegis of <strong>Google&#8217;s Project Shield</strong>, an initiative which seeks to protect journalists and news sites from being <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank">censored</a> by these crippling digital sieges.</p>
<p><strong>Damian Menscher</strong>, a Google security engineer with whom I worked very closely on the migration to Project Shield, spoke this week about the unique challenges involved in protecting a small site like this one from very large, sustained and constantly morphing attacks.</p>
<div id="attachment_37947" style="width: 523px" class="wp-caption aligncenter"><img class="size-full wp-image-37947" src="media/b1d3883b.menscher-risher.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/menscher-risher.png" alt="Google Security Reliability Engineer Damian Menscher speaking at the Enigma conference this week. Photo: @mrisher" width="513" height="583" /><p class="wp-caption-text">Google Security Reliability Engineer Damian Menscher speaking at the Enigma conference this week. Photo: @mrisher</p></div>
<p>Addressing the <a href="https://www.usenix.org/conference/enigma2017" target="_blank">Enigma 2017 security conference</a> in Oakland, Calif., Menscher said his team only briefly considered whether it was such a good idea to invite a news site that takes <a href="https://krebsonsecurity.com/?s=ddos-for-hire&amp;x=0&amp;y=0" target="_blank">frequent swings</a> at the DDoS-for-hire industry.</p>
<p>&#8220;What happens if this botnet actually takes down google.com and we lose all of our revenue?&#8221; Menscher recalled. &#8220;But we considered [that] if the botnet can take us down, we&#8217;re probably already at risk anyway. There&#8217;s nothing stopping them from attacking us at any time. So we really had nothing to lose here.&#8221;<span id="more-37945"></span></p>
<p>Ars Technica&#8217;s <strong>Dan Goodin</strong> was at the Engima conference and filed this report:</p>
<blockquote><p>&#8220;It took only about an hour for Menscher&#8217;s team to arrive at the decision to help Krebs. A much more lengthy process involved actually admitting KrebsOnSecurity into Project Shield&#8230;A key requirement for admittance is that the person requesting service proves they have control over the site. Because KrebsOnSecurity was down at that moment, Krebs was unable to satisfy this requirement.</p>
<p>Making matters worse, the domain-name system settings KrebsOnSecurity used had been locked to thwart the attempted domain hijacking attacks that regularly targeted the site. That prevented Krebs from showing he had control of the site&#8217;s DNS settings.</p>
<p>Once Project Shield ultimately got KrebsOnSecurity back online, it took just 14 minutes for the attacks to resume.&#8221;</p></blockquote>
<p>For more, check out Dan Goodin&#8217;s excellent piece, <a href="https://arstechnica.com/security/2017/02/how-google-fought-back-against-a-crippling-iot-powered-botnet-and-won/" target="_blank">How Google Fought Back Against a Crippling IoT-Powered Botnet and Won</a>. And a rolling thanks to Damian (a true mensch) and to Project Shield for deflecting the evil bits.</p>
<p>For more background on the botnet responsible for knocking this site offline, see <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank">Who is Anna-Senpai, the Mirai Worm Author?</a></p>


feed_id: https://krebsonsecurity.com/?p=37956
title: InterContinental Confirms Breach at 12 Hotels
uri: InterContinental-Confirms-Breach-at-12-Hotels
url: https://krebsonsecurity.com/2017/02/intercontinental-confirms-breach-at-12-hotels/
content:
<p><strong>InterContinental Hotels Group (IHG)</strong>, the parent company for thousands of hotels worldwide including <strong>Holiday Inn</strong>, acknowledged Friday that a credit card breach impacted at least a dozen properties nationwide. News of the breach was <a href="https://krebsonsecurity.com/2016/12/holiday-inn-parent-ihg-probes-breach-claims/" target="_blank">first reported</a> by KrebsOnSecurity more than a month ago.</p>
<div id="attachment_37957" style="width: 300px" class="wp-caption alignright"><img class=" wp-image-37957" src="media/0e7f60aa.topofmark.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/topofmark.png" alt="Top of the Mark, San Francisco, one of the bars impacted by the IHG card breach." width="290" height="292" /><p class="wp-caption-text">Top of the Mark, San Francisco, one of the bars impacted by the IHG card breach.</p></div>
<p>In <a href="http://www.prnewswire.com/news-releases/ihg-notifies-guests-of-payment-card-incident-at-12-properties-in-the-americas-300401996.html" target="_blank">a statement</a> issued late Friday, IHG said it found malicious software installed on point of sale servers at restaurants and bars of 12 IHG-managed properties between August and December 2016. The stolen data included information stored on the magnetic stripe on the backs of customer credit and debit cards &#8212; the cardholder name, card number, expiration date, and internal verification code.</p>
<p>A list of the known breached locations is <a href="https://www.ihg.com/content/us/en/customer-care/protecting-our-guests" target="_blank">here</a>. IHG said cards used at the front desk of these properties were not affected.</p>
<p>According to IHG, we may not yet know the full scope of this breach: The company advised that its investigation into other properties in the Americas region is ongoing.</p>
<p>Card-stealing cyber thieves have broken into some of the largest hotel chains over the past few years. Hotel brands that have acknowledged card breaches over the last year after prompting by KrebsOnSecurity include <a href="https://krebsonsecurity.com/2016/09/kimpton-hotels-acknowledges-data-breach/" target="_blank">Kimpton Hotels</a>, <a href="http://krebsonsecurity.com/2015/07/banks-card-breach-at-trump-hotel-properties/" target="_blank">Trump Hotels</a> (<a href="http://krebsonsecurity.com/2016/04/sources-trump-hotels-breached-again/" target="_blank">twice</a>), <a href="http://krebsonsecurity.com/2015/09/banks-card-breach-at-hilton-hotel-properties/" target="_blank">Hilton</a>, <a href="http://krebsonsecurity.com/2015/03/credit-card-breach-at-mandarian-oriental/" target="_blank">Mandarin Oriental</a>, and <a href="http://krebsonsecurity.com/2014/01/hotel-franchise-firm-white-lodging-investigates-breach/" target="_blank">White Lodging</a> (<a href="http://krebsonsecurity.com/2015/04/white-lodging-confirms-second-breach/" target="_blank">twice</a>). Card breaches also have hit hospitality chains <a href="http://krebsonsecurity.com/2015/11/starwood-hotels-warns-of-credit-card-breach/" target="_blank">Starwood Hotels</a> and <a href="http://krebsonsecurity.com/2016/01/hyatt-card-breach-hit-250-hotels-in-50-nations/" target="_blank">Hyatt</a>.<span id="more-37956"></span><span id="more-36174"></span></p>
<p>In many of those incidents, thieves planted malicious software on the point-of-sale devices at restaurants and bars inside of the hotel chains. Point-of-sale based malware has driven most of the credit card breaches over the past two years, including intrusions at <a href="https://krebsonsecurity.com/?s=target+breach&amp;x=0&amp;y=0" target="_blank">Target</a> and <a href="https://krebsonsecurity.com/?s=home+depot+breach&amp;x=0&amp;y=0" target="_blank">Home Depot</a>, as well as breaches at <a href="https://krebsonsecurity.com/?s=point-of-sale+vendor&amp;x=0&amp;y=0" target="_blank">a slew of point-of-sale vendors</a>. The malware usually is installed via hacked remote administration tools. Once the attackers have their malware loaded onto the point-of-sale devices, they can remotely capture data from each card swiped at that cash register.</p>
<p>Thieves can then <a href="https://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/" target="_blank">sell that data to crooks</a> who specialize in encoding the stolen data onto any card with a magnetic stripe, and using the cards to purchase high-priced electronics and gift cards from big-box stores like Target and Best Buy.</p>
<p>Readers should remember that they’re not liable for fraudulent charges on their credit or debit cards, but they still have to report the unauthorized transactions. There is no substitute for keeping a close eye on your card statements. Also, consider using credit cards instead of debit cards; having your checking account emptied of cash while your bank sorts out the situation can be a hassle and lead to secondary problems (bounced checks, for instance).</p>


feed_id: https://krebsonsecurity.com/?p=37970
title: House Passes Long-Sought Email Privacy Bill
uri: House-Passes-Long-Sought-Email-Privacy-Bill
url: https://krebsonsecurity.com/2017/02/house-passes-long-sought-email-privacy-bill/
content:
<p>The <strong>U.S. House of Representatives</strong> on Monday approved a bill that would update the nation&#8217;s email surveillance laws so that federal investigators are required to obtain a court-ordered warrant for access to older stored emails. Under the current law, U.S. authorities can legally obtain stored emails older than 180 days using only a subpoena issued by a prosecutor or FBI agent without the approval of a judge.</p>
<p><img class="aligncenter wp-image-23893" src="media/57bcd769.cloudprivacy.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/12/cloudprivacy.jpg" alt="cloudprivacy" width="567" height="412" />The House passed by a voice vote <strong>The Email Privacy Act</strong> (<a href="https://www.congress.gov/bill/115th-congress/house-bill/387/text" target="_blank">HR 387</a>). The bill amends the <a title="http://en.wikipedia.org/wiki/Electronic_Communications_Privacy_Act" href="http://en.wikipedia.org/wiki/Electronic_Communications_Privacy_Act" target="_blank">Electronic Communications Privacy Act</a> (ECPA), a 1986 statute that was originally designed to protect Americans from Big Brother and from government overreach. Unfortunately, the law is now so outdated that it actually provides legal cover for the <a title="https://www.eff.org/deeplinks/2013/05/5-overlooked-lessons-justice-depts-leak-investigations" href="https://www.eff.org/deeplinks/2013/05/5-overlooked-lessons-justice-depts-leak-investigations" target="_blank">very sort of overreach it was designed to prevent</a>.</p>
<p>Online messaging was something of a novelty when lawmakers were crafting ECPA, which gave email moving over the network essentially the same protection as a phone call or postal letter. In short, it required the government to obtain a court-approved warrant to gain access to that information.</p>
<p>But the <strong>U.S. Justice Department</strong> wanted different treatment for stored electronic communications. Congress struck a compromise, decreeing that after 180 days email would no longer be protected by the warrant standard and instead would be available to the government with an administrative subpoena and without requiring the approval of a judge.<span id="more-37970"></span></p>
<p>HR 387&#8217;s sponsor <strong>Kevin Yoder</strong> (R-Kan.) explained in <a href="http://yoder.house.gov/media-center/press-releases/video-rep-yoder-s-remarks-on-house-passage-of-email-privacy-act" target="_blank">a speech</a> on the House floor Monday that back in when the bill was passed, hardly anybody stored their personal correspondence &#8220;in the cloud.&#8221; He said <span class="pullquote pqright">the thinking at the time was that &#8220;if an individual was leaving an email on a third-party server it was akin to that person leaving their paper mail in a garbage can at the end of their driveway.&#8221;</span></p>
<p>“Thus, that individual had no reasonable expectation of privacy in regards to that email under the Fourth Amendment,&#8221; Yoder said.</p>
<p><strong>Lee Tien</strong>, a senior staff attorney with the <strong>Electronic Frontier Foundation (EFF)</strong>, said a simple subpoena also can get law enforcement the following information about communications records (in addition to the content of emails stored at a service provider for more than 180 days):</p>
<p>-name;<br />
-address;<br />
-local and long distance telephone connection records, or records of session times and durations;<br />
-length of service (including start date) and types of service utilized;<br />
-telephone or instrument number or other subscriber number or identity, including any temporarily assigned network address; and<br />
-means and source of payment for such service (including any credit card or bank account number), of a subscriber to or customer of such service when the governmental entity uses an administrative subpoena authorized by a Federal or State statute or a Federal or State grand jury or trial subpoena.</p>
<p>The Email Privacy Act does not force investigators to jump through any additional hoops for accessing so-called &#8220;metadata&#8221; messaging information about stored communications, such as the Internet address or email address of a message sender. Under ECPA, the &#8220;transactional&#8221; data associated with communications &#8212; such as dialing information showing what numbers you are calling &#8212; was treated as less sensitive. ECPA allows the government to use something less than a warrant to obtain this routing and signaling information.</p>
<p>The rules are slightly different in California, thanks to the passage of <a href="https://www.eff.org/cases/californias-electronic-communications-privacy-act-calecpa" target="_blank">CalECPA</a>, a law that went into effect in 2016. CalECPA not only requires California government entities to obtain a search warrant before obtaining or accessing electronic information, it also requires a warrant for metadata.</p>
<p>Activists who&#8217;ve championed ECPA reform for years are cheering the House vote, but some are concerned that the bill may once again get hung up in the Senate. Last year, the House passed the bill in an unanimous 419-0 vote, but the measure stalled in the upper chambers of the Senate.</p>
<p>The EFF&#8217;s Tien said he&#8217;s worried that the bill heading to the Senate may not have the support of the Trump administration, which could hinder its chances in a Republican-controlled chamber.</p>
<p>&#8220;The Senate is a very different story, and it was a different story last year when Democrats had more votes,&#8221; Tien said.</p>
<p>Whether the bill even gets considered by the Senate at all is bound to be an issue again this year.</p>
<p>&#8220;I feel a little wounded because it&#8217;s been a hard fight,&#8221; Tien said. &#8220;It hasn&#8217;t been an easy fight to get this far.&#8221;</p>
<p>The U.S. government is not in the habit of publishing data about subpoenas it has requested and received, but several companies that are frequently on the receiving end of such requests do release aggregate numbers. For example, <a href="http://www.apple.com/privacy/transparency-reports/" target="_blank">Apple</a>, <a href="https://govtrequests.facebook.com/" target="_blank">Facebook</a>, <a href="https://www.google.com/transparencyreport/userdatarequests/US/" target="_blank">Google</a>, <a href="https://www.microsoft.com/about/csr/transparencyhub/lerr/" target="_blank">Microsoft</a> and <a href="https://transparency.twitter.com/en.html" target="_blank">Twitter</a> all publish transparency reports. They&#8217;re worth a read.</p>
<p>For a primer on protecting your communications from prying eyes and some tools to help preserve your privacy, check out the <a href="https://ssd.eff.org/en" target="_blank">EFF&#8217;s Surveillance Self-Defense guide</a>.</p>


feed_id: https://krebsonsecurity.com/?p=37997
title: ‘Top 10 Spammer’ Indicted for Wire Fraud
uri: Top-10-Spammer-Indicted-for-Wire-Fraud
url: https://krebsonsecurity.com/2017/02/top-10-spammer-indicted-for-wire-fraud/
content:
<p><strong>Michael A. Persaud</strong>, a California man profiled in a <a href="http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/" target="_blank">Nov. 2014 KrebsOnSecurity story</a> about a junk email purveyor tagged as one of the World&#8217;s Top 10 Worst Spammers, was indicted this week on federal wire fraud charges tied to an alleged spamming operation.</p>
<p>According to an indictment returned in federal court in Chicago, Persaud used multiple Internet addresses and domains – a technique known as “snowshoe spamming” – to transmit spam emails over at least nine networks.</p>
<p><img class="aligncenter size-full wp-image-28602" src="media/54633b1a.persaud-fb.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/persaud-fb.png" alt="persaud-fb" width="410" height="174" /></p>
<p>The <strong>Justice Department</strong> says <span class="il">Persaud</span> sent well over a million spam emails to recipients in the United States and abroad. Prosecutors charge that Persaud often used false names to register the domains, and he created fraudulent “From:” address fields to conceal that he was the true sender of the emails. The government also accuses <span class="il">Persaud</span> of &#8220;illegally transferring and selling millions of email addresses for the purpose of transmitting spam.&#8221;</p>
<p>Persaud is currently <a href="https://www.spamhaus.org/rokso/spammer/SPM1319/michael-persaud" target="_blank">listed as #8</a> on the <a href="https://www.spamhaus.org/statistics/spammers/" target="_blank">World’s 10 Worst Spammers list</a> maintained by <a href="https://krebsonsecurity.com/?s=spamhaus&amp;x=0&amp;y=0" target="_blank">Spamhaus</a>, an anti-spam organization. In 1998, Persaud was <a href="http://articles.latimes.com/1998/dec/29/business/fi-58482" target="_blank">sued by AOL</a>, which charged that he committed fraud by using various names to send millions of get-rich-quick spam messages to America Online customers. Persaud did not contest the charges and was <a href="https://web.archive.org/web/20080705210156/http://legal.web.aol.com/decisions/dljunk/persaudorder.html" target="_blank">ordered</a> to pay more than a half-million dollars in restitution and damages.<span id="more-37997"></span></p>
<p>In 2001, the San Diego District Attorney’s office <a href="http://news.cnet.com/California-throws-the-book-at-spam/2100-1023_3-254262.html" target="_blank">filed criminal charges against Persaud</a>, alleging that he and an accomplice crashed a company’s email server after routing their spam through the company’s servers.</p>
<p>Persaud declined to comment for this story. But he maintains that his email marketing business is legitimate and complies with the <a href="https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003" target="_blank">CAN-SPAM Act</a>, the main anti-spam law in the United States. The law prohibits the sending of spam that spoofs that sender’s address or does not give recipients an easy way to opt out of receiving future such emails from that sender.</p>
<p>Persaud told FBI agents who <a href="https://krebsonsecurity.com/2016/06/fbi-raids-spammer-outed-by-krebsonsecurity/" target="_blank">raided his home last year</a> that he currently conducts internet marketing from his residence by sending a million emails in under 15 minutes from various domains and Internet addresses.</p>
<p>The indictment charges Persaud with ten counts of wire fraud and seeks the forfeiture of four computers. Each count of wire fraud is punishable by up to 20 years in prison. If convicted, the court must impose a reasonable sentence under federal statutes and sentencing guidelines.</p>
<p>Persaud was charged in Chicago because at least two of the servers he allegedly used to conduct snowshoe spamming operations were located there (named only as victims &#8220;B&#8221; and &#8220;F&#8221; in the government&#8217;s indictment). A copy of the indictment against Persaud is <a href="media/3507f613.Persaud-indictment-filed.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/02/Persaud-indictment-filed.pdf" target="_blank">here</a> (PDF).</p>
<p>For more on how spam allegedly sent by Persaud was traced back to his companies, see my story from November 2014, <a href="http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/">Still Spamming After All These Years</a>. For a deeper understanding of why and how spam is the engine that drives virtually all other forms of cybercrime, check out my book &#8212; <em><a href="https://www.amazon.com/Spam-Nation-Organized-Cybercrime---Epidemic/dp/1402295618/ref=sr_1_1?ie=UTF8&amp;qid=1400765293&amp;sr=8-1&amp;keywords=spam+nation" target="_blank">Spam Nation: The Inside Story of Organized Cybercrime</a></em>.</p>


feed_id: https://krebsonsecurity.com/?p=38024
title: Fast Food Chain Arby’s Acknowledges Breach
uri: Fast-Food-Chain-Arby-s-Acknowledges-Breach
url: https://krebsonsecurity.com/2017/02/fast-food-chain-arbys-acknowledges-breach/
content:
<p>Sources at nearly a half-dozen banks and credit unions independently reached out over the past 48 hours to inquire if I&#8217;d heard anything about a data breach at <strong>Arby&#8217;s</strong> fast-food restaurants. Asked about the rumors, Arby&#8217;s told KrebsOnSecurity that it recently remediated a breach involving malicious software installed on payment card systems at hundreds of its restaurant locations nationwide.</p>
<p><img class="alignright wp-image-38032" src="media/37d36110.arbys2.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/arbys2.png" alt="arbys2" width="285" height="317" />A spokesperson for Atlanta, Ga.-based Arby&#8217;s said the company was first notified by industry partners in mid-January about a breach at some stores, but that it had not gone public about the incident at the request of the FBI.</p>
<p>&#8220;Arby’s Restaurant Group, Inc. (ARG) was recently provided with information that prompted it to launch an investigation of its payment card systems,&#8221; the company said in a written statement provided to KrebsOnSecurity.</p>
<p>&#8220;Upon learning of the incident, ARG immediately notified law enforcement and enlisted the expertise of leading security experts, including <strong>Mandiant</strong>,&#8221; their statement continued. &#8220;While the investigation is ongoing, ARG quickly took measures to contain this incident and eradicate the malware from systems at restaurants that were impacted.&#8221;</p>
<p>Arby&#8217;s said the breach involved malware placed on payment systems inside Arby&#8217;s corporate stores, and that Arby&#8217;s franchised restaurant locations were not impacted.</p>
<p>Arby&#8217;s has more than 3,330 stores in the United States, and roughly one-third of those are corporate-owned. The remaining stores are franchises. However, this distinction is likely to be lost on Arby&#8217;s customers until the company releases more information about individual restaurant locations affected by the breach.</p>
<p>&#8220;Although there are over 1,000 corporate Arby&#8217;s restaurants, not all of the corporate restaurants were affected,&#8221; said <strong>Christopher Fuller</strong>, Arby&#8217;s senior vice president of communications. &#8220;But this is the most important point: That we have fully contained and eradicated the malware that was on our point-of-sale systems.&#8221;<span id="more-38024"></span></p>
<p>The first clues about a possible breach at the sandwich chain came in a non-public alert issued by <a href="https://www.pscu.com/" target="_blank">PSCU</a>, a service organization that serves more than 800 credit unions.</p>
<p>The alert sent to PSCU member banks advised that PSCU had just received very long lists of compromised card numbers from both <strong>Visa</strong> and <strong>MasterCard</strong>. The alerts stated that a breach at an unnamed retailer compromised more than 355,000 credit and debit cards issued by PCSU member banks.</p>
<p>&#8220;PSCU believes the alerts are associated with a large fast food restaurant chain, yet to be announced to the public,&#8221; reads the alert, which was sent only to PSCU member banks.</p>
<p>Arby&#8217;s declined to say how long the malware was thought to have stolen credit and debit card data from infected corporate payment systems. But the PSCU notice said the breach is estimated to have occurred between Oct. 25, 2016 and January 19, 2017.</p>
<p>Such a large alert from the card associations is generally a sign of a sizable nationwide breach, as this is likely just the first of many alerts Visa and MasterCard will send to card-issuing banks regarding accounts that were compromised in the intrusion. If history is any lesson, some financial institutions will respond by re-issuing thousands of customer cards, while other (likely larger) institutions will focus on managing fraud losses on the compromised cards.</p>
<p>The breach at Arby&#8217;s comes as many credit unions and smaller banks are still feeling the financial pain from fraud related to a similar breach at the fast food chain <strong>Wendy&#8217;s</strong>. KrebsOnSecurity <a href="https://krebsonsecurity.com/2016/01/wendys-probes-reports-of-credit-card-breach/" target="_blank">broke the news</a> of that breach in January 2016, but the company didn&#8217;t announce it had fully removed the malware from its systems <a href="https://krebsonsecurity.com/2016/05/wendys-breach-affected-5-of-restaurants/" target="_blank">until May 2016</a>. But two months after that the company was forced to admit that <a href="https://krebsonsecurity.com/2016/07/1025-wendys-locations-hit-in-card-breach/" target="_blank">many Wendy&#8217;s locations were still compromised</a>.</p>
<p><strong>B. Dan Berger</strong>, president and CEO of the <strong>National Association of Federal Credit Unions</strong>, said the number of cards that PSCU told member banks were likely exposed in this breach is roughly in line with the numbers released not long after news of the Wendy&#8217;s breach broke.</p>
<p>&#8220;Hundreds of thousands of cards is a big number, and with the Wendy&#8217;s breach, the alerts we were getting from Visa and MasterCard were in the six-digit ranges for sure,&#8221; Berger said. <span class="pullquote pqright">&#8220;That&#8217;s probably one of the biggest numbers I&#8217;ve heard.&#8221;</span></p>
<p>Berger said the Wendy&#8217;s breach was especially painful because the company was re-compromised after it scrubbed its payment systems of malicious software. Many banks and credit unions ended up re-issuing customer cards several times throughout last year after loyal Wendy&#8217;s customers re-compromised their brand new cards again and again because they routinely ate at multiple Wendy’s locations throughout the month.</p>
<p>&#8220;We had institutions that stopped approving debit and credit transactions through Wendy&#8217;s when they were still dealing with that breach,&#8221; Berger said. &#8220;Our member credit unions were eating the costs of fraud on compromised cards, and on top of that having to re-issue the same cards over and over.&#8221;</p>
<p>Point-of-sale malware has driven most of the major retail industry credit card breaches over the past two years, including intrusions at <a href="https://krebsonsecurity.com/?s=target+breach&amp;x=0&amp;y=0" target="_blank">Target</a> and <a href="https://krebsonsecurity.com/?s=home+depot+breach&amp;x=0&amp;y=0" target="_blank">Home Depot</a>, as well as breaches at <a href="https://krebsonsecurity.com/?s=point-of-sale+vendor&amp;x=0&amp;y=0" target="_blank">a slew of point-of-sale vendors</a>. The malware sometimes is installed via hacked remote administration tools like LogMeIn; in other cases the malware is relayed via &#8220;spear-phishing&#8221; attacks that target company employees. Once the attackers have their malware loaded onto the point-of-sale devices, they can remotely capture data from each card swiped at that cash register.</p>
<p>Thieves can then <a href="https://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/" target="_blank">sell that data to crooks</a> who specialize in encoding the stolen data onto any card with a magnetic stripe, and using the cards to purchase high-priced electronics and gift cards from big-box stores like Target and Best Buy.</p>
<p>Readers should remember that they’re not liable for fraudulent charges on their credit or debit cards, but they still have to report the unauthorized transactions. There is no substitute for keeping a close eye on your card statements. Also, consider using credit cards instead of debit cards; having your checking account emptied of cash while your bank sorts out the situation can be a hassle and lead to secondary problems (bounced checks, for instance).</p>


feed_id: https://krebsonsecurity.com/?p=38055
title: Who Ran Leakedsource.com?
uri: Who-Ran-Leakedsource-com
url: https://krebsonsecurity.com/2017/02/who-ran-leakedsource-com/
content:
<p>Late last month, multiple news outlets reported that unspecified law enforcement officials had seized the servers for <strong>Leakedsource.com</strong>, perhaps the largest online collection of usernames and passwords leaked or stolen in some of the worst data breaches &#8212; including billions of credentials for accounts at top sites like <strong>LinkedIn</strong>, <strong>Myspace</strong>, and <strong>Yahoo</strong>.</p>
<p>In a development that could turn out to be deeply ironic, it seems that the real-life identity of LeakedSource&#8217;s principal owner may have been exposed by many of the same stolen databases he&#8217;s been peddling.</p>
<div id="attachment_38087" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/043e7779.lsscreen.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/lsscreen.png"><img class="wp-image-38087 size-medium" src="media/0f4fb43e.lsscreen-580x319.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/lsscreen-580x319.png" alt="The now-defunct Leakedsource service." width="580" height="319" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/02/lsscreen-580x319.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/02/lsscreen-768x422.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/02/lsscreen.png 894w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The now-defunct LeakedSource service.</p></div>
<p>LeakedSource in October 2015 began selling access to passwords stolen in high-profile breaches. Enter any email address on the site&#8217;s search page and it would tell you if it had a password corresponding to that address. However, users had to select a payment plan before viewing any passwords.</p>
<p>LeakedSource was a curiosity to many, and for some journalists a potential source of news about new breaches. But unlike services such as <a href="https://www.breachalarm.com" target="_blank">BreachAlarm</a> and <a href="https://haveibeenpwned.com/" target="_blank">HaveIBeenPwned.com</a> &#8212; which force users to verify that they can access a given account or inbox before the site displays whether it has found a password associated with the account in question &#8212; LeakedSource did nothing to validate users. This fact, critics charged, showed that the proprietors of LeakedSource were purely interested in making money and helping others pillage accounts.</p>
<p>I also was curious about LeakedSource, but for a different reason. I wanted to chase down something I&#8217;d heard from multiple sources: That one of the administrators of LeakedSource also was the admin of <strong>abusewith[dot]us</strong>, a site unabashedly dedicated to helping people hack email and online gaming accounts.</p>
<p>Abusewith[dot]us began in September 2013 as a forum for learning and teaching how to hack accounts at <a href="https://www.runescape.com" target="_blank">Runescape</a>, a massively multiplayer online role-playing game (MMORPG) set in a medieval fantasy realm where players battle for kingdoms and riches.<br />
<img class="aligncenter size-medium wp-image-38073" src="media/6672a296.runescape-580x328.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/runescape-580x328.png" alt="runescape" width="580" height="328" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/02/runescape-580x328.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/02/runescape-768x434.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/02/runescape-940x531.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/02/runescape.png 984w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>The currency with which Runescape players buy and sell weapons, potions and other in-game items are virtual gold coins, and many of Abusewith[dot]us&#8217;s early members traded in a handful of commodities: Phishing kits and exploits that could be used to steal Runescape usernames and passwords from fellow players; virtual gold plundered from hacked accounts; and databases from hacked forums and Web sites related to Runescape and other online games.</p>
<p>The administrator of Abusewith[dot]us is a hacker who uses the nickname &#8220;<strong>Xerx3s</strong>.&#8221; The avatar attached to Xerx3s&#8217;s account suggests the name is taken from <a href="https://en.wikipedia.org/wiki/Xerxes_I" target="_blank">Xerxes the Great</a>, a Persian king who lived during the fifth century BC.</p>
<p>Xerx3s the hacker appears to be especially good at breaking into discussion forums and accounts dedicated to Runescape and online gaming. Xerx3s also is a major seller of Runescape gold &#8212; often sold to other players at steep discounts and presumably harvested from hacked accounts.</p>
<div id="attachment_38074" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/eea9511f.abusewithus-current.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/abusewithus-current.png"><img class="wp-image-38074 size-medium" src="media/fc3e94c0.abusewithus-current-580x372.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/abusewithus-current-580x372.png" alt="Xerx3s's administrator account profile at Abusewith.us." width="580" height="372" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/02/abusewithus-current-580x372.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/02/abusewithus-current-768x492.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/02/abusewithus-current-940x602.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/02/abusewithus-current.png 1497w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Xerx3s&#8217;s administrator account profile at Abusewith.us.</p></div>
<p>I didn&#8217;t start looking into who might be responsible for LeakedSource until July 2016, when I sought an interview by reaching out to the email listed on the site (leakedsourceonline@gmail.com). Soon after, I received a Jabber chat invite from the address &#8220;<strong>leakedsource@chatme.im</strong>.&#8221;</p>
<p>The entirety of that brief interview is archived <a href="https://krebsonsecurity.com/wp-content/uploads/2017/02/LeakedSourceAdminChat.txt" target="_blank">here.</a> I wanted to know whether the proprietors of the service believed they were doing anything wrong (we&#8217;ll explore more about the legal aspects of LeakedSource&#8217;s offerings later in this piece).  Also, I wanted to learn whether the rumors of LeakedSource arising out of Abusewith[us] were true.</p>
<p>&#8220;After many of the big breaches of 2015, we noticed a common public trend&#8230;&#8217;Where can I search it to see if I was affected?&#8217;,&#8221; wrote the anonymous person hiding behind the leakedsource@chatme.im account. &#8220;And thus, the idea was born to fill that need, not rising out of anything. We are however going to terminate the interview as it does seem to be more of a witch hunt instead of journalism. Thank you for your time.&#8221;</p>
<p>Nearly two weeks after that chat with the LeakedSource administrator, I got a note from a source who keeps fairly close tabs on the major players in the English-speaking cybercrime underground. My source told me he&#8217;d recently chatted with Xerx3s using the Jabber address Xerx3s has long used prior to the creation of LeakedSource &#8212; <strong>xerx3s@chatme.im</strong>.</p>
<p>Xerx3s told my source in great detail about my conversation with the Leakedsource administrator, suggesting that either Xerx3s was the same person I spoke with in my brief interview with LeakedSource, or that the LeakedSource admin had shared a transcript of our chat with Xerx3s.</p>
<p>Although his username on Abusewith[dot]us was Xerx3s, many of Xerx3s&#8217;s closest associates on the forum <a href="media/d40afd53.xer-wade.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/xer-wade.png" target="_blank">referred to him as &#8220;Wade&#8221; in their forum postings</a>. This is in reference to a pseudonym Xerx3s frequently used, &#8220;<strong>Jeremy Wade</strong>.&#8221;</p>
<p><div id="attachment_38114" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-38114" src="media/4fa5f417.xerownsit-580x252.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/xerownsit-580x252.png" alt="An associate of Xerx3s tells another abusewith[dot]us user that Xerx3s is the owner of LeakedSource. That comment was later deleted from the discussion thread pictured here." width="580" height="252" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/02/xerownsit-580x252.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/02/xerownsit-768x334.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/02/xerownsit.png 934w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">An associate of Xerx3s tells another abusewith[dot]us user that Xerx3s is the owner of LeakedSource. That comment was later deleted from the discussion thread pictured here.</p></div>One email address this Jeremy Wade identity used pseudonymously was <strong>imjeremywade@gmail.com</strong>. According to a &#8220;reverse WHOIS&#8221; record search ordered through <a href="https://www.domaintools.com" target="_blank">Domaintools.com</a>, that email address is tied to two domain names registered in 2015: <strong>abusing[dot]rs</strong>, and <strong>cyberpay[dot]info</strong>. The original registration records for each site included the name &#8220;Secure Gaming LLC.&#8221;</p>
<p>The &#8220;Jeremy Wade&#8221; pseudonym shows up in a number of hacked forum databases that were posted to both Abusewith[dot]us and LeakedSource, including several other sites related to hacking and password abuse.</p>
<p>For example, the <a href="http://pastebin.com/5wEcD8CP" target="_blank">user database</a> stolen and leaked from the DDoS-for-hire service &#8220;<strong>panic-stresser[dot]xyz</strong>&#8221; shows that a PayPal account tied to the email address <strong>eadeh_andrew@yahoo.com</strong> paid $5 to cover a subscription for a user named &#8220;jeremywade;&#8221; The leaked Panicstresser database shows the Jeremywade account was tied to the email address <strong>xdavros@gmail.com</strong>, and that the account was created in July 2012.</p>
<p>The leaked Panicstresser database also showed that the first login for that Jeremywade account came from the Internet address <strong>68.41.238.208</strong>, which is a dynamic Internet address assigned to residential customers of <strong>Comcast Communications</strong> in Michigan.</p>
<p>According to a large number of forum postings, it appears that whoever used the xdavros@gmail.com address also created several variations on that address, including <strong>alexdavros@gmail.com</strong>, <strong>davrosalex3@yahoo.com</strong>, <strong>davrosalex4@yahoo.com</strong>, as well as <strong>themarketsales@gmail.com.</strong></p>
<p>The Gmail account xdavros@gmail.com was used to register at least four domain names almost six years ago in 2011. Two of those domains &#8212; <strong>daily-streaming.com</strong> and <strong>tiny-chats.com</strong> &#8212; were originally registered to a &#8220;<strong>Nick Davros</strong>&#8221; at <strong>3757 Dunes Parkway, Muskegon, Mich</strong>. The other two were registered to a Nick or <strong>Alex Davros</strong> at <strong>868 W. Hile Rd., Muskegon, Mich</strong>. All four domain registration records included the phone number <strong>+12313430295</strong>.</p>
<p>I took that 68.41.238.208 Internet address that the leaked Panicstresser database said was tied to the account xdavros@gmail.com and ran an Internet search on it. The address turned up in yet another compromised hacker forum database &#8212; this time in the leaked user database for <strong>sinister[dot]ly</strong>, ironically another site where users frequently post databases plundered from other sites and forums.</p>
<p>The leaked sinister[dot]ly forum database shows that a user by the name of &#8220;<strong>Jwade</strong>&#8221; who registered under the email address <strong>trpkisaiah@gmailcom</strong> first logged into the forum from the same Comcast Internet address tied to the xdavros@gmail.com account at Panicstresser.<span id="more-38055"></span></p>
<p>I also checked that Michigan Comcast address with <a href="https://www.farsightsecurity.com/" target="_blank">Farsight Security</a>, a security firm which runs a paid service that tracks the historic linkages between Internet addresses and domain names. Farsight reported that between 2012 and 2014, the Internet address 68.41.238.208 was tied to <strong>no-ip.biz</strong>, popular &#8220;dynamic IP&#8221; service.</p>
<p>No-ip.biz and other dynamic IP address services are usually free services that allow users to have Web sites hosted on servers that frequently change their Internet addresses. This type of service is useful for people who want to host a Web site on a home-based Internet address that may change from time to time, because services like No-ip.biz can be used to easily map the domain name to the user’s new Internet address whenever it happens to change.</p>
<p><span id="more-8917"></span>Unfortunately, these dynamic IP providers are extremely popular in the attacker community, because they allow bad guys to keep their malware and scam sites up even when researchers mange to track the attacking IP address and convince the ISP responsible for that address to disconnect the malefactor. In such cases, dynamic IP services allow the owner of the attacking domain to simply re-route the attack site to another Internet address that he controls.</p>
<p>Farsight reports that the address 68.41.238.208 <a href="media/00257e65.wade-no-ip-history.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/wade-no-ip-history.png" target="_blank">maps back to three different dynamic IP domains</a>, including &#8220;<strong>jwade69.no-ip.biz</strong>,&#8221; &#8220;<strong>wadewon.no-ip.biz</strong>,&#8221; and &#8220;<strong>jrat6969.zapto.org</strong>.&#8221; That first dynamic address &#8212; jwade69.no-ip.biz &#8212; was <a href="https://info.publicintelligence.net/FBI-BlackshadesDomains.txt" target="_blank">included among several hundred others in a list</a> published by the <strong>Federal Bureau of Investigation</strong> as tied to the distribution of <a href="https://krebsonsecurity.com/tag/blackshades/" target="_blank">Blackshades</a>, a popular malware strain that was used as a password-stealing trojan by hundreds of paying customers prior to May 2014.</p>
<h4>XERX3S HACKED?</h4>
<p>In January 2017, when news of the alleged raid on LeakedSource began circulating in the media, I began going through my notes and emails searching for key accounts known to be tied to Xerx3s and the administrator of Abusewith[dot]us.</p>
<p>Somehow, in the previous three months I&#8217;d managed to overlook an anonymous message I received in mid-September from a reader who claimed to have hacked the email account themarketsales@gmail.com, one of several addresses my research suggested was tied to Xerx3s.</p>
<p>The anonymous source didn&#8217;t say exactly how he hacked this account, but judging from the passwords tied to Xerx3s&#8217;s other known accounts that were included in the various forum database leaks listed above <em>it may well have been because Xerx3s in some cases re-used the same password across multiple accounts. </em></p>
<p>My anonymous source shared almost a dozen screenshots of his access to themarketsales@gmail.com, which indicate the name attached to the account was &#8220;<strong>Alex Davros</strong>.&#8221; The screenshots also show this user received thousands of dollars in Paypal payments from Leakedsource.com over a fairly short period in 2015.<br />
<a class="lightbox" href="media/3feb2d55.alexdavrosleakedsource.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/alexdavrosleakedsource.png"><img class="aligncenter wp-image-38066 size-medium" src="media/3ae419c6.alexdavrosleakedsource-580x160.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/alexdavrosleakedsource-580x160.png" alt="alexdavrosleakedsource" width="580" height="160" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/02/alexdavrosleakedsource-580x160.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/02/alexdavrosleakedsource-768x212.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/02/alexdavrosleakedsource-940x260.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>The screenshots also showed that themarketsales@gmail.com was tied to a PayPal account assigned to a Secured Gaming LLC. Recall that this is the same company name included in the Web site registration records back in 2011 for daily-streaming.com and tiny-chats.com.</p>
<div id="attachment_38064" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/fb5a713d.themarketsalespage1.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/themarketsalespage1.png"><img class="wp-image-38064 size-medium" src="media/3fcc1bd9.themarketsalespage1-580x284.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/themarketsalespage1-580x284.png" alt="A screenshot shared with me in Sept. 2016 by an anonymous source who said he'd hacked the Gmail address &quot;themarketsales@gmail.com&quot;." width="580" height="284" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/02/themarketsalespage1-580x284.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/02/themarketsalespage1-768x377.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/02/themarketsalespage1-940x461.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A screenshot shared with me in Sept. 2016 by an anonymous source who said he&#8217;d hacked the Gmail address &#8220;themarketsales@gmail.com&#8221;.</p></div>
<p>In addition, the screenshot above and <a href="media/18395656.alexdavros-hyperfilter.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/alexdavros-hyperfilter.png" target="_blank">others shared by my source</a> indicate that the same Paypal account tied to themarketsales@gmail.com was habitually used to pay a monthly bill from <strong>Hyperfilter.com</strong>, a company that provides DDoS protection and hosting and which has long been <a href="http://statsmentor.net/www.abusewith.us" target="_blank">the provider used by Abusewith[dot]us</a>.</p>
<p>Finally, the anonymous hacker shared screenshots suggesting he had also hacked into the email account <strong>desiparker18@gmail.com</strong>, an account apparently connected to a young lady in Michigan named <strong>Desi Parker</strong>. The screenshots for Ms. Parker suggest her hacked Gmail account was tied to an <strong>Apple iTunes</strong> account billed to a MasterCard ending in 7055 and issued to an Alexander Davros at 868 W. Hile, Muskegon, Mich.</p>
<p>The screenshots show the desiparker18@gmail.com address is associated with an Instagram account for a woman by the same name from Muskegon, Mich. (note that the address given in the WHOIS records for Alex Davros&#8217;s daily-streaming.com and tiny-chats.com also was Muskegon, Mich).</p>
<p>Desi Parker&#8217;s Instagram lists her &#8220;spouse&#8221; as Alex Davros, and says her phone number is 231-343-0295. Recall that this is the same phone number included in the Alex Davros domain registration records for daily-streaming.com and tiny-chats.com. That phone number is currently not in service.</p>
<p>Desi Parker&#8217;s Facebook account indeed says she is currently in a relationship with <strong>Alexander Marcus Davros</strong>, and the page links to <a href="https://www.facebook.com/marcus.davros?pnref=lhc" target="_blank">this Facebook account</a> for Alex Davros.</p>
<p>Alex&#8217;s Facebook profile is fairly sparse (at least the public version of it), but there is a singular notation in his entire profile that stands out: Beneath the &#8220;Other Names&#8221; heading under the &#8220;Details about Alexander&#8221; tab, Alex lists &#8220;<strong>TheKing</strong>.&#8221; Parker&#8217;s Instagram account includes a <a href="media/98e3de37.alexthekingdrawing.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/alexthekingdrawing.png" target="_blank">photo of an illustration she made</a> including her beau&#8217;s first name with a crown on top.</p>
<p>Interestingly, two email addresses connected to domains associated with the Jeremy Wade alias &#8212; <strong>matt96sk@yahoo.com</strong> and <strong>skythekiddy@yahoo.com</strong> &#8212; are tied to Facebook accounts for Michigan residents who both list Alex Davros among their Facebook friends.</p>
<p>Below is a rough mind map I created which attempts to show the connections between the various aliases, email addresses, phone numbers and Internet addresses mentioned above. At a minimum, they strongly indicate that Xerx3s is indeed an administrator of LeakedSource.</p>
<p><img class="alignright wp-image-38128" src="media/1085feaa.iamxerbutlsno.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/iamxerbutlsno.png" alt="iamxerbutlsno" width="229" height="364" />I managed to reach Davros <a href="http://twitter.com/thedavlol" target="_blank">through Twitter</a>, and asked him to follow me so that we could exchange direct messages. Within maybe 60 seconds of my sending that tweet, Davros followed me on Twitter and politely requested via direct message that I remove my public Twitter messages asking him to follow me.</p>
<p>After I did as requested, Davros&#8217;s only response initially was, &#8220;Wow, impressive but I can honestly tell you I am not behind the service.&#8221; However, when pressed to be more specific, he admitting to being Xerx3s but claimed he had no involvement in LeakedSource.</p>
<p>&#8220;I am xer yes but LS no,&#8221; Davros said. He stopped answering my questions after that, saying he was busy &#8220;doing a couple things IRL.&#8221; IRL is Internet slang for &#8220;in real life.&#8221; Presumably these other things he was doing while I was firing off more questions had nothing to do with activities like deleting profiles or contacting an attorney.</p>
<p>Even if Davros is telling the truth, the preponderance of clues here and the myriad connections between them suggest that he at least has close ties to some of those who are involved in running LeakedSource.</p>
<div id="attachment_38067" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/28c1b86e.ls-aw-mindmap.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/ls-aw-mindmap.png"><img class="wp-image-38067 size-medium" src="media/3f1bef1e.ls-aw-mindmap-580x302.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/ls-aw-mindmap-580x302.png" alt="A &quot;mind map&quot; I created to illustrate the apparent relationships between various addresses and pseudonyms referenced in this story." width="580" height="302" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/02/ls-aw-mindmap-580x302.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/02/ls-aw-mindmap-768x400.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/02/ls-aw-mindmap-940x490.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A &#8220;mind map&#8221; I created to illustrate the apparent relationships between various addresses and pseudonyms referenced in this story.</p></div>
<h4>THE LEGALITY OF LEAKEDSOURCE</h4>
<p>On the surface, the rationale that LeakedSource&#8217;s proprietors have used to justify their service may seem somewhat reasonable: The service merely catalogs information that is already stolen from companies and that has been leaked in some form online.</p>
<p>But legal experts I spoke with saw things differently, saying LeakedSource&#8217;s owners could face criminal charges if prosecutors could show LeakedSource intended for the passwords that are for sale on the site to be used in the furtherance of a crime.</p>
<p><strong>Orin Kerr</strong>, director of the <a href="https://www.law.gwu.edu/cybersecurity" target="_blank">Cybersecurity Law Initiative</a> at <strong>The George Washington University</strong>, said trafficking in passwords is clearly a crime under the <a href="https://www.law.cornell.edu/uscode/text/18/1030" target="_blank">Computer Fraud and Abuse Act</a> (CFAA).</p>
<p>Specifically, Section A6 of the CFAA, which makes it a crime to &#8220;<span class="chapeau">knowingly and with intent to defraud traffic in any password or similar information through which a computer may be accessed without authorization, if&#8230;</span>such trafficking affects interstate or foreign commerce.</p>
<p>&#8220;CFAA quite clearly punishes password trafficking,&#8221; Kerr said. &#8220;The statute says the [accused] must be trafficking in passwords knowingly and with intent to defraud, or trying to further unauthorized access.&#8221;</p>
<p><strong>Judith Germano</strong>, a senior fellow at the <a href="http://www.lawandsecurity.org/" target="_blank">Center on Law and Security</a> at New York University&#8217;s School of Law, said LeakedSource might have a veneer of legitimacy if it made an effort to check whether users already have access to the accounts for which they&#8217;re seeking passwords.</p>
<p>&#8220;If they’re not properly verifying that when the user goes to the site to get passwords then I think that&#8217;s where their mask of credibility falls,&#8221; Germano said.</p>
<p>LeakedSource may be culpable also because at one point the site offered to crack hashed or encrypted passwords for a fee. In addition, it seems clear that the people who ran the service also advocated the use of stolen passwords for financial gain.</p>


feed_id: https://krebsonsecurity.com/?p=38141
title: Men Who Sent Swat Team, Heroin to My Home Sentenced
uri: Men-Who-Sent-Swat-Team-Heroin-to-My-Home-Sentenced
url: https://krebsonsecurity.com/2017/02/men-who-sent-swat-team-heroin-to-my-home-sentenced/
content:
<p>It&#8217;s been a remarkable week for cyber justice. On Thursday, a Ukrainian man who hatched a plan in 2013 to send heroin to my home and then call the cops when the drugs arrived was sentenced to 41 months in prison for unrelated cybercrime charges. Separately, a 19-year-old American who admitted to being part of a hacker group that sent a heavily-armed police force to my home in 2013 was sentenced to three years probation.</p>
<div id="attachment_26609" style="width: 207px" class="wp-caption alignright"><img class="size-full wp-image-26609" src="media/5fb288e3.s-vovnenko.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/06/s-vovnenko.png" alt="Sergei &quot;Fly&quot; Vovnenko, in an undated photo. In a letter to this author following his arrest, Vovnenko said he forgave me for &quot;doxing&quot; him -- printing his real name and image -- on my site." width="197" height="252" /><p class="wp-caption-text">Sergei &#8220;Fly&#8221; Vovnenko, in an undated photo. In a letter to this author following his arrest, Vovnenko said he forgave me for &#8220;doxing&#8221; him &#8212; printing his real name and image &#8212; on my site.</p></div>
<p><strong>Sergey Vovnenko</strong>, a.k.a. &#8220;Fly,&#8221; &#8220;Flycracker&#8221; and &#8220;MUXACC1,&#8221; pleaded guilty last year to aggravated identity theft and conspiracy to commit wire fraud. Prosecutors said Vovnenko operated a network of more than 13,000 hacked computers, using them to harvest credit card numbers and other sensitive information.</p>
<p>When I first became acquainted with Vovnenko in 2013, I knew him only by his many hacker names, including “Fly” and “Flycracker,” among others. At the time, Fly was the administrator of the fraud forum “thecc[dot]bz,” an exclusive and closely guarded Russian language board dedicated to financial fraud and identity theft.</p>
<p>After I secretly gained access to his forum, I learned he’d hatched a plot to have heroin sent to my home and to have one of his forum lackeys call the police when the drugs arrived.</p>
<p>I explained this whole ordeal <a href="http://krebsonsecurity.com/2015/10/hacker-who-sent-me-heroin-faces-charges-in-u-s/" target="_blank">in great detail in 2015</a>, when Vovnenko initially was extradited from Italy to face charges here in the United States. In short, the antics didn’t end when I foiled his plot to get me arrested for drug possession, and those antics likely contributed to his arrest and to this guilty plea.</p>
<p>Vovnenko contested his extradition from Italy, and in so doing spent roughly 15 months in arguably <a href="http://www.thelocal.it/20140615/italys-jailbirds-are-packed-like-sardines" target="_blank">Italy&#8217;s worst prison</a>. During that time, he seemed to have turned his life around, sending me postcards at Christmas time and even an apparently heartfelt apology letter.</p>
<div id="attachment_32576" style="width: 590px" class="wp-caption aligncenter"><img class="wp-image-32576 size-medium" src="media/2ccf1c9b.flypostcardback-580x503.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/10/flypostcardback-580x503.png" alt="Seasons greetings from my pen pal, Flycracker." width="580" height="503" srcset="http://krebsonsecurity.com/wp-content/uploads/2015/10/flypostcardback-580x503.png 580w, http://krebsonsecurity.com/wp-content/uploads/2015/10/flypostcardback-940x816.png 940w, http://krebsonsecurity.com/wp-content/uploads/2015/10/flypostcardback.png 952w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Seasons greetings from my pen pal, Flycracker.</p></div>
<p>On Thursday, a judge in New Jersey sentenced Vovnenko to 41 months in prison, three years of supervised released and ordered him to pay restitution of $83,368.<span id="more-38141"></span></p>
<p>Separately, a judge in Washington, D.C. handed down a sentence of three year&#8217;s probation to <strong>Eric Taylor</strong>, a hacker probably better known by his handle &#8220;<a href="http://twitter.com/CosmoTheGod" target="_blank">Cosmo the God</a>.&#8221;</p>
<p>Taylor was among several men involved in making a false report to my local police department at the time about a supposed hostage situation at our Virginia home. In response, a <a href="http://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank">heavily-armed police force surrounded my home</a> and put me in handcuffs at gunpoint before the police realized it was all a dangerous hoax known as &#8220;swatting.&#8221;</p>
<p>CosmoTheGod rocketed to Internet infamy in 2013 when he and a number of other hackers set up the Web site <a href="http://krebsonsecurity.com/2013/03/credit-reports-sold-for-cheap-in-the-underweb/" target="_blank">exposed[dot]su</a>, which routinely &#8220;doxed&#8221; dozens of public officials and celebrities by publishing the address, Social Security numbers and other personal information on the former <strong>First Lady Michelle Obama</strong>, the then-director of the FBI and the U.S. attorney general, among others. The group also swatted many of the people they doxed.</p>
<div id="attachment_25473" style="width: 610px" class="wp-caption aligncenter"><img class="wp-image-25473 size-large" src="media/f2651763.exposed-su-600x462.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/03/exposed-su-600x462.png" alt="Exposed[dot]su was built with the help of identity information obtained and/or stolen from ssndob[dot]ru." width="600" height="462" srcset="http://krebsonsecurity.com/wp-content/uploads/2014/03/exposed-su-285x219.png 285w, http://krebsonsecurity.com/wp-content/uploads/2014/03/exposed-su-600x462.png 600w, http://krebsonsecurity.com/wp-content/uploads/2014/03/exposed-su.png 1263w" sizes="(max-width: 600px) 100vw, 600px" /><p class="wp-caption-text">Exposed[dot]su was built with the help of identity information obtained and/or stolen from ssndob[dot]ru.</p></div>
<p>Taylor and his co-conspirators were able to dox so many celebrities and public officials because they hacked a Russian identity theft service called <a href="https://krebsonsecurity.com/2014/03/who-built-the-id-theft-service-ssndob-ru/" target="_blank">ssndob[dot]ru</a>. That service in turn <a href="http://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/" target="_blank">relied upon compromised user accounts</a> at data broker giant <strong>LexisNexis</strong> to pull personal and financial data on millions of Americans.</p>
<p>At least two other young men connected to the exposed[dot]su conspiracy have already been sentenced to prison.</p>
<div id="attachment_38144" style="width: 265px" class="wp-caption alignright"><img class=" wp-image-38144" src="media/e6c3f145.ctg.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/ctg.png" alt="Eric &quot;CosmoTheGod&quot; Taylor." width="255" height="258" /><p class="wp-caption-text">Eric &#8220;CosmoTheGod&#8221; Taylor, in a recent selfie posted to his Twitter profile.</p></div>
<p>Among them was Mir Islam, a 22-year-old Brooklyn man who was <a href="https://krebsonsecurity.com/2016/07/serial-swatter-stalker-and-doxer-mir-islam-gets-just-1-year-in-jail/" target="_blank">sentenced last year to two years in prison for doxing and swatting</a>, and for cyberstalking a young woman whom he also admitted to swatting. Because he served almost a year of detention prior to his sentencing, Islam was only expected to spend roughly a year in prison, although it appears he was released before even serving the entire year.</p>
<p>Hours after his sentencing, Taylor reached out to KrebsOnSecurity via Facetime to apologize for his actions. Taylor, a California native, said he is trying to turn his life around, and that he has even started his own <a href="https://cinder.com/" target="_blank">cybersecurity consultancy</a>.</p>
<p>&#8220;I live in New York City now, have a baby on the way and am really trying to get my shit together finally,&#8221; Taylor said.</p>
<p>If Taylor&#8217;s physical appearance is any indication, he is indeed turning over a new leaf. At the time he was involved in publishing exposed[dot]su, the six-foot, seven-inch CosmoTheGod was <a href="https://www.wired.com/2012/09/cosmo-the-god-who-fell-to-earth/" target="_blank">easily a hundred pounds heavier than he is now</a>.</p>
<p class="p1"><span class="s1">Unfortunately, not everyone in Taylor&#8217;s former crew is making changes for the better. According to Taylor, his former co-conspirator Islam was recently re-arrested after allegedly cyberstalking Taylor&#8217;s girlfriend. That stalking claim could not be independently confirmed, however court documents show that Islam was indeed re-arrested and incarcerated last month in New York.</span></p>
<div id="attachment_35432" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-35432" src="media/89c1936a.islamsentencing-580x307.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/07/islamsentencing-580x307.png" alt="Mir Islam, at his sentencing hearing today. Sketches copyright by Hennessy / CourtroomArt.com" width="580" height="307" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/07/islamsentencing-580x307.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/07/islamsentencing-768x407.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/07/islamsentencing-940x498.png 940w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Mir Islam, at his sentencing hearing last year. Sketches copyright by Hennessy / CourtroomArt.com</p></div>


feed_id: https://krebsonsecurity.com/?p=38156
title: February Updates from Adobe, Microsoft
uri: February-Updates-from-Adobe-Microsoft
url: https://krebsonsecurity.com/2017/02/february-updates-from-adobe-microsoft/
content:
<p>A handful of readers have inquired as to the whereabouts of <strong>Microsoft</strong>&#8216;s usual monthly patches for <strong>Windows</strong> and related software. Microsoft opted to delay releasing any updates until next month, even though there is a zero-day vulnerability in Windows going around. However, <strong>Adobe</strong> did push out updates this week as per usual to fix critical issues in its <strong>Flash Player</strong> software.</p>
<p><img class="alignright wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="189" height="198" />In <a href="https://blogs.technet.microsoft.com/msrc/2017/02/14/february-2017-security-update-release/" target="_blank">a brief statement</a> this week, Microsoft said it &#8220;discovered a last minute issue that could impact some customers&#8221; that was not resolved in time for Patch Tuesday, which normally falls on the second Tuesday of each month. In an update to that advisory posted on Wednesday, Microsoft said it would deliver February&#8217;s batch of patches as part of the next regularly-scheduled Patch Tuesday, which falls on March 14, 2017.</p>
<p>On Feb. 2, the <strong>CERT Coordination Center</strong> at <strong>Carnegie Mellon University</strong> <a href="https://www.kb.cert.org/vuls/id/867968" target="_blank">warned</a> that an unpatched bug in a core file-sharing component of Windows (SMB) could let attackers crash Windows 8.1, and Windows 10 systems, as well as server equivalents of those platforms. CERT warned that exploit code for the flaw was already available online.<span id="more-38156"></span></p>
<p>The updates from Adobe fix at least 13 vulnerabilities in versions of Flash Player for Windows, Mac, ChromeOS and Linux systems. Adobe said it is not aware of any exploits in the wild for any of the 13 flaws fixed in this update.</p>
<p>The latest update brings Flash to <em>v. 24.0.0.221</em>. The update is rated &#8220;critical&#8221; for all OSes except Linux; critical flaws can be exploited to compromise a vulnerable system through no action on the part of the user, aside from perhaps browsing to a malicious or hacked Web site.</p>
<p>Flash has long been a risky program to leave plugged into the browser. If you have Flash installed, you should update, hobble or remove Flash as soon as possible. To see which version of Flash your browser may have installed, check out <a href="http://www.adobe.com/software/flash/about/" target="_blank">this page</a>.</p>
<p><img class="alignleft wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="172" height="147" />The smartest option is probably to ditch the program once and for all and significantly increase the security of your system in the process. An extremely powerful and buggy program that binds itself to the browser, Flash is a favorite target of attackers and malware. For some ideas about how to hobble or do without Flash (as well as slightly less radical solutions) check out <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">A Month Without Adobe Flash Player</a>.</p>
<p>If you choose to keep and update Flash, please do it today. The most recent versions of Flash should be available from the <a href="https://get.adobe.com/flashplayer/" target="_blank">Flash home page.</a> Windows users who browse the Web with anything other than <strong>Internet Explorer</strong> may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>
<p><strong>Chrome </strong>and IE should auto-install the latest Flash version on browser restart (users may need to manually check for updates in and/or restart the browser to get the latest Flash version). Chrome users may need to restart the browser to install or automatically download the latest version. When in doubt, click the vertical three dot icon to the right of the URL bar, select “Help,” then “About Chrome”: If there is an update available, Chrome should install it then.</p>


feed_id: https://krebsonsecurity.com/?p=37888
title: How to Bury a Major Breach Notification
uri: How-to-Bury-a-Major-Breach-Notification
url: https://krebsonsecurity.com/2017/02/how-to-bury-a-major-breach-notification/
content:
<p>Amid the hustle and bustle of the <strong>RSA Security Conference</strong> in San Francisco last week, researchers at RSA released a startling report that received very little press coverage relative to its overall importance. The report detailed a malware campaign that piggybacked on a popular piece of software used by system administrators at some of the nation&#8217;s largest companies. Incredibly, the report did not name the affected software, and the vendor in question has apparently chosen to bury its breach disclosure. This post is an attempt to remedy that.</p>
<p>The RSA report detailed the threat from a malware operation the company dubbed &#8220;<strong>Kingslayer</strong>.&#8221; According to RSA, the attackers compromised the Web site of a company that sells software to help Windows system administrators better parse and understand Windows event logs. RSA said the site hosting the event log management software was only compromised for two weeks &#8212; from April 9, 2015 to April 25, 2015 &#8212; but that the intrusion was likely far more severe than the short duration of the intrusion suggests.</p>
<p>That&#8217;s because in addition to compromising the download page for this software package,<em> the attackers also hacked the company&#8217;s software update server</em>, <em>meaning any company that already had the software installed prior to the site compromise would likely have automatically downloaded the compromised version when the software regularly checked for available updates</em> (as it was designed to do).</p>
<div id="attachment_38174" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/b0b075f1.kingslayertimeline.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/kingslayertimeline.png"><img class="wp-image-38174 size-medium" src="media/1c8065fa.kingslayertimeline-580x247.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/kingslayertimeline-580x247.png" alt="Image: RSA" width="580" height="247" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/02/kingslayertimeline-580x247.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/02/kingslayertimeline-768x327.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/02/kingslayertimeline.png 917w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Image: RSA</p></div>
<p>RSA said that in April 2016 it &#8220;sinkholed&#8221; or took control over the Web site that the malware used as a control server &#8212; <strong>oraclesoft[dot]net</strong> &#8212; and from there they were able to see indicators of which organizations might still be running the backdoored software. According to RSA, the victims included five major defense contractors; four major telecommunications providers; 10+ western military organizations; more than two dozen Fortune 500 companies; 24 banks and financial institutions; and at least 45 higher educational institutions.</p>
<p>RSA declined to name the software vendor whose site was compromised, but said the company issued a security notification on its Web site on June 30, 2016 and updated the notice on July 17, 2016 at RSA&#8217;s request following findings from further investigation into a defense contractor&#8217;s network. RSA also noted that the victim software firm had a domain name ending in &#8220;.net,&#8221; and that the product in question was installed as a Windows installer package file (.msi).</p>
<p>Using that information, it wasn&#8217;t super difficult to find the product in question. An Internet search for the terms &#8220;event log security notification april 2015&#8221; turns up <a href="http://www.eventid.net/evlog/evlogsecnote.asp" target="_blank">a breach notification</a> from June 30, 2016 about a software package called <strong>EVlog</strong>, produced by an <strong>Altair Technologies Ltd.</strong> in Mississauga, Ontario. The timeline mentioned in the breach notification exactly matches the timeline laid out in the RSA report.</p>
<p>As far as breach disclosures go, this one is about the lamest I&#8217;ve ever seen given the sheer number of companies that Altair Technologies <a href="http://www.eventid.net/whosubscribed.asp" target="_blank">lists on its site as subscribers to eventid.net</a>, an online service tied to EVlog. I could not locate a single link to this advisory anywhere on the company&#8217;s site, nor could I find evidence that Altair Technologies had made any effort via social media or elsewhere to call attention to the security advisory; it is simply buried in the site. A screenshot of the original, much shorter, version of that notice is <a href="media/3168ddf5.evlogcomp.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/evlogcomp.png" target="_blank">here</a>.<span id="more-37888"></span></p>
<div id="attachment_38175" style="width: 198px" class="wp-caption alignright"><img class=" wp-image-38175" src="media/2e5c1197.eventidsubscribers.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/eventidsubscribers.png" alt="Just some of the customers of Eventid. " width="188" height="776" /><p class="wp-caption-text">Just some of the customers of Eventid.</p></div>
<p>Perhaps the company emailed its subscribers about the breach, but that seems doubtful. The owner of Altair Technologies, a programmer named <strong>Adrian Grigorof</strong>, did not respond to multiple requests for comment.</p>
<p>&#8220;This attack is unique in that it appears to have specifically targeted Windows system administrators of large and, perhaps, sensitive organizations,&#8221; RSA said in its report. &#8220;These organizations appeared on a list of customers still displayed on the formerly subverted software vendor&#8217;s Web site. This is likely not coincidence, but unfortunately, nearly two years after the Kingslayer campaign was initiated, we still do not know how many of the customers listed on the website may have been breached, or possibly are still compromised by the Kingslayer perpetrators.&#8221;</p>
<p>It&#8217;s perhaps worth noting that this isn&#8217;t the only software package sold by Altair Technologies. An analysis of Eventid.net shows that the site is hosted on a server along with three other domains, <strong>eventreader.com</strong>, <strong>firegen.com</strong> and <strong>grigorof.com</strong> (the latter being a vanity domain of the software developer). The other two domains &#8212; eventreader.com and firegen.com &#8212; correspond to different software products sold by Altair.</p>
<p>The fact that those software titles appear to have been sold and downloadable from the same server as eventid.net (going back as far as 2010) suggests that those products may have been similarly compromised. However, I could find no breach notification mentioning those products. <a href="http://www.firegen.com/testimonials.html" target="_blank">Here is a list of companies</a> that Altair says are customers of Firegen; they include <strong>3M</strong>, <strong>DirecTV</strong>, <strong>Dole Food Company</strong>, <strong>EDS</strong>, <strong>FedEx</strong>, <strong>Ingram Micro</strong>, <strong>Northrup Grumman</strong>, <strong>Symantec</strong> and the <strong>U.S. Marshals Service</strong>.</p>
<p>RSA calls these types of intrusions &#8220;supply chain attacks,&#8221; in that they provide one compromise vector to multiple targets. It&#8217;s not difficult to see from the customer lists of the software titles mentioned above why an attacker might salivate over the idea of hacking an entire suite of software designed for corporate system administrators.</p>
<p>&#8220;Supply chain exploitation attacks, by their very nature, are stealthy and have the potential to provide the attacker access to their targets for a much longer period than malware delivered by other common means, by evading traditional network analysis and detection tools,&#8221; wrote RSA&#8217;s <strong>Kent Backman</strong> and <strong>Kevin Stear</strong>. &#8220;Software supply chain attacks offer considerable &#8216;bang for the buck&#8217; against otherwise hardened targets. In the case of Kingslayer, this especially rings true because the specific system-administrator-related systems most likely to be infected offer the ideal beachhead and operational staging environment for system exploitation of a large enterprise.&#8221;</p>
<p>A copy of the RSA report is available <a href="https://www.rsa.com/en-us/resources/kingslayer-a-supply-chain-attack" target="_blank">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=38224
title: iPhone Robbers Try to iPhish Victims
uri: iPhone-Robbers-Try-to-iPhish-Victims
url: https://krebsonsecurity.com/2017/02/iphone-robbers-try-to-iphish-victims/
content:
<p>In another strange tale from the kinetic-attack-meets-cyberattack department, earlier this week I heard from a loyal reader in Brazil whose wife was recently mugged by three robbers who nabbed her iPhone. Not long after the husband texted the stolen phone &#8212; offering to buy back the locked device &#8212; he soon began receiving text messages stating the phone had been found. All he had to do to begin the process of retrieving the device was click the texted link and log in to the phishing page mimicking Apple&#8217;s site.</p>
<p><img class="aligncenter size-full wp-image-38259" src="media/f892a002.applephish.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/applephish.png" alt="applephish" width="578" height="311" /></p>
<p><strong>Edu Rabin </strong>is a resident of Porto Alegre, the capital and largest city of the Brazilian state of Rio Grande do Sul in southern Brazil. Rabin said three thugs robbed his wife last Saturday in broad daylight. Thankfully, she was unharmed and all they wanted was her iPhone 5s.</p>
<p>Rabin said he then tried to locate the device using the &#8220;Find my iPhone&#8221; app.</p>
<p>&#8220;It was already in a nearby city, where the crime rates are even higher than mine,&#8221; Rabin said.</p>
<p>He said he then used his phone to send the robbers a message offering to buy back his wife&#8217;s phone.</p>
<p>&#8220;I’d sent a message with my phone number saying, &#8216;Dear mister robber, since you can’t really use the phone, I’m preparing to rebuy it from you. All my best!&#8217; This happened on Saturday. On Sunday, I’d checked again the search app and the phone was still offline and at same place.&#8221;</p>
<p>But the following day he began receiving text messages stating that his phone had been recovered.</p>
<p>&#8220;On Monday, I’d started to receive SMS messages saying that my iphone had been found and a URL to reach it,&#8221; Rabin said. Here&#8217;s a screenshot of one of those texts:</p>
<p><img class="aligncenter size-full wp-image-38232" src="media/3ea3193e.buscariphonetext.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/buscariphonetext.png" alt="buscariphonetext" width="486" height="629" /></p>
<p>The link led to a page that looks exactly like the Brazilian version of Apple&#8217;s sign-in page, but which is hosted on a site that allows free Web hosting.</p>
<p><img class="aligncenter size-medium wp-image-38233" src="media/d1804748.fakeapple-580x383.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/fakeapple-580x383.png" alt="fakeapple" width="580" height="383" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/02/fakeapple-580x383.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/02/fakeapple-768x507.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/02/fakeapple-940x620.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/02/fakeapple.png 1454w" sizes="(max-width: 580px) 100vw, 580px" /><span id="more-38224"></span></p>
<p>Rabin said he didn&#8217;t fall for the ruse, but that he imagines the scam would trick quite a few people who have lost their iPhone and are anxious to get it back.</p>
<p>Leave the &#8220;icloud&#8221; off the end of that texted URL and we can see a phony copy of Apple&#8217;s &#8220;Find My iPhone&#8221; login page that is still live (the hosting provider has been notified):</p>
<div id="attachment_38231" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-38231" src="media/8cf25965.buscar-iphone-580x366.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/buscar-iphone-580x366.png" alt="A &quot;Find my iPhone&quot; phishing page used by the robbers." width="580" height="366" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/02/buscar-iphone-580x366.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/02/buscar-iphone-768x484.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/02/buscar-iphone-940x593.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/02/buscar-iphone.png 1113w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A &#8220;Find my iPhone&#8221; phishing page used by the robbers.</p></div>
<p>But the scammers didn&#8217;t stop there in trying to phish the Apple ID and password for his iPhone account. Rabin said that just two days later, he received an odd, automated call on his mobile.</p>
<p>&#8220;It came from a strange number and a voice sounding like Siri or the [Google] Waze voice, informing me that my iPhone had been found and to look for my SMS for more info,&#8221; Rabin said. &#8220;That’s when I thought I had to tell this story to someone. To me, it really got to another level, connecting the lowest kind of criminals to a high profile one (probably went to school and college) that can buy (or even create) this kind of scam.&#8221;</p>
<p>The high cost of smart phones makes mobile device theft a serious problem everywhere in the world, not just Brazil. If you use an Apple device, it&#8217;s a good idea to turn on the &#8220;Find My iPhone&#8221; feature using the <a href="http://itunes.apple.com/us/app/find-my-iphone/id376101648?mt=8%5C%5C" target="_blank">Find My iPhone App</a>, so that when or if the device gets lost you can located it by signing into <a href="http://icloud.com/find" target="_blank">icloud.com/find</a>.</p>
<p>If your Apple device is lost or stolen, check out <a href="https://support.apple.com/en-us/HT201472" target="_blank">Apple&#8217;s advice</a> on how to manage the loss, depending on the severity of the situation. In Rabin&#8217;s case, even though the phone is currently turned off, he has the options to put it in &#8220;Lost mode,&#8221; &#8220;lock it,&#8221; or &#8220;remotely erase it.&#8221; The next time your device is online, these actions will take effect.</p>
<p>Also, try to make a habit of regularly synching your device to your computer, so that in the event your phone is lost or stolen your data is backed up and you don&#8217;t have to worry about remotely wiping important data that may not already be saved locally.</p>


feed_id: https://krebsonsecurity.com/?p=37162
title: More on Bluetooth Ingenico Overlay Skimmers
uri: More-on-Bluetooth-Ingenico-Overlay-Skimmers
url: https://krebsonsecurity.com/2017/02/more-on-bluetooth-ingenico-overlay-skimmers/
content:
<p>This blog has featured <a href="https://krebsonsecurity.com/?s=ingenico+and+skimmer&amp;x=0&amp;y=0" target="_blank">several stories</a> about &#8220;overlay&#8221; card and PIN skimmers made to be placed atop Ingenico-brand card readers at store self-checkout lanes. I&#8217;m revisiting the topic again because a security technician at a U.S.-based retailer recently shared a few photos of several of these devices pulled from compromised card terminals, and the images and his story offer a fair bit more detail than in previous articles.</p>
<div id="attachment_38241" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-38241" src="media/f633329a.ped3-Copy-580x431.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/ped3-Copy-580x431.jpg" alt="An &quot;overlay&quot; skimming device (right) that was found attached to a card reader at a retail establishment." width="580" height="431" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/02/ped3-Copy-580x431.jpg 580w, http://krebsonsecurity.com/wp-content/uploads/2017/02/ped3-Copy-768x570.jpg 768w, http://krebsonsecurity.com/wp-content/uploads/2017/02/ped3-Copy-940x698.jpg 940w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">An &#8220;overlay&#8221; skimming device (right) that was found attached to a card reader at a retail establishment.</p></div>
<p>The device featured here is a Bluetooth-based skimmer; it is designed to steal both the card data when a customer swipes and to record the victim&#8217;s PIN using a PIN pad overlay.</p>
<p>The Bluetooth component of the skimmer allows the thieves to retrieve stolen data wirelessly via virtually any Bluetooth enabled device &#8212; just by being in proximity to the compromised card terminal (~30 meters).</p>
<p>If we look on the backside of this skimmer, we can see the electronics needed to intercept the PIN. The source who shared these pictures said an employee thought the PIN pad buttons were a little too difficult to press down, and soon discovered this plastic overlay and others just like it on two more self-checkout terminals.</p>
<p><img class="aligncenter size-medium wp-image-38242" src="media/83f013c3.PED1-580x431.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/PED1-580x431.jpg" alt="PED1" width="580" height="431" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/02/PED1-580x431.jpg 580w, http://krebsonsecurity.com/wp-content/uploads/2017/02/PED1-768x570.jpg 768w, http://krebsonsecurity.com/wp-content/uploads/2017/02/PED1-940x698.jpg 940w, http://krebsonsecurity.com/wp-content/uploads/2017/02/PED1.jpg 1560w" sizes="(max-width: 580px) 100vw, 580px" /><span id="more-37162"></span></p>
<p>Here&#8217;s a closeup of the electronics that power this skimmer (sorry, this is the highest resolution photo available):</p>
<p><img class="aligncenter size-medium wp-image-38243" src="media/1d707cec.closeupe-580x434.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/closeupe-580x434.png" alt="closeupe" width="580" height="434" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/02/closeupe-580x434.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/02/closeupe.png 685w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>This model of overlay skimmers appears to be quite similar to a version sold in the cybercrime underground and detailed <a href="https://krebsonsecurity.com/2016/10/self-checkout-skimmers-go-bluetooth/" target="_blank">in this post</a>.</p>
<p>According to my retail source who shared these pictures, the overlay skimmers used parts cannibalized from Samsung smart phones. The source said the devices placed themselves in a mode to transmit stolen card data and PINs as soon as they were turned off and back on again. Investigators also discovered that they could connect via Bluetooth to the skimming devices by entering the PIN &#8220;2016&#8221; on a Bluetooth-enabled wireless device.</p>
<p>However, the source said none of the overlay skimmers they found appeared to have any on-board data storage, suggesting the thieves had planted a second wireless device somewhere in or near the store and were hoovering up card and PIN data via Bluetooth in real time. Or, perhaps the crooks were simply sitting outside the store in the parking lot, using a laptop and high-gain antenna to pull down card and PIN data.</p>
<p><img class="alignright size-full wp-image-38270" src="media/0a801195.skimside.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/02/skimside.png" alt="skimside" width="236" height="318" />&#8220;We combed the property for something like an old cell phone gathering data, but we didn&#8217;t find anything,&#8221; the source told KrebsOnSecurity.</p>
<p>Customers generally are the first line of defense against these types of scams. Not long ago, KrebsOnSecurity published a post on how to spot Ingenico self-checkout skimmers. Unfortunately, most of the telltale signs are only noticeable if you are already well familiar with the appearance of a legitimate Ingenico ISC 250 terminal. Nevertheless, most of these skimmers will detach themselves with a gentle tug on the card reader.</p>
<p>For more tips on spotting these Ingenico overlay skimmers, <a href="https://krebsonsecurity.com/2016/06/how-to-spot-ingenico-self-checkout-skimmers/" target="_blank">check out this post</a>. Want to read more about skimming devices, check out my series, <a href="https://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers</a>.</p>


feed_id: https://krebsonsecurity.com/?p=38285
title: Ransomware for Dummies: Anyone Can Do It
uri: Ransomware-for-Dummies-Anyone-Can-Do-It
url: https://krebsonsecurity.com/2017/03/ransomware-for-dummies-anyone-can-do-it/
content:
<p>Among today&#8217;s fastest-growing cybercrime epidemics is &#8220;ransomware,&#8221; malicious software that encrypts your computer files, photos, music and documents and then demands payment in Bitcoin to recover access to the files. A big reason for the steep increase in ransomware attacks in recent years comes from the proliferation of point-and-click tools sold in the cybercrime underground that make it stupid simple for anyone to begin extorting others for money.</p>
<p>Recently, I came across an extremely slick and professionally produced video advertisement promoting the features and usability of &#8220;Philadelphia,&#8221; a ransomware-as-a-service crimeware package that is sold for roughly $400 to would-be cybercriminals who dream of carving out their own ransomware empires.</p>
<p>This stunning advertisement does a thorough job of showcasing Philadelphia&#8217;s many features, including the ability to generate PDF reports and charts of victims &#8220;to track your malware campaigns&#8221; as well as the ability to plot victims around the world using Google Maps.</p>
<p>&#8220;Everything just works,&#8221; claim the proprietors of Philadelphia. &#8220;Get your lifetime copy. One payment. Free updates. No monthly fees.&#8221;</p>
<p>One interesting feature of this ransomware package is the ability to grant what the program&#8217;s architects call &#8220;mercy.&#8221; This refers to the desperate and heartbreaking pleas that ransomware purveyors often hear from impecunious victims whose infections have jeopardized some priceless and irreplaceable data &#8212; such as photos of long lost loved ones.</p>
<p>I&#8217;ll revisit the authors of this ransomware package in a future post. For now, just check out their ad. It&#8217;s fairly chilling.</p>
<div style="text-align: center;"><iframe src="http://www.youtube.com/embed/g-9pkLwOjC4" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>


feed_id: https://krebsonsecurity.com/?p=38309
title: Payments Giant Verifone Investigating Breach
uri: Payments-Giant-Verifone-Investigating-Breach
url: https://krebsonsecurity.com/2017/03/payments-giant-verifone-investigating-breach/
content:
<p>Credit and debit card payments giant <strong>Verifone</strong> [<a href="https://www.google.com/search?q=%22verifone+largest%22&amp;oq=%22verifone+largest%22&amp;aqs=chrome..69i57j0l2.5583j0j4&amp;sourceid=chrome&amp;ie=UTF-8#q=NYSE:PAY&amp;stick=H4sIAAAAAAAAAONgecRoyi3w8sc9YSmdSWtOXmNU4-IKzsgvd80rySypFJLgYoOy-KR4uLj0c_UNzKtyLC0seADs-Rb9OgAAAA&amp;*" target="_blank">NYSE: PAY</a>] is investigating a breach of its internal computer networks that appears to have impacted a number of companies running its point-of-sale solutions, according to sources. Verifone says the extent of the breach was limited to its corporate network and that its payment services network was not impacted.</p>
<p>San Jose, Calif.-based Verifone is the <a href="https://www.bloomberg.com/news/articles/2016-09-29/once-the-credit-card-reader-to-beat-verifone-is-losing-its-grip" target="_blank">largest</a> maker of credit card terminals used in the United States. It sells point-of-sale terminals and services to support the swiping and processing of credit and debit card payments at a variety of businesses, including retailers, taxis, and fuel stations.</p>
<p>On Jan. 23, 2017, Verifone sent an &#8220;urgent&#8221; email to all company staff and contractors, warning they had 24 hours to change all company passwords.</p>
<p>&#8220;We are currently investigating an IT control matter in the Verifone environment,&#8221; reads an email memo penned by <strong>Steve Horan</strong>, Verifone Inc.&#8217;s senior vice president and chief information officer. &#8220;As a precaution, we are taking immediate steps to improve our controls.&#8221;</p>
<div id="attachment_38316" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/812773f0.verif1.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/verif1.png"><img class="wp-image-38316 size-medium" src="media/914328d1.verif1-580x706.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/verif1-580x706.png" alt="An internal memo sent by Verifone's chief information officer to all staff and contractors, telling them to change their passwords. The memo also users would no longer be able to install software at will, apparently something everyone at the company could do prior to this notice." width="580" height="706" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/verif1-580x706.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/verif1.png 728w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">An internal memo sent Jan. 23, 2017 by Verifone&#8217;s chief information officer to all staff and contractors, telling them to change their passwords. The memo also states that Verifone employees would no longer be able to install software at will, apparently something everyone at the company could do prior to this notice.</p></div>
<p>The internal Verifone memo &#8212; a copy of which was obtained by KrebsOnSecurity and is pictured above &#8212; also informed employees they would no longer be allowed to install software of any kind on company computers and laptops.</p>
<p>Asked about the breach reports, a Verifone spokesman said the company saw evidence in January 2017 of an intrusion in a &#8220;limited portion&#8221; of its internal network, but that the breach never impacted its payment services network.</p>
<div id="attachment_38321" style="width: 308px" class="wp-caption alignright"><a class="lightbox" href="media/7e4c5c4b.verifonefuel.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/verifonefuel.png"><img class="wp-image-38321" src="media/beb368fc.verifonefuel-580x653.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/verifonefuel-580x653.png" alt="An ad tied to Verifone's petroleum services point-of-sale offerings." width="298" height="335" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/verifonefuel-580x653.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/verifonefuel.png 741w" sizes="(max-width: 298px) 100vw, 298px" /></a><p class="wp-caption-text">An ad tied to Verifone&#8217;s petroleum services point-of-sale offerings.</p></div>
<p>&#8220;In January 2017, Verifone’s information security team saw evidence of a limited cyber intrusion into our corporate network,&#8221; Verifone spokesman <strong>Andy Payment</strong> said. &#8220;Our payment services network was not impacted. We immediately began work to determine the type of information targeted and executed appropriate measures in response. We believe today that due to our immediate response, the potential for misuse of information is limited.&#8221;</p>
<p>Verifone&#8217;s Mr. Payment declined to answer additional questions about the breach, such as how Verifone learned about it and whether the company was initially notified by an outside party. But a source with knowledge of the matter told KrebsOnSecurity.com that the employee alert Verifone sent out on Jan, 23, 2017 was in response to a notification that Verifone received from the credit card companies <strong>Visa</strong> and <strong>Mastercard</strong> just days earlier in January.</p>
<p>A spokesperson for Visa declined to comment for this story. MasterCard officials did not respond to requests for comment.</p>
<p>According to my source, the intrusion impacted at least one corner of Verifone&#8217;s business: A customer support <a href="http://www.verifone.com/products/hardware/petro-pos-systems/" target="_blank">unit based in Clearwater, Fla.</a> that provides comprehensive payment solutions specifically to gas and petrol stations throughout the United States &#8212; including, pay-at-the-pump credit card processing; physical cash registers inside the fuel station store; customer loyalty programs; and remote technical support.</p>
<p>The source said his employer shared with the card brands evidence that a Russian hacking group known for targeting payment providers and hospitality firms had compromised at least a portion of Verifone&#8217;s internal network.</p>
<p><span class="pullquote pqright">The source says Visa and MasterCard were notified that the intruders appeared to have been inside of Verifone&#8217;s network since mid-2016.</span> The source noted there is ample evidence the attackers used some of the same toolsets and infrastructure as the cybercrime gang that last year is thought to have <a href="https://krebsonsecurity.com/2016/08/data-breach-at-oracles-micros-point-of-sale-division/" target="_blank">hacked into Oracle&#8217;s MICROS division</a>, a unit of Oracle that provides point-of-sale solutions to hundreds of thousands of retailers and hospitality firms.</p>
<p>Founded in Hawaii, U.S. in 1981, Verifone now operates in more than 150 countries worldwide and employ nearly 5,000 people globally.</p>
<p><strong>Update, 1:17 p.m. ET: </strong>Verifone circled back post-publication with the following update to their statement: &#8220;According to the forensic information to-date, the cyber attempt was limited to controllers at approximately two dozen gas stations, and occurred over a short time frame.  We believe that no other merchants were targeted and the integrity of our networks and merchants’ payment terminals remain secure and fully operational.&#8221;</p>
<p><span id="more-38309"></span></p>
<h4>ANALYSIS</h4>
<p>In the MICROS breach, the intruders used a crimeware-as-a-service network called <a href="https://krebsonsecurity.com/tag/carbanak/" target="_blank">Carbanak</a>, also known as Anunak. In that incident, the attackers compromised Oracle&#8217;s ticking portal that Oracle uses to help MICROS&#8217;s hospitality customers remotely troubleshoot problems with their point-of-sale systems. The attackers reportedly used that access to plant malware on the support server so they could siphon MICROS customer usernames and passwords when those customers logged in to the support site.</p>
<p>Oracle&#8217;s very few public statements about that incident made it clear that the attackers were after information that could get them inside the electronic tills run by the company&#8217;s customers &#8212; not Oracle&#8217;s cloud or other service offerings. The company acknowledged that it had &#8220;detected and addressed malicious code in certain legacy Micros systems,&#8221; and that it had asked all MICROS customers to reset their passwords.</p>
<p><strong>Avivah Litan</strong>, a financial fraud and endpoint solutions analyst for <a href="https://www.gartner.com/analyst/12030/Avivah-Litan" target="_blank">Gartner Inc.</a>, said the attackers in the Verifone breach probably also were after anything that would allow them to access customer payment terminals.</p>
<p>&#8220;The worst thing is the attackers have information on the point-of-sale systems that lets them put backdoors on the devices that can record, store and transmit stolen customer card data,&#8221; Litan said. &#8220;It sounds like they were after point-of-sale software information, whether the POS designs, the source code, or signing keys. Also, the company says it believes it stopped the breach in time, and that usually means they don&#8217;t know if they did. The bottom line is it&#8217;s very serious when the Verifone system gets breached.&#8221;</p>
<p>Verifone&#8217;s Jan. 23 &#8220;urgent&#8221; alert to its staff and contractors suggested that &#8212; prior to the intrusion &#8212; all employees were free to install or remove software at will. Litan said such policies are not uncommon and they certainly make it simpler for businesses to get work done, but she cautioned that allowing every user to install software anytime makes it easier for a hacker to do the same across multiple systems after compromising just a single machine inside the network.</p>
<p>&#8220;It sounds like [Verifone] found some malware in their network that must have come from an employee desktop because now they&#8217;re locking that down,&#8221; Litan said. &#8220;But the next step for these attackers is lateral movement within the victim&#8217;s network. And it&#8217;s not just within Verifone&#8217;s network at that point, it potentially expands to any connected partner network or through trusted zones.&#8221;</p>
<p>Litan said many companies choose to &#8220;whitelist&#8221; applications that they know and trust, but to block all others. She said the solutions can dramatically bring down the success rate of attacks, but that users tend to resist and dislike being restricted on their work devices.</p>
<p>&#8220;Most companies don’t put in whitelists because it’s hard to manage. But that&#8217;s hardly an excuse for not doing it. Whitelisting is very effective, it’s just a pain in the neck for users. You have to have a process and policies in place to support whitelisting, but it&#8217;s certainly doable. Yes, it&#8217;s been beaten in targeted attacks before &#8212; where criminals get inside and steal the code-signing keys, but it&#8217;s still probably the strongest endpoint security organizations can put in place.&#8221;</p>
<p>Verifone would not respond to questions about the duration of the breach in its corporate networks. But if, as sources say, this breach lasted more than six months, that&#8217;s an awful long time for an extremely skilled adversary to wander around inside your network undetected. Whether the intruders were able to progress from one segment of Verifone&#8217;s network to another would depend much on how segmented Verifone&#8217;s network is, as well as the robustness of security surrounding its various corporate divisions and many company acquisitions over the years.</p>
<p>The thieves who hacked Target Corp. in 2013, for example, were able to communicate with virtually all company cash registers and other systems within the company&#8217;s network because Target&#8217;s internal network resembled a single canoe instead of a massive ship with digital bulkheads throughout the vessel to stop a tiny breach in the hull from sinking the entire ship. Check out <a href="https://krebsonsecurity.com/2015/09/inside-target-corp-days-after-2013-breach/" target="_blank">this story from Sept. 2015</a>, which looked at the results of a confidential security test Target commissioned just days after the breach (spoiler alert, the testers were able to talk to every Target cash register in all 2,000 stores after remotely commandeering a deli scale at a single Target store).</p>
<div id="attachment_38334" style="width: 204px" class="wp-caption alignleft"><a href="https://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/" target="_blank" rel="https://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/"><img class="wp-image-38334 size-full" src="media/22b08baa.mcdumpalsjoined.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/mcdumpalsjoined.png" alt="Curious how a stolen card shop works? Check out this story." width="194" height="340" /></a><p class="wp-caption-text">Curious how a stolen card shop works? Check out this story.</p></div>
<p>The card associations often require companies that handle credit cards to undergo a third-party security audit, but only if there is evidence that customer card data was compromised. That evidence usually comes in the form of banks reporting a pattern of fraud on customer cards that were all used at a particular merchant during the same time frame. However, those reports come slowly &#8212; if at all &#8212; and often trickle up to the card brands weeks or months after <a href="https://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/" target="_blank">stolen cards end up for sale in bulk on the cybercrime underground</a>.</p>
<p>Corporate network compromises or the theft of proprietary source code (e.g. the same code that goes on merchant payment devices) generally do not trigger a mandatory third-party investigation by a security firm approved by the card brands, Litan said, although she noted that breaches which can be shown to have a material financial impact on the company need to be disclosed to investors and securities regulators.</p>
<p>&#8220;There&#8217;s no rule anywhere that says you have to disclose if your software&#8217;s source code is stolen, but there should be,&#8221; Litan said. &#8220;Typically, when a company has a breach of their corporate network you think it might hurt the company, but in a case when the company&#8217;s software is stolen and that software is used to transmit credit card data then everyone else is hurt.&#8221;</p>
<p>Sources told KrebsOnSecurity that Verifone commissioned an investigation of the breach from <a href="http://www.foregenix.com/" target="_blank">Foregenix Ltd.</a>, a digital forensics firm based in the United Kingdom that <a href="http://www.foregenix.com/partners" target="_blank">lists</a> Verifone as a &#8220;strategic partner.&#8221; Foregenix declined to comment for this story.</p>
<h4>LOW-HANGING FRUIT</h4>
<p>Litan said if the attackers who broke into Verifone were indeed targeting payment systems in the filling station business, they were going after the lowest of the low-hanging fruit. The fuel station industry is chock-full of unattended, automated terminals that have special security dispensation from Visa and Mastercard: Fuel station owners have been given more time than almost any other industry to forestall costly security upgrades for new card terminals at gas pumps that are capable of reading more secure chip-enabled credit and debit cards.</p>
<p>The chip cards are an advancement mainly because they are far more difficult and costly for thieves to counterfeit or clone for use in face-to-face transactions &#8212; by far the most profitable form of credit card fraud (think gift cards and expensive gaming consoles that can easily be resold for cash).</p>
<p>After years of lagging behind the rest of the world &#8212; the United States is the last of the G20 nations to move to chip cards &#8212; most U.S. financial institutions are starting to issue chip-based cards to customers. However, many retailers and other card-accepting locations have been slow to accept chip based transactions even though they already have the hardware in place to accept chip cards (<a href="https://krebsonsecurity.com/2016/02/the-great-emv-fake-out-no-chip-for-you/" target="_blank">this piece</a> attempts to explain the &#8220;why&#8221; behind that slowness).</p>
<p>In contrast, chip-card readers are still a rarity at fuel pumps in the United States, and Litan said they will continue to be for several years. In December 2016, the card associations <a href="https://krebsonsecurity.com/2016/12/visa-delays-chip-deadline-for-pumps-to-2020/" target="_blank">announced they were giving fuel station owners until 2020</a> to migrate to chip-based readers.</p>
<p>Previously, fuel station owners that didn&#8217;t meet the October 2017 deadline to have chip-enabled readers at the pump would have been on the hook to absorb 100 percent of the costs of fraud associated with transactions in which the customer presented a chip-based card but was not asked or able to dip the chip. Now that they have another three years to get it done, thieves will continue to attack fuel station dispensers and other unattended terminals with skimmers and by attacking point-of-sale terminal hardware makers, integrators and resellers.</p>
<h4>HOW WOULD YOUR EMPLOYER FARE?</h4>
<p>My confidential source on this story said the closest public description of the email phishing schemes used by the Russian crime group behind both the MICROS and Verifone hacks comes in <a href="https://www.trustwave.com/Resources/SpiderLabs-Blog/Operation-Grand-Mars--a-comprehensive-profile-of-Carbanak-activity-in-2016/17/" target="_blank">a report earlier this year from <strong>Trustwave</strong></a>, a security firm that often gets called in to investigate third-party data breaches. In that analysis, Trustwave describes an organized crime gang that routinely sets up phony companies and corresponding fake Web sites to make its targeted email phishing lures appear even more convincing.</p>
<div id="attachment_38332" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-38332" src="media/333ddf56.Trustwavephishing-580x147.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/Trustwavephishing-580x147.png" alt="A phishing lure used in a malware campaign by the same group that allegedly broke into MICROS and Verifone. Source: Trustwave Grand Mars report." width="580" height="147" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/Trustwavephishing-580x147.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/Trustwavephishing-768x195.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/Trustwavephishing-940x238.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/Trustwavephishing.png 951w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A phishing lure used in a malware campaign by the same group that allegedly broke into MICROS and Verifone. Source: Trustwave Grand Mars report.</p></div>
<p>The messages from this group usually include a <strong>Microsoft Office</strong> (Word or Excel) document that has been booby-trapped with malicious scripts known as &#8220;macros.&#8221; Microsoft disables macros by default in recent versions of Office, but poisoned document lures often come with entreaties that prompt recipients to override Microsoft&#8217;s warnings and enable them manually.</p>
<p>Trustwave&#8217;s report cites two examples of this social engineering; one in which an image file is used to obscure a warning sign (see below), and another in which the cleverly-crafted phishing email was accompanied by <a href="https://krebsonsecurity.com/2016/01/a-look-inside-cybercriminal-call-centers/" target="_blank">a phone call</a> from the fraudsters to walk the recipient through the process of manually overriding the macro security warnings (and in effect to launch the malware on the local network).</p>
<p>According to Trustwave, this Russian hacking group prefers to target companies in the hospitality industry, and is thought to be connected to the breaches at a string of hotel chains, including <a href="https://www.google.com/url?sa=t&amp;rct=j&amp;q=&amp;esrc=s&amp;source=web&amp;cd=2&amp;cad=rja&amp;uact=8&amp;ved=0ahUKEwiZjd7ex8PSAhXG5YMKHQ0eD2gQFggiMAE&amp;url=https%3A%2F%2Fkrebsonsecurity.com%2F2015%2F12%2Fmalware-driven-card-breach-at-hyatt-hotels%2F&amp;usg=AFQjCNH2nn6ge_FLBIYDxqbsDR46RtCaKA&amp;sig2=hALQfe-07HUnP9NpWoN5HQ">the card breach at Hyatt</a> that compromised customer credit and debit cards at some 250 hotels in roughly 50 countries throughout much of 2015.</p>
<p>In a common attack, the perpetrators would send a phishing email from a domain associated with a legitimate-looking but fake company that was inquiring about spending a great deal of money bringing many important guests to a specific property on a specific date. The emails are often sent to sales and event managers at these lodging facilities, with instructions for checking the attached (booby-trapped) document for specifics about guest and meeting room requirements.</p>
<div id="attachment_38333" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-38333" src="media/4b3dcd45.protecteddoc-580x470.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/protecteddoc-580x470.png" alt="This phishing lure prompts users to enable macros and then launch the malware by disguising it as a message file. Source: Trustwave." width="580" height="470" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/protecteddoc-580x470.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/protecteddoc.png 723w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">This phishing lure prompts users to enable macros and then launch the malware by disguising it as a message file. Source: Trustwave.</p></div>


feed_id: https://krebsonsecurity.com/?p=38367
title: WikiLeaks Dumps Docs on CIA’s Hacking Tools
uri: WikiLeaks-Dumps-Docs-on-CIA-s-Hacking-Tools
url: https://krebsonsecurity.com/2017/03/wikileaks-dumps-docs-on-cias-hacking-tools/
content:
<p><strong>WikiLeaks</strong> on Tuesday dropped one of its most explosive word bombs ever: A secret trove of documents apparently stolen from the <strong>U.S. Central Intelligence Agency (CIA)</strong> detailing methods of hacking everything from smart phones and TVs to compromising Internet routers and computers. KrebsOnSecurity is still digesting much of this fascinating data cache, but here are some first impressions based on what I&#8217;ve seen so far.</p>
<p>First, to quickly recap what happened: In a post on its site, WikiLeaks said the release &#8212; <a href="https://wikileaks.org/ciav7p1/" target="_blank">dubbed &#8220;Vault 7&#8221;</a> &#8212; was the largest-ever publication of confidential documents on the agency. WikiLeaks is promising a series of these document caches; this first one includes more than 8,700 files allegedly taken from a high-security network inside <strong>CIA&#8217;s Center for Cyber Intelligence</strong> in Langley, Va.</p>
<div id="attachment_38380" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-38380" src="media/8b078c5e.samsung-cia-580x424.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/samsung-cia-580x424.png" alt="The home page for the CIA's &quot;Weeping Angel&quot; project, which sought to exploit flaws that could turn certain 2013-model Samsung &quot;smart&quot; TVs into remote listening posts." width="580" height="424" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/samsung-cia-580x424.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/samsung-cia-768x561.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/samsung-cia-940x686.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/samsung-cia.png 997w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The home page for the CIA&#8217;s &#8220;Weeping Angel&#8221; project, which sought to exploit flaws that could turn certain 2013-model Samsung &#8220;smart&#8221; TVs into remote listening posts.</p></div>
<p>&#8220;Recently, the CIA lost control of the majority of its hacking arsenal including malware, viruses, trojans, weaponized &#8216;zero day&#8217; exploits, malware remote control systems and associated documentation,&#8221; WikiLeaks wrote. &#8220;This extraordinary collection, which amounts to more than several hundred million lines of code, gives its possessor the entire hacking capacity of the CIA. The archive appears to have been circulated among former U.S. government hackers and contractors in an unauthorized manner, one of whom has provided WikiLeaks with portions of the archive.&#8221;</p>
<p>Wikileaks said it was calling attention to the CIA&#8217;s global covert hacking program, its malware arsenal and dozens of weaponized exploits against &#8220;a wide range of U.S. and European company products, include Apple&#8217;s iPhone, Google&#8217;s Android and Microsoft&#8217;s Windows and even Samsung TVs, which are turned into covert microphones.&#8221;</p>
<p>The documents for the most part don&#8217;t appear to include the computer code needed to exploit previously unknown flaws in these products, although WikiLeaks says that stuff may show up in a future dump. This collection is probably best thought of as an internal corporate wiki used by multiple CIA researchers who methodically found and documented weaknesses in a variety of popular commercial and consumer electronics.</p>
<p>For example, the data dump lists a number of exploit &#8220;modules&#8221; available to compromise various models of consumer routers made by companies like <a href="https://search.wikileaks.org/?query=linksys&amp;exact_phrase=&amp;any_of=&amp;exclude_words=&amp;document_date_start=&amp;document_date_end=&amp;released_date_start=&amp;released_date_end=&amp;publication_type%5B%5D=51&amp;new_search=False&amp;order_by=most_relevant#results" target="_blank">Linksys</a>, <a href="https://search.wikileaks.org/?query=microtik&amp;exact_phrase=&amp;any_of=&amp;exclude_words=&amp;document_date_start=&amp;document_date_end=&amp;released_date_start=&amp;released_date_end=&amp;publication_type%5B%5D=51&amp;new_search=False&amp;order_by=most_relevant#results" target="_blank">Microtik</a> and <a href="https://search.wikileaks.org/?query=Zyxel&amp;exact_phrase=&amp;any_of=&amp;exclude_words=&amp;document_date_start=&amp;document_date_end=&amp;released_date_start=&amp;released_date_end=&amp;publication_type%5B%5D=51&amp;new_search=False&amp;order_by=most_relevant#results" target="_blank">Zyxel</a>, to name a few. CIA researchers also collated several pages worth of probing and testing weaknesses in business-class devices from <a href="https://search.wikileaks.org/?query=cisco&amp;exact_phrase=&amp;any_of=&amp;exclude_words=&amp;document_date_start=&amp;document_date_end=&amp;released_date_start=&amp;released_date_end=&amp;publication_type%5B%5D=51&amp;new_search=False&amp;order_by=most_relevant#results" target="_blank">Cisco</a><strong>, </strong>whose powerful routers carry a decent portion of the Internet&#8217;s traffic on any given day. <strong>Craig Dods</strong>, a researcher with Cisco&#8217;s rival <strong>Juniper</strong>, <a href="https://www.linkedin.com/pulse/cia-hacking-tools-review-cisco-primary-target-craig-dods" target="_blank">delves into greater detail</a> on the Cisco bugs for anyone interested (Dods says he found no exploits for Juniper products in the cache, yet).</p>
<h4>WHILE MY SMART TV GENTLY WEEPS</h4>
<p>Some of the exploits discussed in these leaked CIA documents appear to reference full-on, remote access vulnerabilities. However, a great many of the documents I&#8217;ve looked at seem to refer to attack concepts or half-finished exploits that may be limited by very specific requirements &#8212; such as physical access to the targeted device.</p>
<p>The &#8220;<strong>Weeping Angel</strong>&#8221; <a href="https://wikileaks.org/ciav7p1/cms/page_12353643.html" target="_blank">project&#8217;s page</a> from 2014 is a prime example: It discusses ways to turn certain 2013-model <strong>Samsung</strong> &#8220;smart TVs&#8221; into remote listening devices; methods for disabling the LED lights that indicate the TV is on; and suggestions for fixing a problem with the exploit in which the WiFi interface on the TV is disabled when the exploit is run.</p>
<blockquote><p>ToDo / Future Work:<br />
Build a console cable</p>
<p>Turn on or leave WiFi turned on in Fake-Off mode</p>
<p>Parse unencrypted audio collection<br />
Clean-up the file format of saved audio. Add encryption??</p></blockquote>
<p>According to the documentation, Weeping Angel worked as long as the target hadn&#8217;t upgraded the firmware on the Samsung TVs, and that the firmware upgrade eliminated the &#8220;current installation method,&#8221; which apparently required the insertion of a booby-trapped USB device into the TV.</p>
<p>Don&#8217;t get me wrong: This is a serious leak of fairly sensitive information. And I sincerely hope Wikileaks decides to work with researchers and vendors to coordinate the patching of flaws leveraged by the as-yet unreleased exploit code archive that apparently accompanies this documentation from the CIA.</p>
<p>But in reading the media coverage of this leak, one might be led to believe that even if you are among the small minority of Americans who have chosen to migrate more of their communications to privacy-enhancing technologies like <strong>Signal</strong> or <strong>WhatsApp</strong>, it&#8217;s all futility because the CIA can break it anyway.</p>
<p>Perhaps a future cache of documents from this CIA division will change things on this front, but an admittedly cursory examination of these documents indicates that the CIA&#8217;s methods for weakening the privacy of these tools all seem to require attackers to first succeed in deeply subverting the security of the mobile device &#8212; either through a remote-access vulnerability in the underlying operating system or via physical access to the target&#8217;s phone.</p>
<p>As Bloomberg&#8217;s tech op-ed writer <strong>Leonid Bershidsky</strong> <a href="https://www.bloomberg.com/view/articles/2017-03-08/wikileaks-cia-revelations-look-like-a-dud-for-now" target="_blank">notes</a>, the documentation released here shows that these attacks are &#8220;not about mass surveillance &#8212; something that should bother the vast majority of internet users &#8212; but about monitoring specific targets.&#8221;</p>
<p>By way of example, Bershidsky points to <a href="https://twitter.com/whispersystems/status/839204754718932992" target="_blank">a tweet yesterday</a> from <strong>Open Whisper Systems</strong> (the makers of the Signal private messaging app) which observes that, &#8220;The CIA/Wikileaks story today is about getting malware onto phones, none of the exploits are in Signal or break Signal Protocol encryption.&#8221;</p>
<p>The company went on to say that because more online services are now using end-to-end encryption to prevent prying eyes from reading communications that are intercepted in-transit, intelligence agencies are being pushed &#8220;from undetectable mass surveillance to expensive, high-risk, targeted attacks.&#8221;</p>
<div id="attachment_38381" style="width: 587px" class="wp-caption aligncenter"><img class="size-full wp-image-38381" src="media/3f25fd38.ows-tweet.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/ows-tweet.png" alt="A tweet from Open Whisper Systems, the makers of the popular mobile privacy app Signal." width="577" height="326" /><p class="wp-caption-text">A tweet from Open Whisper Systems, the makers of the popular mobile privacy app Signal.</p></div>
<p><span id="more-38367"></span>As limited as some of these exploits appear to be, the methodical approach of the countless CIA researchers who apparently collaborated to unearth these flaws is impressive and speaks to a key problem with most commercial hardware and software today: The vast majority of vendors would rather spend the time and money marketing their products than embark on the costly, frustrating, time-consuming and continuous process of stress-testing their own products and working with a range of researchers to find these types of vulnerabilities before the CIA or other nation-state-level hackers can.</p>
<p>Of course, not every company has a budget of hundreds of millions of dollars just to do basic security research. According to <a href="http://www.nbcnews.com/news/us-news/cia-prepping-possible-cyber-strike-against-russia-n666636" target="_blank">this NBC News report</a> from October 2016, the CIA&#8217;s Center for Cyber Intelligence (the alleged source of the documents discussed in this story) has a staff of hundreds and a budget in the hundreds of millions: Documents leaked by NSA whistleblower <strong>Edward Snowden</strong> indicate the CIA requested $685.4 million for computer network operations in 2013, compared to $1 billion by the <strong>U.S. National Security Agency</strong> (NSA).</p>
<h4>TURNABOUT IS FAIR PLAY?</h4>
<p>NBC also reported that the CIA&#8217;s Center for Cyber Intelligence was tasked by the Obama administration last year to devise cyber attack strategies in response to Russia&#8217;s alleged involvement in the siphoning of emails from <strong>Democratic National Committee</strong> servers as well as from <strong>Hillary Clinton</strong>&#8216;s campaign chief <strong>John Podesta</strong>. Those emails were ultimately published online by Wikileaks last summer.</p>
<p>NBC reported that <span class="pullquote pqright">the &#8220;wide-ranging &#8216;clandestine&#8217; cyber operation designed to harass and &#8217;embarrass&#8217; the Kremlin leadership was being lead by the CIA&#8217;s Center for Cyber Intelligence.&#8221; Could this attack have been the Kremlin&#8217;s response to an action or actions by the CIA&#8217;s cyber center?</span> Perhaps time (or future leaks) will tell.</p>
<p>Speaking of the NSA, the Wikileaks dump comes hot on the heels of a similar disclosure by <a href="https://en.wikipedia.org/wiki/The_Shadow_Brokers" target="_blank">The Shadow Brokers</a>, a hacking group that said it stole malicious software from the <a href="https://en.wikipedia.org/wiki/Equation_Group" target="_blank">Equation Group</a>, a highly-skilled and advanced threat actor that has been closely tied to the NSA.</p>
<p>What&#8217;s interesting is this Wikileaks cache includes <a href="https://wikileaks.org/ciav7p1/cms/page_14588809.html" target="_blank">a longish discussion thread</a> among CIA employees who openly discuss where the NSA erred in allowing experts to tie the NSA&#8217;s coders to malware produced by the Equation Group. As someone who spends a great deal of time <a href="https://krebsonsecurity.com/category/breadcrumbs/" target="_blank">unmasking cybercriminals who invariably leak their identity and/or location</a> through poor operational security, I was utterly fascinated by this exchange.</p>
<h4>BUG BOUNTIES VS BUG STOCKPILES</h4>
<p>Many are using this latest deluge from WikiLeaks to reopen the debate over whether there is enough oversight of the CIA&#8217;s hacking activities. <em>The New York Times</em> <a href="https://www.nytimes.com/2017/03/07/world/europe/wikileaks-cia-hacking.html?emc=edit_na_20170307&amp;nl=breaking-news&amp;nlid=66044131&amp;ref=headline" target="_blank">called</a> yesterday&#8217;s WikiLeaks disclosure &#8220;the latest coup for the antisecrecy organization and a serious blow to the CIA, which uses its hacking abilities to carry out espionage against foreign targets.&#8221;</p>
<p>The WikiLeaks scandal also revisits the question of whether the U.S. government should instead of hoarding and stockpiling vulnerabilities be more open and transparent about its findings &#8212; or at least work privately with software vendors to get the bugs fixed for the greater good. After all, these advocates argue, the United States is perhaps the most technologically-dependent country on Earth: Surely we have the most to lose when (not if) these exploits get leaked? Wouldn&#8217;t it be better and cheaper if everyone who produced software sought to crowdsource the hardening of their products?</p>
<p>On that front, my email inbox was positively peppered Tuesday with emails from organizations that run &#8220;bug bounty&#8221; programs on behalf of corporations. These programs seek to discourage &#8220;full disclosure&#8221; approach &#8212; e.g., a researcher releasing exploit code for a previously unknown bug and giving the affected vendor exactly zero days to fix the problem before the public finds out how to exploit it (hence the term &#8220;zero-day&#8221; exploit). Rather, the bug bounties encourage security researchers to work closely and discreetly with software vendors to fix security vulnerabilities &#8212; sometimes in exchange for monetary reward and sometimes just for public recognition.</p>
<p><strong>Casey Ellis</strong>, chief executive officer and founder of bug bounty program <a href="https://www.bugcrowd.com" target="_blank">Bugcrowd</a>, suggested the CIA WikiLeaks disclosure will help criminal groups and other adversaries, while leaving security teams scrambling.</p>
<p>&#8220;In this mix there are the targeted vendors who, before today, were likely unaware of the specific vulnerabilities these exploits were targeting,&#8221; Ellis said. &#8220;Right now, the security teams are pulling apart the Wikileaks dump, performing technical analysis, assessing and prioritizing the risk to their products and the people who use them, and instructing the engineering teams towards creating patches. The net outcome over the long-term is actually a good thing for Internet security &#8212; the vulnerabilities that were exploited by these tools will be patched, and the risk to consumers reduced as a result &#8212; but for now we are entering yet another Shadow Brokers, Stuxnet, Flame, Duqu, etc., a period of actively exploitable 0-day bouncing around in the wild.&#8221;</p>
<p>Ellis said that &#8212; in an ironic way, one could say that Wikileaks, the CIA, and the original exploit authors &#8220;have combined to provide the same knowledge as the &#8216;good old days&#8217; of full disclosure &#8212; but with far less control and a great many more side-effects than if the vendors were to take the initiative themselves.&#8221;</p>
<p>&#8220;This, in part, is why the full disclosure approach evolved into the coordinated disclosure and <span class="il">bug</span> <span class="il">bounty</span> models becoming commonplace today,&#8221; Ellis said in a written statement. &#8220;Stories like that of Wikileaks today are less and less surprising and to some extent are starting to be normalized. It’s only when the pain of doing nothing exceeds the pain of change that the majority of organizations will shift to an proactive vulnerability discovery strategy and the vulnerabilities exploited by these toolkits &#8212; and the risk those vulnerabilities create for the Internet &#8212; will become less and less common.&#8221;</p>
<p>Many observers &#8212; including a number of cybersecurity professional friends of mine &#8212; have become somewhat inured to these disclosures, and argue that this is exactly the sort of thing you might expect an agency like the CIA to be doing day in and day out. <strong>Omer Schneider</strong>, CEO at a startup called <strong>CyberX</strong>, seems to fall into this camp.</p>
<p>&#8220;The main issue here is not that the CIA has its own hacking tools or has a cache of zero-day exploits,&#8221; Schneider said. &#8220;Most nation-states have similar hacking tools, and they&#8217;re being used all the time. What&#8217;s surprising is that the general public is still shocked by stories like these. Regardless of the motives for publishing this, our concern is that Vault7 makes it even easier for a crop of new cyber-actors get in the game.&#8221;</p>
<p>This almost certainly won&#8217;t be the last time KrebsOnSecurity cites <a href="https://wikileaks.org/ciav7p1/cms/index.html" target="_blank">this week&#8217;s big CIA WikiLeaks trove</a>. But for now I&#8217;m interested to hear what you, Dear Readers, found most intriguing about it? Sound off in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=38414
title: WikiLeaks: We’ll Work With Software Makers on Zero-Days
uri: WikiLeaks-We-ll-Work-With-Software-Makers-on-Zero-Days
url: https://krebsonsecurity.com/2017/03/wikileaks-well-work-with-software-makers-on-zero-days/
content:
<p>When <strong>WikiLeaks</strong> on Tuesday <a href="https://krebsonsecurity.com/2017/03/wikileaks-dumps-docs-on-cias-hacking-tools/" target="_blank">dumped thousands of files</a> documenting hacking tools used by the <strong>U.S. Central Intelligence Agency</strong>, many feared WikiLeaks would soon publish a trove of so-called &#8220;zero days,&#8221; the actual computer code that the CIA uses to exploit previously unknown flaws in a range of software and hardware products used by consumers and businesses. But on Thursday, WikiLeaks editor-in-chief <strong>Julian Assange</strong> promised that his organization would work with hardware and software vendors to fix the security weaknesses prior to releasing additional details about the flaws.</p>
<p>&#8220;After considering what we think is the best way to proceed, and hearing these calls from some of the manufacturers, we have decided to work with them to give them exclusive access to additional technical details we have, so that fixes can be developed and pushed out,&#8221; Assange said in a press conference put on by his organization. &#8220;Once this material is effectively disarmed by us, we will publish additional details about what has been occurring.&#8221;</p>
<div id="attachment_38417" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-38417" src="media/faa79316.wiki0day-580x479.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/wiki0day-580x479.png" alt="Source: Twitter" width="580" height="479" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/wiki0day-580x479.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/wiki0day.png 591w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Source: Twitter</p></div>
<p>So-called &#8220;zero-day&#8221; flaws refer to vulnerabilities in hardware or software products that vendors first learn about when those flaws are already under active attack (i.e., the vendor has &#8220;zero days&#8221; to fix the vulnerability before it begins affecting its customers and users). Zero-day flaws are highly prized by cybercriminals and nation states alike because they potentially allow attackers to stealthily bypass a target&#8217;s digital defenses.</p>
<p>It&#8217;s unclear if WikiLeak&#8217;s decision to work with software makers on zero-days was impacted by a poll the organization took via its Twitter page over the past few days. The tweet read: &#8220;Tech companies are saying they need more details of CIA attack techniques to fix them faster. Should WikiLeaks work directly with them?&#8221;</p>
<p>So far, just over 38,000 people have responded, with a majority (57 percent) saying &#8220;Yes, make people safe,&#8221; while only 36 percent selected &#8220;no, they&#8217;re part of the problem.&#8221;</p>
<p>Assange didn&#8217;t offer additional details about the proposed information-sharing process he described, such as whether WikiLeaks would seek to work with affected vendors individually or if it might perhaps rely on a trusted third-party or third-parties to assist in that process.<span id="more-38414"></span></p>
<p>But WikiLeaks seemed eager to address concerns voiced by many tech experts that leaking details about how to exploit these cyber attack weapons developed by the CIA would leave consumers and businesses caught in the middle as crooks and individual actors attempt to use the exploits for personal or financial gain. Perhaps to assuage such concerns, Assange said his vision for WikiLeaks was to act as a &#8220;neutral digital Switzerland that assists people all over the world to be secure.&#8221;</p>
<p>Nevertheless, even just the documentation on the CIA&#8217;s hacking tools that was released this week may offer curious and skilled hackers some strong pointers about where to look for unpatched security flaws that could be used to compromise systems running those software products. It will be interesting to see if and how often security researchers and bug hunters going forward credit the WikiLeaks CIA document dump for leading their research in a direction they hadn&#8217;t before considered.</p>


feed_id: https://krebsonsecurity.com/?p=38363
title: Dahua, Hikvision IoT Devices Under Siege
uri: Dahua-Hikvision-IoT-Devices-Under-Siege
url: https://krebsonsecurity.com/2017/03/dahua-hikvision-iot-devices-under-siege/
content:
<p><strong>Dahua</strong>, the world&#8217;s second-largest maker of &#8220;Internet of Things&#8221; devices like security cameras and digital video recorders (DVRs), has shipped a software update that closes a gaping security hole in a broad swath of its products. The vulnerability allows anyone to bypass the login process for these devices and gain remote, direct control over vulnerable systems. Adding urgency to the situation, there is now code available online that allows anyone to exploit this bug and commandeer a large number of IoT devices.</p>
<p><img class="alignright wp-image-38431" src="media/4870a098.dahua.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/dahua.png" alt="dahua" width="254" height="219" />On March 5, a security researcher named <strong>Bashis</strong> posted to <a href="http://seclists.org/fulldisclosure/2017/Mar/7" target="_blank">the Full Disclosure security mailing list</a> exploit code for an embarrassingly simple flaw in the way many Dahua security cameras and DVRs handle authentication. These devices are designed to be controlled by a local Web server that is accessible via a Web browser.</p>
<p>That server requires the user to enter a username and password, but Bashis found he could force all affected devices to cough up their usernames and a simple hashed value of the password. Armed with this information, he could effectively &#8220;pass the hash&#8221; and the corresponding username right back to the Web server and be admitted access to the device settings page. From there, he could add users and install or modify the device&#8217;s software. From Full Disclosure:</p>
<blockquote><p>&#8220;This is so simple as:<br />
1. Remotely download the full user database with all credentials and permissions<br />
2. Choose whatever admin user, copy the login names and password hashes<br />
3. Use them as source to remotely login to the Dahua devices</p>
<p>&#8220;This is like a damn Hollywood hack, click on one button and you are in&#8230;&#8221;</p></blockquote>
<p>Bashis said he was so appalled at the discovery that he labeled it an apparent &#8220;backdoor&#8221; &#8212; an undocumented means of accessing an electronic device that often only the vendor knows about. Enraged, Bashis decided to publish his exploit code without first notifying Dahua. Later, Bashis said he changed his mind after being contacted by the company and agreed to remove his code from the online posting.</p>
<p>Unfortunately, that ship may have already sailed. Bashis&#8217;s exploit code already has been copied in several other places online as of this publication.</p>
<p>Asked why he took down his exploit code, Bashis said in an interview with KrebsOnSecurity that &#8220;The hack is too simple, way too simple, and now I want Dahua&#8217;s users to get patched firmware’s before they will be victims to some botnet.&#8221;</p>
<p>In an advisory published March 6, Dahua said it has identified nearly a dozen of its products that are vulnerable, and that further review may reveal additional models also have this flaw. The company is urging users to <a href="http://us.dahuasecurity.com/en/us/Security-Bulletin_030617.php" target="_blank">download and install the newest firmware updates</a> as soon as possible. Here are the models known to be affected so far:</p>
<p>DH-IPC-HDW23A0RN-ZS<br />
DH-IPC-HDBW23A0RN-ZS<br />
DH-IPC-HDBW13A0SN<br />
DH-IPC-HDW13A0SN<br />
DH-IPC-HFW13A0SN-W<br />
DH-IPC-HDBW13A0SN<br />
DH-IPC-HDW13A0SN<br />
DH-IPC-HFW13A0SN-W<br />
DHI-HCVR51A04HE-S3<br />
DHI-HCVR51A08HE-S3<br />
DHI-HCVR58A32S-S2</p>
<p>It&#8217;s not clear exactly how many devices worldwide may be vulnerable. Bashis says that&#8217;s a difficult question to answer, but that he &#8220;wouldn&#8217;t be surprised if 95 percent of Dahua&#8217;s product line has the same problem,&#8221; he said. &#8220;And also possible their OEM clones.&#8221;</p>
<p>Dahua has not yet responded to my questions or request for comment. I&#8217;ll update this post if things change on that front.</p>
<p>This is the second time in a week that a major Chinese IoT firm has urgently warned its customers to update the firmware on their devices. For weeks, experts have been warning that there are signs of attackers exploiting an unknown backdoor or equally serious vulnerability in cameras and DVR devices made by IoT giant <strong>Hikvision</strong>.<span id="more-38363"></span></p>
<p>Writing for video surveillance publication <strong>IPVM</strong>, <strong>Brian Karas</strong> <a href="https://ipvm.com/reports/hik-default-hack" target="_blank">reported on March 2</a> that he was hearing from multiple Hikvision security camera and DVR users who suddenly were locked out of their devices and had new &#8220;system&#8221; user accounts added without their permission.</p>
<p>Karas said the devices in question all were set up to be remotely accessible over the Internet, and were running with the default credentials (12345). Karas noted that there don&#8217;t appear to be any Hikvision devices sought out by the <a href="https://krebsonsecurity.com/?s=mirai&amp;x=0&amp;y=0" target="_blank">Mirai worm</a> &#8212; the <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank">now open-source malware</a> that is being used to enslave IoT devices in a botnet for launching crippling online attacks (in contrast, Dahua&#8217;s products are <a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" target="_blank">hugely represented in the list of systems being sought out by the Mirai worm</a>.)</p>
<p>In addition, a programmer who has long written and distributed custom firmware for Hikvision devices claims he&#8217;s found a backdoor in &#8220;many popular Hikvision products that makes it possible to gain full admin access to the device,&#8221; <a href="https://ipcamtalk.com/threads/backdoor-found-in-hikvision-cameras.17523/" target="_blank">wrote</a> the user &#8220;Montecrypto&#8221; on the IoT forum <strong>IPcamtalk</strong> on Mar. 5. &#8220;Hikvision gets two weeks to come forward, acknowledge, and explain why the backdoor is there and when it is going to be removed. I sent them an email. If nothing changes, I will publish all details on March 20th, along with the firmware that disables the backdoor.&#8221;</p>
<p>According to IPVM&#8217;s Karas, Hikvision has not acknowledged an unpatched backdoor or any other equivalent weakness in its product. But on Mar. 2, the company issued a reminder to its integrator partners about the need to be updated to the latest firmware.</p>
<div id="attachment_38430" style="width: 573px" class="wp-caption aligncenter"><img class="size-full wp-image-38430" src="media/06236cd5.hikvisionstatement.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/hikvisionstatement.png" alt="A special bulletin issued Mar. 2, 2017 by Hikvision. Image: IPVM" width="563" height="484" /><p class="wp-caption-text">A special bulletin issued Mar. 2, 2017 by Hikvision. Image: IPVM</p></div>
<p>&#8220;Hikvision has determined that there is a scripted application specifically targeting Hikvision NVRs and DVRs that meet the following conditions: they have not been updated to the latest firmware; they are set to the default port, default user name, and default password,&#8221; the company&#8217;s statement reads. &#8220;Hikvision has required secure activation since May of 2015, making it impossible for our integrator partners to install equipment with default settings. However, it was possible, before that date, for integrators to install NVRs and DVRs with default settings. Hikvision strongly recommends that our dealer base review the security levels of equipment installed prior to June 2015 to ensure the use of complex passwords and upgraded firmware to best protect their customers.&#8221;</p>
<h4>ANALYSIS</h4>
<p>I don&#8217;t agree with Bashis&#8217;s conclusion that the Dahua flaw was intentional; It appears that the makers of these products simply did not invest much energy, time or money in building security into the software. Rather, security is clearly an afterthought that is bolted on afterwards with these devices, which is why nobody should trust them.</p>
<p>The truth is that the software that runs on a whole mess of these security cameras and DVRs is very poorly written, and probably full of more security holes just like the flaw Dahua users are dealing with right now. To hope or wish otherwise given what we know about the history of these cheap electronic devices seems sheer folly.</p>
<p>In December, KrebsOnSecurity <a href="https://krebsonsecurity.com/2016/12/researchers-find-fresh-fodder-for-iot-attack-cannons/" target="_blank">warned</a> that many Sony security cameras contained a backdoor that can only be erased by updating the firmware on the devices.</p>
<p>Some security experts maintain that these types of flaws can&#8217;t be easily exploited when the IoT device in question is behind a firewall. But that advice just doesn&#8217;t hold water for today&#8217;s IoT cameras and DVRs. For one thing, a great many security cameras and other IoT devices will punch a hole in your firewall straight away without your permission, using a technology called <a href="https://en.wikipedia.org/wiki/Universal_Plug_and_Play" target="_blank">Universal Plug-and-Play</a> (UPnP).</p>
<p>In other cases, IoT products are incorporating <a href="https://krebsonsecurity.com/2016/02/this-is-why-people-fear-the-internet-of-things/" target="_blank">peer-to-peer (P2P) technology that cannot be turned off</a> and exposes users to even greater threats.  In that same December 2016 story referenced above, I cited research from security firm <strong>Cybereason</strong>, which found at least two previously unknown security flaws in dozens of IP camera families that are white-labeled under a number of different brands (and some without brands at all).</p>
<p>&#8220;Cybereason’s team found that they could easily exploit these devices even if they <em>were</em> set up behind a firewall,&#8221; that story noted. &#8220;That’s because all of these cameras ship with a factory-default peer-to-peer (P2P) communications capability that enables remote &#8216;cloud&#8217; access to the devices via the manufacturer’s Web site — provided a customer visits the site and provides the unique camera ID stamped on the bottom of the devices.&#8221;</p>
<p>The story continued:</p>
<p>&#8220;Although it may seem that attackers would need physical access to the vulnerable devices in order to derive those unique camera IDs, Cybereason’s principal security researcher <strong>Amit Serper</strong> said the company figured out a simple way to enumerate all possible camera IDs using the manufacturer’s Web site.&#8221;</p>
<p>My advice? Avoid the P2P models like the plague. If you have security cameras or DVR devices that are connected to the Internet, make sure they are up to date with the latest firmware. Beyond that, consider completely blocking external network access to the devices and enabling a VPN if you truly need remote access to them.</p>
<p><a href="https://www.howtogeek.com/221001/how-to-set-up-your-own-home-vpn-server/" target="_blank">Howtogeek.com</a> has a decent tutorial on setting up your own VPN to enable remote access to your home or business network; on picking a decent router that supports VPNs; and installing custom firmware like DD-WRT on the router if available (because, as we can see, stock firmware usually is some horribly insecure and shoddy stuff).</p>
<p>If you’re curious about an IoT device you purchased and what it might do after you connect it to a network, the information is there if you know how and where to look. <a href="http://lifehacker.com/how-to-tap-your-network-and-see-everything-that-happens-1649292940" target="_blank">This Lifehacker post</a> walks through some of the basic software tools and steps that even a novice can follow to learn more about what’s going on across a local network.</p>


feed_id: https://krebsonsecurity.com/?p=38361
title: If Your iPhone is Stolen, These Guys May Try to iPhish You
uri: If-Your-iPhone-is-Stolen-These-Guys-May-Try-to-iPhish-You
url: https://krebsonsecurity.com/2017/03/if-your-iphone-is-stolen-these-guys-may-try-to-iphish-you/
content:
<p>KrebsOnSecurity recently featured <a href="https://krebsonsecurity.com/2017/02/iphone-robbers-try-to-iphish-victims/" target="_blank">the story</a> of a Brazilian man who was peppered with phishing attacks trying to steal his Apple iCloud username and password after his wife&#8217;s phone was stolen in a brazen daylight mugging. Today, we&#8217;ll take an insider&#8217;s look at an Apple iCloud phishing gang that appears to work quite closely with organized crime rings &#8212; within the United States and beyond  &#8212; to remotely unlock and erase stolen Apple devices.</p>
<p>Victims of iPhone theft can use the Find My iPhone feature to remotely locate, lock or erase their iPhone &#8212; just by visiting Apple&#8217;s site and entering their iCloud username and password. Likewise, an iPhone thief can use those iCloud credentials to remotely unlock the victim&#8217;s stolen iPhone, wipe the device, and resell it. As a result, iPhone thieves often subcontract the theft of those credentials to third-party iCloud phishing services. This story is about one of those services.</p>
<div id="attachment_38528" style="width: 292px" class="wp-caption alignright"><a class="lightbox" href="media/e60d35cc.iserverlure.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/iserverlure.png"><img class="wp-image-38528" src="media/e60d35cc.iserverlure.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/iserverlure.png" alt="The iCloud account phishing text that John's friend received months after losing a family iPhone." width="282" height="311" /></a><p class="wp-caption-text">The iCloud account phishing text that John&#8217;s friend received months after losing a family iPhone.</p></div>
<p>Recently, I heard from a security professional whose close friend received a targeted attempt to phish his Apple iCloud credentials. The phishing attack came several months after the friend&#8217;s child lost his phone at a public park in Virginia. The phish arrived via text message and claimed to have been sent from Apple. It said the device tied to his son&#8217;s phone number had been found, and that its precise location could be seen for the next 24 hours by clicking a link embedded in the text message.</p>
<p>That security professional source &#8212; referred to as &#8220;John&#8221; for simplicity&#8217;s sake &#8212; declined to be named or credited in this story because some of the actions he took to gain the knowledge presented here may run afoul of U.S. computer fraud and abuse laws.</p>
<p>John said his friend clicked on the link in the text message he received about his son&#8217;s missing phone and was presented with a fake iCloud login page: <strong>appleid-applemx[dot]us</strong>. A lookup on that domain indicates it is hosted on a server in Russia that is or was shared by at least 140 other domains &#8212; mostly other apparent iCloud phishing sites &#8212; such as <strong>accounticloud[dot]site</strong>; <strong>apple-appleid[dot]store</strong>; <strong>apple-devicefound[dot]org</strong>; and so on (a full list of the domains at that server <a href="https://krebsonsecurity.com/wp-content/uploads/2017/03/domainsatiphonephishingscam.txt" target="_blank">is available here</a>).</p>
<p>While the phishing server may be hosted in Russia, its core users appear to be in a completely different part of the world. Examining the server more closely, John noticed that it was (mis)configured in a way that leaked data about various Internet addresses that were seen recently accessing the server, as well as the names of specific directories on the server that were being accessed.</p>
<p>After monitoring that logging information for some time, my source discovered there were five Internet addresses that communicated with the server multiple times a day, and that those address corresponded to devices located in Argentina, Columbia, Ecuador and Mexico.</p>
<p>He also found a file openly accessible on the Russian server which indicated that an application running on the server was constantly sending requests to imei24.com and imeidata.net &#8212; services that allow anyone to look up information about a mobile device by entering its unique <a href="https://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity" target="_blank">International Mobile Equipment Identity (IMEI) number</a>. These services return a variety of information, including the make and model of the phone, whether Find My iPhone is enabled for the device, and whether the device has been locked or reported stolen.</p>
<p>John said that as he was conducting additional reconnaissance of the Russian server, he tried to access &#8220;index.php&#8221; &#8212; which commonly takes one to a site&#8217;s home page &#8212; when his browser was redirected to &#8220;login.php&#8221; instead. The resulting page, pictured below, is a login page for an application called &#8220;iServer.&#8221; The login page displays a custom version of Apple&#8217;s trademarked logo as part of a pirate&#8217;s skull and crossbones motif, set against a background of bleeding orange flames.</p>
<div id="attachment_38458" style="width: 588px" class="wp-caption aligncenter"><a class="lightbox" href="media/76ba2332.iserverlogin.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/iserverlogin.png"><img class="wp-image-38458 size-full" src="media/76ba2332.iserverlogin.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/iserverlogin.png" alt="The login page for an Apple iCloud credential phishing operation apparently used to unlock and remotely wipe stolen iPhones." width="578" height="581" /></a><p class="wp-caption-text">The login page for an Apple iCloud credential phishing operation apparently used to unlock and remotely wipe stolen iPhones.</p></div>
<p>John told me that in addition to serving up that login page, the server also returned the HTML contents of the &#8220;index.php&#8221; he originally requested from the server. When he saved the contents of index.php to his computer and viewed it as a text file, he noticed it inexplicably included a list of some 137 user names, email addresses and expiration dates for various users who&#8217;d apparently paid a monthly fee to access the iCloud phishing service.</p>
<p>&#8220;These appear to be &#8216;resellers&#8217; or people that have access to the crimeware server,&#8221; my source said of the user information listed in the server&#8217;s &#8220;index.php&#8221; file.</p>
<p><a class="lightbox" href="media/4eda719c.priceperreseller.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/priceperreseller.png"><img class="aligncenter wp-image-38499 size-medium" src="media/28cb8630.priceperreseller-580x210.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/priceperreseller-580x210.png" alt="priceperreseller" width="580" height="210" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/priceperreseller-580x210.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/priceperreseller-768x278.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/priceperreseller-940x340.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/priceperreseller.png 1043w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>John told KrebsOnSecurity that with very little effort he was able to guess the password of at least two other users listed in that file. After John logged into the iCloud phishing service with those credentials, the service informed him that the account he was using was expired. John was then prompted to pay for at least one more month subscription access to the server to continue.</p>
<p>Playing along, John said he clicked the &#8220;OK&#8221; button indicating he wished to renew his subscription, and was taken to a shopping cart hosted on the domain <strong>hostingyaa[dot]com</strong>. That payment form in turn was accepting PayPal payments for an account tied to an entity called <strong>HostingYaa LLC</strong>; viewing the HTML source on that payment page revealed the PayPal account was tied to the email address &#8220;<strong>admin@hostingyaa[dot]com</strong>.&#8221;</p>
<p>According to the file coughed up by the Russian server, the first username in that user list &#8212; demoniox12 &#8212; is tied to an email address <strong>admin@lanzadorx.net</strong> and to a zero-dollar subscription to the phishing service. This strongly indicates the user in question is an administrator of this phishing service.</p>
<p>A review of Lanzadorx[dot]net indicates that it is a phishing-as-a-service offering that advertises the ability to launch targeted phishing attacks at a variety of free online services, including accounts at Apple, Hotmail, Gmail and Yahoo, among others.</p>
<p>A reverse WHOIS lookup ordered from Domaintools.com shows that the admin@lanzadorx.net email is linked to the registration data for exactly two domains &#8212; hostingyaa[dot]info and lanzadorx[dot]net [full disclosure: Domaintools is currently one of several advertisers on KrebsOnSecurity].</p>
<p>Hostingyaa[dot]info is registered to a Dario Dorrego, one of the other zero-dollar accounts included near the top of the list of users that are authorized to access the iCloud phishing service. The site says Dorrego&#8217;s account corresponds to the email address <strong>dario@hostingyaa[dot]com</strong>. That name Dario Dorrego also appears in the site registration records for 31 other Web site domains, all of which are listed <a href="https://krebsonsecurity.com/wp-content/uploads/2017/03/ReverseWhoisOnDarioDorrego.txt" target="_blank">here</a>.</p>
<p>John said he was able to guess the passwords for at least six other accounts on the iCloud phishing service, including one particularly interesting user and possible reseller of the service who picked the username &#8220;<strong>Jonatan</strong>.&#8221; Below is a look at the home screen for Jonatan&#8217;s account on this iCloud phishing service. We can see the system indicates Jonatan was able to obtain at least 65 &#8220;hacked IDs&#8221; through this service, and that he pays USD $80 per month for access to it.</p>
<div id="attachment_38462" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/69a79051.homescreenhackedids.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/homescreenhackedids.png"><img class="wp-image-38462 size-medium" src="media/618c14cd.homescreenhackedids-580x474.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/homescreenhackedids-580x474.png" alt="&quot;Jonatan,&quot; a user of this iCloud account credential phishing service. Note the left side panel indicates the number of records and hacked IDs recorded for Jonatan's profile." width="580" height="474" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/homescreenhackedids-580x474.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/homescreenhackedids-768x628.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/homescreenhackedids-940x769.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/homescreenhackedids.png 972w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">&#8220;Jonatan,&#8221; a user of this iCloud account credential phishing service. Note the left side panel indicates the number of records and hacked IDs recorded for Jonatan&#8217;s profile.</p></div>
<p><span id="more-38361"></span>Here are some of the details for &#8220;Tanya,&#8221; one such victim tied to Jonatan&#8217;s account. Tammy&#8217;s personal details have been redacted from this image:</p>
<div id="attachment_38463" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/604754f2.victim-tanya.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/victim-tanya.png"><img class="wp-image-38463 size-medium" src="media/8c3eb541.victim-tanya-580x369.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/victim-tanya-580x369.png" alt="This page from the iCloud phishing service shows the redacted account details phished from an iPhone user named Tanya." width="580" height="369" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/victim-tanya-580x369.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/victim-tanya-768x488.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/victim-tanya-940x598.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/victim-tanya.png 1327w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">This page from the iCloud phishing service shows the redacted account details phished from an iPhone user named Tanya.</p></div>
<p>Here is the iCloud phishing page Tanya would have seen if she clicked the link sent to her via text message. Note that the victim&#8217;s full email address is automatically populated into the username portion of the login page to make the scam feel more like Apple&#8217;s actual iCloud site:</p>
<p><a class="lightbox" href="media/6eb49ef3.tanyaphish.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/tanyaphish.png"><img class="aligncenter wp-image-38534 size-medium" src="media/af178a4b.tanyaphish-580x331.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/tanyaphish-580x331.png" alt="tanyaphish" width="580" height="331" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/tanyaphish-580x331.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/tanyaphish-768x439.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/tanyaphish-940x537.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/tanyaphish.png 1370w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>The page below from Jonatan&#8217;s profile lists each of his 60+ victims individually, detailing their name, email address, iCloud password, phone number, unique device identifier (IMEI), iPhone model/generation and some random notes apparently inserted by Jonatan:</p>
<p><a class="lightbox" href="media/e8f0e8a6.victimslist.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/victimslist.png"><img class="aligncenter wp-image-38465 size-medium" src="media/d892634d.victimslist-580x362.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/victimslist-580x362.png" alt="victimslist" width="580" height="362" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/victimslist-580x362.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/victimslist-768x480.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/victimslist-940x587.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/victimslist.png 1326w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>The next screen shot shows the &#8220;SMS sent&#8221; page. It tracks which victims were sent which variation of phishing scams offered by the site; whether targets had clicked a link in the phony iCloud phishing texts; and if any of those targets ever visited the fake iCloud login pages:</p>
<p><a class="lightbox" href="media/3f7da534.smssent.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/smssent.png"><img class="aligncenter wp-image-38472 size-medium" src="media/6d026758.smssent-580x295.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/smssent-580x295.png" alt="smssent" width="580" height="295" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/smssent-580x295.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/smssent-768x391.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/smssent.png 856w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>Users of this phishing service can easily add a new phishing domain if their old links get cleaned up or shut down by anti-phishing and anti-spam groups. This service also advertises the ability to track when phishing links have been flagged by anti-phishing companies:</p>
<p><a class="lightbox" href="media/81355138.listofdomains.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/listofdomains.png"><img class="aligncenter wp-image-38475 size-medium" src="media/3e9779d8.listofdomains-580x306.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/listofdomains-580x306.png" alt="listofdomains" width="580" height="306" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/listofdomains-580x306.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/listofdomains-768x405.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/listofdomains-940x496.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/listofdomains.png 1009w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>This is where the story turns both comical and ironic. Many times, attackers will test their exploit on themselves whilst failing to fully redact their personal information. Jonatan apparently tested the phishing attacks on himself using his actual Apple iCloud credentials, and this data was indexed by Jonatan&#8217;s phishing account at the fake iCloud server. In short, he phished himself and forgot to delete the successful results. Sorry, but I&#8217;ve blurred out Jonatan&#8217;s iCloud password in the screen shot here:</p>
<p><a class="lightbox" href="media/3b09fd8e.jonataninfo.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/jonataninfo.png"><img class="aligncenter wp-image-38478 size-medium" src="media/6d58b4ef.jonataninfo-580x337.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/jonataninfo-580x337.png" alt="jonataninfo" width="580" height="337" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/jonataninfo-580x337.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/jonataninfo-768x446.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/jonataninfo-940x546.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/jonataninfo.png 1094w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>See if you can guess what John did next? Yes, he logged into Jonatan&#8217;s iCloud account. Helpfully, one of the screenshots in the photos saved to Jonatan&#8217;s iCloud account is of Jonatan logged into the same phishing server that leaked his iCloud account information!</p>
<p><a class="lightbox" href="media/a1443eff.jonatan-loggedin.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatan-loggedin.png"><img class="aligncenter wp-image-38479 size-medium" src="media/25e78a5c.jonatan-loggedin-580x316.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatan-loggedin-580x316.png" alt="jonatan-loggedin" width="580" height="316" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatan-loggedin-580x316.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatan-loggedin-768x419.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatan-loggedin-940x513.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatan-loggedin.png 1012w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>The following advertisement for Jonatan&#8217;s service &#8212; also one of the images John found in Jonatan&#8217;s iCloud account &#8212; includes the prices he charges for his own remote iPhone unlocking service. It appears the pricing is adjusted upwards considerably for phishing attacks on newer model stolen iPhones. The price for phishing an iPhone 4 or 4s is $40 per message, versus $120 per message for phishing attacks aimed at iPhone 6s and 6s plus users. Presumably this is because the crooks hiring this service stand to make more money selling newer phones.</p>
<p><img class="aligncenter size-medium wp-image-38516" src="media/4577d725.jonatan-prices2-580x354.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatan-prices2-580x354.png" alt="jonatan-prices2" width="580" height="354" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatan-prices2-580x354.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatan-prices2-768x469.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatan-prices2-940x574.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatan-prices2.png 1306w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>The email address that Jonatan used to register on the Apple iPhone phishing service &#8212; shown in one of the screen shots above as jona_icloud@hotmail.com &#8212; also was used to register an account on Facebook tied to a <strong>Jonatan Rodriguez</strong> who says he is from Puerto Rico. It just so happens that this Jonatan Rodriguez on Facebook also uses his profile to advertise a &#8220;Remove iCloud&#8221; service. What are the odds?</p>
<div id="attachment_38488" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/440d507e.jonatanfb.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatanfb.png"><img class="wp-image-38488 size-medium" src="media/00885338.jonatanfb-580x642.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatanfb-580x642.png" alt="Jonatan's Facebook profile page." width="580" height="642" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatanfb-580x642.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatanfb-768x849.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatanfb-940x1040.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatanfb.png 943w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Jonatan&#8217;s Facebook profile page.</p></div>
<p>Well, pretty good considering this Facebook user also is the administrator of a Facebook Group called <a href="https://www.facebook.com/groups/1629713247283449/" target="_blank">iCloud Unlock Ecuador &#8211; Worldwide</a>. Incredibly, Facebook says there are 2,797 members of this group. Here&#8217;s what they&#8217;re all about:</p>
<p><a class="lightbox" href="media/e18fe326.icloudunlockecuador.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/icloudunlockecuador.png"><img class="aligncenter wp-image-38480 size-medium" src="media/290abb5c.icloudunlockecuador-580x581.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/icloudunlockecuador-580x581.png" alt="icloudunlockecuador" width="580" height="581" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/icloudunlockecuador-150x150.png 150w, http://krebsonsecurity.com/wp-content/uploads/2017/03/icloudunlockecuador-580x581.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/icloudunlockecuador-768x769.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/icloudunlockecuador-940x941.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/icloudunlockecuador.png 1007w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>Jonatan&#8217;s Facebook profile picture would have us believe that he is a male model, but the many selfies he apparently took of himself and left in his iCloud account show a much softer side of Jonatan:</p>
<div id="attachment_38481" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/c9d5ccba.jonatan-selfie.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatan-selfie.png"><img class="wp-image-38481 size-medium" src="media/7e2fb045.jonatan-selfie-580x361.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatan-selfie-580x361.png" alt="Jonatan, in a selfie he uploaded to his iCloud account, which he gave away the credentials to because the web site where his phishing service provider was hosted no virtually no security to speak of. " width="580" height="361" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatan-selfie-580x361.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatan-selfie-768x478.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatan-selfie-940x585.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/jonatan-selfie.png 1327w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Jonatan, in a selfie he uploaded to his iCloud account. Jonatan unwittingly gave away the credentials to his iCloud account because the web site where his iCloud account phishing service provider was hosted had virtually no security (nor did Jonatan, apparently). Other photos in his archive include various ads for his iPhone unlocking service.</p></div>
<p>Among the members of this Facebook group is one &#8220;Alexis Cadena,&#8221; whose name appears in several of the screenshots tied to Jonatan&#8217;s account in the iCloud phishing service:</p>
<p><a class="lightbox" href="media/57dd5138.alexcadena.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/alexcadena.png"><img class="aligncenter wp-image-38484 size-medium" src="media/89087b94.alexcadena-580x146.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/alexcadena-580x146.png" alt="alexcadena" width="580" height="146" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/alexcadena-580x146.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/alexcadena-768x193.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/alexcadena-940x236.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/alexcadena.png 1062w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>Alexis Cadena apparently also has his own iCloud phishing service. It&#8217;s not clear if he sub-lets it from Jonatan or what, but here are some of Alex&#8217;s ads:</p>
<p><a class="lightbox" href="media/9eb36fb0.alexiscadena-fb.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/alexiscadena-fb.png"><img class="aligncenter wp-image-38485 size-medium" src="media/78dc4d80.alexiscadena-fb-580x407.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/alexiscadena-fb-580x407.png" alt="alexiscadena-fb" width="580" height="407" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/alexiscadena-fb-580x407.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/alexiscadena-fb-768x539.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/alexiscadena-fb-940x659.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/alexiscadena-fb.png 1075w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>Coming back to Jonatan, the beauty of the iCloud service (and the lure used by Jonatan&#8217;s phishing service) is that iPhones can be located fairly accurately to a specific address. Alas, because Jonatan phished his own iCloud account, we can see that according to Jonatan&#8217;s iCloud service, his phone was seen in <a href="https://www.google.com/maps/place/Iv%C3%A1n+Riofr%C3%ADo,+Yantzaza,+Ecuador/@-3.825873,-78.7681746,16z/data=!4m5!3m4!1s0x91cb7a0841760e33:0xbd8c4992b7922555!8m2!3d-3.8301121!4d-78.7605786" target="_blank">the following neighborhood</a> in Ecuador on March 7, 2017. The map shows a small radius of a few blocks within <a href="https://en.wikipedia.org/wiki/Yantzaza" target="_blank">Yantzaza</a>, a town of 10,000 in southern Educador:</p>
<div id="attachment_38486" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/1f6d9c1d.jrmapped.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/jrmapped.png"><img class="wp-image-38486 size-medium" src="media/5dcb85f6.jrmapped-580x337.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/jrmapped-580x337.png" alt="Jonatan's home town, according to the results of his &quot;find my iphone&quot; feature in iCloud." width="580" height="337" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/jrmapped-580x337.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/jrmapped-768x446.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/jrmapped-940x546.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/jrmapped.png 1081w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Jonatan&#8217;s home town, according to the results of his &#8220;find my iphone&#8221; feature in iCloud.</p></div>
<p>Jonatan did not respond to multiple requests for comment.</p>


feed_id: https://krebsonsecurity.com/?p=38549
title: Adobe, Microsoft Push Critical Security Fixes
uri: 2017-03-15-Adobe-Microsoft-Push-Critical-Security-Fixes
url: https://krebsonsecurity.com/2017/03/adobe-microsoft-push-critical-security-fixes-10/
content:
<p><strong>Adobe</strong> and <strong>Microsoft</strong> each pushed out security updates for their products today. Adobe plugged at least seven security holes in its <strong>Flash Player</strong> software. Microsoft, which <a href="https://krebsonsecurity.com/2017/02/february-updates-from-adobe-microsoft/" target="_blank">delayed</a> last month&#8217;s Patch Tuesday until today, issued an unusually large number of update bundles (18) to fix dozens of flaws in <strong>Windows</strong> and associated software.</p>
<p><img class="alignright wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="202" height="212" />Microsoft&#8217;s <a href="https://technet.microsoft.com/en-us/library/security/MS17-010" target="_blank">patch</a> to fix at least five critical bugs in the Windows file-sharing service is bound to make a great deal of companies nervous before they get around to deploying this week&#8217;s patches. Most organizations block internal file-sharing networks from talking directly to their Internet-facing networks, but these flaws could be exploited by a malicious computer worm to spread very quickly once inside an organization with a great many unpatched Windows systems.</p>
<p>Another critical patch (<a href="https://technet.microsoft.com/en-us/library/security/MS17-013" target="_blank">MS17-013</a>) covers a slew of dangerous vulnerabilities in the way Windows handles certain image files. Malware or miscreants could exploit the flaws to foist malicious software without any action on the part the user, aside from perhaps just browsing to a hacked or booby-trapped Web site.<span id="more-38549"></span></p>
<p>According to <a href="https://isc.sans.edu/forums/diary/February+and+March+Microsoft+Patch+Tuesday/22185/" target="_blank">a blog post</a> at the <strong>SANS Internet Storm Center</strong>, the image-handling flaw is one of six bulletins Microsoft released today which include vulnerabilities that have either already been made public or that are already being exploited. Several of these are in <strong>Internet Explorer</strong> (<a href="https://isc.sans.edu/vuln.html?cve=2017-0008" data-ss1489520257="1">CVE 2017-0008</a>/<a href="https://technet.microsoft.com/en-us/library/security/MS17-006" target="_blank">MS17-006</a>) and/or <strong>Microsoft Edge</strong> (<a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0037" target="_blank">CVE-2017-0037</a>/<a href="https://technet.microsoft.com/en-us/library/security/MS17-007" target="_blank">MS17-007</a>).</p>
<p>For a more in-depth look at today&#8217;s updates from Microsoft, check out <a href="https://blog.qualys.com/laws-of-vulnerabilities/2017/03/14/massive-security-update-from-microsoft-for-march" target="_blank">this post</a> from security vendor <strong>Qualys</strong>.</p>
<p>And as per usual, Adobe used Patch Tuesday as an occasion to release updates for its Flash Player software. The <a href="https://helpx.adobe.com/security/products/flash-player/apsb17-07.html" target="_blank">latest update</a> brings Flash to <em>v. 25.0.0.127</em> for Windows, Mac and Linux users alike. If you have Flash installed, you should update, hobble or remove Flash as soon as possible. To see which version of Flash your browser may have installed, check out <a href="http://www.adobe.com/software/flash/about/" target="_blank">this page</a>.</p>
<p><img class="alignleft size-full wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="211" height="180" />The smartest option is probably to ditch the program once and for all and significantly increase the security of your system in the process. An extremely powerful and buggy program that binds itself to the browser, Flash is a favorite target of attackers and malware. For some ideas about how to hobble or do without Flash (as well as slightly less radical solutions) check out <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">A Month Without Adobe Flash Player</a>.</p>
<p>If you choose to keep Flash, please update it today. The most recent versions of Flash should be available from the <a href="https://get.adobe.com/flashplayer/" target="_blank">Flash home page.</a> Windows users who browse the Web with anything other than <strong>Internet Explorer</strong> may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>
<p><strong>Chrome </strong>and IE should auto-install the latest Flash version on browser restart (users may need to manually check for updates in and/or restart the browser to get the latest Flash version). Chrome users may need to restart the browser to install or automatically download the latest version. When in doubt, click the vertical three dot icon to the right of the URL bar, select “Help,” then “About Chrome”: If there is an update available, Chrome should install it then.</p>
<p>Finally, Adobe also issued <a href="https://helpx.adobe.com/security/products/shockwave/apsb17-08.html" target="_blank">a patch</a> for its <strong>Shockwave Player</strong>, which is another program you should probably ditch if you don&#8217;t have a specific need for it. The long and short of it is that Shockwave often contains the same exploitable Flash bugs but doesn&#8217;t get patched anywhere near as often as Flash. Please read <a href="https://krebsonsecurity.com/2014/05/why-you-should-ditch-adobe-shockwave/" target="_blank">Why You Should Ditch Adobe Shockwave</a> if you have any doubts on this front.</p>
<p>As always, if you experience any issues downloading or installing any of these updates, please leave a note about it in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=38562
title: Four Men Charged With Hacking 500M Yahoo Accounts
uri: Four-Men-Charged-With-Hacking-500M-Yahoo-Accounts
url: https://krebsonsecurity.com/2017/03/four-men-charged-with-hacking-500m-yahoo-accounts/
content:
<p style="text-align: center;"><em>&#8220;Between two evils, I always pick the one I never tried before.&#8221; -Karim Baratov (paraphrasing <a href="https://en.wikiquote.org/wiki/Mae_West" target="_blank">Mae West</a>)</em></p>
<p>The U.S. Justice Department today unsealed indictments against four men accused of hacking into a half-billion <strong>Yahoo</strong> email accounts. Two of the men named in the indictments worked for a unit of the Russian <strong>Federal Security Service</strong> (FSB) that serves as the FBI&#8217;s point of contact in Moscow on cybercrime cases. Here&#8217;s a look at the accused, starting with a 22-year-old who apparently did not try to hide his tracks.</p>
<p>According to a <a href="https://www.justice.gov/opa/pr/us-charges-russian-fsb-officers-and-their-criminal-conspirators-hacking-yahoo-and-millions" target="_blank">press release</a> put out by the <strong>Justice Department</strong>, among those indicted was <strong>Karim Baratov</strong> (a.k.a. Kay, Karim Taloverov), a Canadian and Kazakh national who lives in Canada. Baratov is accused of being hired by the two FSB officer defendants in this case &#8212; <strong>Dmitry Dokuchaev, </strong>33, and <strong>Igor Sushchin</strong>, 43 &#8212; to hack into the email accounts of thousands of individuals.</p>
<div id="attachment_38569" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/ee810e48.mrkarim.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/mrkarim.png"><img class="wp-image-38569 size-medium" src="media/52e1812f.mrkarim-580x348.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/mrkarim-580x348.png" alt="Karim Baratov, as pictured in 2014 on his own site, mr-karim.com." width="580" height="348" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/mrkarim-580x348.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/mrkarim-768x461.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/mrkarim-940x564.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/mrkarim.png 1256w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Karim Baratov (a.k.a. Karim Taloverov), as pictured in 2014 on his own site, mr-karim.com. The license plate on his BMW pictured here is Mr. Karim.</p></div>
<p>Reading the Justice Department&#8217;s indictment, it would seem that Baratov was perhaps the least deeply involved in this alleged conspiracy. That may turn out to be true, but he also appears to have been the least careful about hiding his activities, leaving quite a long trail of email hacking services that took about 10 minutes of searching online to trace back to him specifically.</p>
<p>Security professionals are fond of saying that any system is only as secure as its weakest link. It would not be at all surprising if Baratov was the weakest link in this conspiracy chain.</p>
<p>A look at Mr. Baratov&#8217;s <a href="https://www.facebook.com/mrkarrrim" target="_blank">Facebook</a> and <a href="https://www.instagram.com/mrkarrrim/" target="_blank">Instagram</a> photos indicates he is heavily into high-performance sports cars. His profile picture shows two of his prized cars &#8212; a Mercedes (pictured above) and an Aston Martin &#8212; parked in the driveway of his single-family home in Ontario.</p>
<p>A simple reverse WHOIS search at domaintools.com on the name Karim Baratov turns up <a href="https://krebsonsecurity.com/wp-content/uploads/2017/03/KarimBaratovDomains.txt" target="_blank">81 domains</a> registered to someone by this name in Ontario. Many of those domains include the names of big email providers like Google and Yandex, such as <strong>accounts-google[dot]net</strong> and <strong>www-yandex[dot]com</strong>.</p>
<p>Other domains appear to be Web sites selling email hacking services. One of those is a domain registered to Baratov&#8217;s home address in Ancaster, Ontario called <strong>infotech-team[dot]com</strong>. A <a href="http://web.archive.org/web/20140301084455/http://infotech-team.com/" target="_blank">cached copy of that site</a> from archive.org shows this once was a service that offered &#8220;quality mail hacking to order, without changing the password.&#8221; The service charged roughly $60 per password.</p>
<div id="attachment_38565" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/885df45b.info-tech-team.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/info-tech-team.png"><img class="wp-image-38565 size-medium" src="media/45b3fe7b.info-tech-team-580x447.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/info-tech-team-580x447.png" alt="Archive.org's cache of infotech-team.com, an email hacking service registered to Baratov." width="580" height="447" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/info-tech-team-580x447.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/info-tech-team-768x592.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/info-tech-team-940x724.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/info-tech-team.png 1219w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Archive.org&#8217;s cache of infotech-team.com, an email hacking service registered to Baratov.</p></div>
<p>The proprietors of Infotech-team[dot]com advertise the ability to steal email account passwords without actually changing the victim&#8217;s password. According to the Justice Department, Baratov&#8217;s service relied on &#8220;spear phishing&#8221; emails that targeted individuals with custom content and enticed the recipient into clicking a link.</p>
<p><strong>Antimail[dot]org</strong> is another domain registered to Baratov that was active between 2013 and 2015. It advertises &#8220;quality-mail hacking to order!&#8221;:</p>
<p><a class="lightbox" href="media/9c947c60.antimail.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/antimail.png"><img class="aligncenter wp-image-38566 size-medium" src="media/325a8751.antimail-580x351.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/antimail-580x351.png" alt="antimail" width="580" height="351" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/antimail-580x351.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/antimail-768x465.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/antimail-940x570.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>Another email hacking business registered to Baratov is <strong>xssmail[dot]com</strong>, which also has for several years advertised the ability to break into email accounts of virtually all of the major Webmail providers. XSS is short for &#8220;cross-site-scripting.&#8221; XSS attacks rely on vulnerabilities in Web sites that don&#8217;t properly parse data submitted by visitors in things like search forms or anyplace one might enter data on a Web site.</p>
<p>In the context of phishing links, the user clicks the link and is actually taken to the domain he or she thinks she is visiting (e.g., yahoo.com) but the vulnerability allows the attacker to inject malicious code into the page that the victim is visiting.</p>
<p>This can include fake login prompts that send any data the victim submits directly to the attacker. Alternatively, it could allow the attacker to steal &#8220;cookies,&#8221; text files that many sites place on visitors&#8217; computers to validate whether they have visited the site previously, as well as if they have authenticated to the site already.</p>
<div id="attachment_38567" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/c2e4e9f5.xssmail.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/xssmail.png"><img class="wp-image-38567 size-medium" src="media/75c31ed7.xssmail-580x377.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/xssmail-580x377.png" alt="Archive.org's cache of xssmail.com" width="580" height="377" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/xssmail-580x377.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/xssmail-768x499.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/xssmail-940x611.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/xssmail.png 1486w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Archive.org&#8217;s cache of xssmail.com</p></div>
<p>Perhaps instead of or in addition to using XSS attacks in targeted phishing emails, Baratov also knew about or had access to other cookie-stealing exploits collected by another accused in today&#8217;s indictments: Russian national <strong>Alexsey Alexseyevich Belan</strong>.</p>
<p>According to government investigators, Belan has been on the FBI&#8217;s <a href="https://www.fbi.gov/wanted/cyber" target="_blank">Cyber Most Wanted</a> list since 2013 after breaking into and stealing credit card data from a number of e-commerce companies. In June 2013, Belan was arrested in a European country on request from the United States, but the FBI says he was able to escape to Russia before he could be extradited to the U.S.<span id="more-38562"></span></p>
<div id="attachment_38570" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/0ab65651.belan-fbi.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/belan-fbi.png"><img class="wp-image-38570 size-medium" src="media/dad6c002.belan-fbi-580x630.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/belan-fbi-580x630.png" alt="A screenshot from the FBI's Cyber Most Wanted List for Alexsey Belan." width="580" height="630" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/belan-fbi-580x630.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/belan-fbi-768x834.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/belan-fbi.png 781w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A screenshot from the FBI&#8217;s Cyber Most Wanted List for Alexsey Belan.</p></div>
<p>The government says the two other Russian nationals who were allegedly part of the conspiracy to hack Yahoo &#8212; the aforementioned FSB Officers Dokuchaev and Sushchin<strong> </strong>&#8212; used Belan to gain unauthorized access to Yahoo’s network. Here&#8217;s what happened next, according to the indictments:</p>
<blockquote><p>&#8220;In or around November and December 2014, Belan stole a copy of at least a portion of Yahoo’s User Database (UDB), a Yahoo trade secret that contained, among other data, subscriber information including users’ names, recovery email accounts, phone numbers and certain information required to manually create, or &#8216;mint,&#8217; account authentication web browser &#8216;cookies&#8217; for more than 500 million Yahoo accounts.</p>
<p>&#8220;Belan also obtained unauthorized access on behalf of the FSB conspirators to Yahoo’s Account Management Tool (AMT), which was a proprietary means by which Yahoo made and logged changes to user accounts. Belan, Dokuchaev and Sushchin then used the stolen UDB copy and AMT access to locate Yahoo email accounts of interest and to mint cookies for those accounts, enabling the co-conspirators to access at least 6,500 such accounts without authorization.&#8221;</p></blockquote>
<p>U.S. investigators say Dokuchaev was an FSB officer assigned to Second Division of FSB Center 18, also known as the FSB Center for Information Security. Dokuchaev&#8217;s colleague Sushchin was an associate of FSB officer was embedded as a purported employee and Head of Information Security at a Russian financial firm, where he monitored the communications of the firm&#8217;s employees.</p>
<p><a class="lightbox" href="media/37aa97e5.dokuchaev-fbi.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/dokuchaev-fbi.png"><img class="aligncenter wp-image-38574 size-medium" src="media/ebadc704.dokuchaev-fbi-580x673.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/dokuchaev-fbi-580x673.png" alt="dokuchaev-fbi" width="580" height="673" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/dokuchaev-fbi-580x673.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/dokuchaev-fbi-768x891.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/dokuchaev-fbi.png 791w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>According to the Justice Department, some victim accounts that Dokuchaev and Sushchin asked Belan and Baratov to hack were of predictable interest to the FSB (a foreign intelligence and law enforcement service), such as personal accounts belonging to Russian journalists; Russian and U.S. government officials; employees of a prominent Russian cybersecurity company; and numerous employees of other providers whose networks the conspirators sought to exploit. Other personal accounts belonged to employees of commercial entities, such as a Russian investment banking firm, a French transportation company, U.S. financial services and private equity firms, a Swiss bitcoin wallet and banking firm and a U.S. airline.</p>
<p>&#8220;During the conspiracy, the FSB officers facilitated Belan’s other criminal activities, by providing him with sensitive FSB law enforcement and intelligence information that would have helped him avoid detection by U.S. and other law enforcement agencies outside Russia, including information regarding FSB investigations of computer hacking and FSB techniques for identifying criminal hackers,&#8221; the Justice Department charged in its press statement about the indictments.</p>
<p>&#8220;Additionally, while working with his FSB conspirators to compromise Yahoo’s network and its users, Belan used his access to steal financial information such as gift card and credit card numbers from webmail accounts; to gain access to more than 30 million accounts whose contacts were then stolen to facilitate a spam campaign; and to earn commissions from fraudulently redirecting a subset of Yahoo’s search engine traffic,&#8221; the government alleges.</p>
<p><a class="lightbox" href="media/c2203fa7.suchchin-fbi.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/suchchin-fbi.png"><img class="aligncenter wp-image-38575 size-medium" src="media/1efaa14f.suchchin-fbi-580x673.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/suchchin-fbi-580x673.png" alt="suchchin-fbi" width="580" height="673" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/suchchin-fbi-580x673.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/suchchin-fbi-768x892.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/suchchin-fbi.png 789w" sizes="(max-width: 580px) 100vw, 580px" /></a></p>
<p>Each of the four men face 47 criminal charges, including conspiracy, computer fraud, economic espionage, theft of trade secrets and aggravated identity theft.</p>
<p>Dokuchaev, who is alleged to have used the hacker nickname &#8220;Forb,&#8221; was arrested in December in Moscow. According to a report by the Russian news agency Interfax, Dokuchaev was arrested on charges of treason for alleging sharing information with the <strong>U.S. Central Intelligence Agency</strong> (CIA). For more on that treason case, see my Jan. 28, 2017 story, <a href="https://krebsonsecurity.com/2017/01/a-shakeup-in-russias-top-cybercrime-unit/" target="_blank">A Shakeup in Russia&#8217;s Top Cybercrime Unit</a>.</p>
<p>For more on Dokuchaev&#8217;s allegedly checkered past (Russian news sites report that he went to work for the FSB to avoid being prosecuted for bank fraud) check out <a href="https://translate.google.com/translate?sl=ru&amp;tl=en&amp;js=y&amp;prev=_t&amp;hl=en&amp;ie=UTF-8&amp;u=http%3A%2F%2Fwww.vedomosti.ru%2Fnewspaper%2Farticles%2F2004%2F11%2F02%2Flicom-k-licu-s-hakerom&amp;edit-text=" target="_blank">this fascinating story</a> from Russian news outlet <em>Vedomosti</em>, which featured interview with the hacker Forb from 2004.</p>
<p>In September 2016, Yahoo first disclosed the theft of 500 million accounts that is being attributed to this conspiracy. But in December 2016, Yahoo acknowledged that a separate hack from 2013 that it attributed to a &#8220;state-sponsored actor&#8221; had <a href="https://krebsonsecurity.com/2016/12/yahoo-one-billion-more-accounts-hacked/" target="_blank">jeopardized more than a billion user accounts</a>.</p>
<p><em>The New York Times</em> <a href="https://www.nytimes.com/2017/03/15/technology/yahoo-hack-indictment.html?emc=edit_na_20170315&amp;nl=breaking-news&amp;nlid=66044131&amp;ref=cta&amp;_r=0" target="_blank">reports</a> that Yahoo said it has not been able to glean much information about that attack, which was <a href="https://www.nytimes.com/2016/12/15/technology/hacked-yahoo-data-for-sale-dark-web.html" data-ss1489620320="1">uncovered by InfoArmor</a>, an Arizona security firm. Interestingly, that attack also involved the use of forged Yahoo cookies, according to <a href="https://yahoo.tumblr.com/post/154479236569/important-security-information-for-yahoo-users" target="_blank">a statement</a> from Yahoo&#8217;s chief information security officer.</p>
<p>The one alleged member of this conspiracy who would have been simple to catch is Baratov, as he does not appear to have hidden his wealth and practically peppers the Internet with pictures of six-digit sports cars he has owned over the years.</p>
<p>Baratov was arrested on Tuesday in Canada, where the matter is now pending with Canadian authorities. U.S. prosecutors are now trying to seize Baratov&#8217;s black Mercedes Benz C54 and his Aston Martin DBS, arguing that they were purchased with the proceeds from cybercrime activity.</p>
<p>A redacted copy of the indictment is available <a href="https://www.justice.gov/opa/press-release/file/948201/download" target="_blank">here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=38604
title: Google Points to Another POS Vendor Breach
uri: Google-Points-to-Another-POS-Vendor-Breach
url: https://krebsonsecurity.com/2017/03/google-points-to-another-pos-vendor-breach/
content:
<p>For the second time in the past nine months, Google has inadvertently but nonetheless correctly helped to identify the source of a large credit card breach &#8212; by assigning a &#8220;This site may be hacked&#8221; warning beneath the search results for the Web site of a victimized merchant.</p>
<p>A little over a month ago, KrebsOnSecurity was contacted by multiple financial institutions whose anti-fraud teams were trying to trace the source of a great deal of fraud on cards that were all used at a handful of high-end restaurants around the country.</p>
<p>Two of those fraud teams shared a list of restaurants that all affected cardholders had visited recently. A bit of searching online showed that nearly all of those establishments were run by <strong>Select Restaurants Inc.</strong>, a Cleveland, Ohio company that owns a number of well-known eateries nationwide, including Boston&#8217;s Top of the Hub; Parker&#8217;s Lighthouse in Long Beach, Calif.; the Rusty Scupper in Baltimore, Md.; Parkers Blue Ash Tavern in Cincinnati, Ohio; Parkers’ Restaurant &amp; Bar in Downers Grove, Illinois; Winberie’s Restaurant &amp; Bar with locations in Oak Park, Illinois and Princeton and Summit, New Jersey; and Black Powder Tavern in Valley Forge, PA.</p>
<div id="attachment_38605" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/b59f2416.selectrestgooglelisting.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/selectrestgooglelisting.png"><img class="wp-image-38605 size-medium" src="media/242221b3.selectrestgooglelisting-580x322.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/selectrestgooglelisting-580x322.png" alt="Google's search listing for Select Restaurants, which indicates Google thinks this site may be hacked." width="580" height="322" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/selectrestgooglelisting-580x322.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/selectrestgooglelisting-768x426.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/selectrestgooglelisting.png 773w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Google&#8217;s search listing for Select Restaurants, which indicates Google thinks this site may be hacked.</p></div>
<p>Knowing very little about this company at the time, I ran a Google search for it and noticed that Google believes the site may be hacked (it still carries this message). This generally means some portion of the site was compromised by scammers who are trying to abuse the site&#8217;s search engine rankings to beef up the rankings for &#8220;spammy&#8221; sites &#8212; such as those peddling counterfeit prescription drugs and designer handbags.</p>
<p>The &#8220;This site may be hacked&#8221; advisory is not quite as dire as Google&#8217;s &#8220;This site may harm your computer&#8221; warning &#8212; the latter usually means the site is actively trying to foist malware on the visitor&#8217;s computer. But in my experience it&#8217;s never a good sign when a business that accepts credit cards has one of these warnings attached to its search engine results.</p>
<p>Case in point: I experienced this exact scenario last summer as I was <a href="https://krebsonsecurity.com/2016/06/banks-credit-card-breach-at-cicis-pizza/" target="_blank">reporting out the details on the breach at CiCi&#8217;s Pizza chain</a>. In researching that story, all signs were pointing to a point-of-sale (POS) terminal provider called <strong>Datapoint POS</strong>. Just like it did with Select Restaurants&#8217;s site, Google reported that Datapoint&#8217;s site appeared to be hacked.</p>
<div id="attachment_35057" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/785f164d.datapoint.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/datapoint.png"><img class="wp-image-35057 size-medium" src="media/dbfc9fd5.datapoint-580x330.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/06/datapoint-580x330.png" alt="Google thinks Datapoint's Web site is trying to foist malicious software." width="580" height="330" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/06/datapoint-580x330.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/06/datapoint.png 699w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Google believed Datapoint&#8217;s Web site was hacked.</p></div>
<p>Select Restaurants did not return messages seeking comment. But as with the breach at Cici&#8217;s Pizza chains, the breach involving Select Restaurant locations mentioned above appears to have been the result of an intrusion at the company&#8217;s POS vendor &#8212; Geneva, Ill. based <strong>24&#215;7 Hospitality Technology</strong>. 24&#215;7 handles credit and debit card transactions for thousands of hotels and restaurants, including more than 200 <strong>Buffalo Wild Wings</strong> franchises nationwide.</p>
<p>On Feb. 14, 24/7 Hospitality sent a letter to customers warning that its systems recently were hacked by a &#8220;sophisticated network intrusion through a remote access application.&#8221; Translation: Someone guessed or phished the password that we use to remotely administer point-of-sale systems at its customer locations. 24&#215;7 said the attackers subsequently executed the <strong>PoSeidon</strong> malware variant, which is designed to siphon card data when cashiers swipe credit cards at an infected cash register (for more on PoSeidon, check out <a href="https://krebsonsecurity.com/2015/04/pos-providers-feel-brunt-of-poseidon-malware/" target="_blank">POS Providers Feel Brunt of PoSeidon Malware</a>).</p>
<p>KrebsOnSecurity obtained a copy of <a href="media/1402070a.tice-to-Merchants-re-Impact-Start-Select-Restaurants-Cleve-1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/03/24-x7-Notice-to-Merchants-re-Impact-Start-Select-Restaurants-Cleve-1.pdf" target="_blank">the letter</a> (PDF) that 24/7 Hospitality CEO <strong>Todd Baker, Jr.</strong> sent to Select Restaurants. That missive said even though the intruders apparently had access to all of 24/7 customers&#8217; payment systems, not all of those systems were logged into by the hackers. Alas, this was probably little consolation for Select Restaurants, because the letter then goes on to say that the breach involves all of the restaurants listed on Select&#8217;s Web site, and that the breach appears to have extended from late October 2016 to mid-January 2017.<span id="more-38604"></span></p>
<h4>ANALYSIS</h4>
<p>From my perspective, organized crime gangs have so completely overrun the hospitality and restaurant point-of-sale systems here in the United States that I just assume my card may very well be compromised whenever I use it at a restaurant or hotel bar/eatery. I&#8217;ve received no fewer than three new credit cards over the past year, and I&#8217;d wager that in at least one of those cases I happened to have used the card at multiple merchants whose POS systems were hacked at the same time.</p>
<p>But no matter how many times I see it, it&#8217;s fascinating to watch this slow motion train wreck play out. Given how much risk and responsibility for protecting against these types of hacking incidents is spread so thinly across the entire industry, it&#8217;s little wonder that organized crime gangs have been picking off POS providers for Tier 3 and Tier 4 merchants with PoSeidon en masse in recent years.</p>
<p>I believe one big reason we keep seeing the restaurant and hospitality industry being taken to the cleaners by credit card thieves is that in virtually all of these incidents, the retailer or restaurant has no direct relationships to the banks which have issued the cards that will be run through their hacked POS systems. Rather, these small Tier 3 and Tier 4 merchants are usually buying merchant services off of a local systems integrator who often is in turn reselling access to a third-party payment processing company.</p>
<p>As a result, very often when these small chains or solitary restaurants get hit with PoSeidon, there is no record of a breach that is simple to follow from the breached merchant back to the bank which issued the cards used at those compromised merchants. It is only by numerous financial institutions experiencing fraud from the same restaurants and then comparing notes about possible POS vendors in common among these restaurants that banks and credit unions start to gain a clue about what&#8217;s happening and who exactly has been hacked.</p>
<p>But this takes a great deal of time, effort and trust. Meanwhile, the crooks are laughing all the way to the bank. Another reason I find all this fascinating is that the two main underground cybercrime shops that appear to be principally responsible for offloading cards stolen in these Tier 3 and Tier 4 merchant breaches involving PoSeidon &#8212; stores like <a href="https://krebsonsecurity.com/?s=Rescator&amp;x=0&amp;y=0" target="_blank">Rescator</a> and <a href="https://krebsonsecurity.com/2015/04/pos-providers-feel-brunt-of-poseidon-malware/" target="_blank">Briansdump</a> &#8212; both abuse my likeness in their advertisements and on their home pages. Here&#8217;s Briansdump:</p>
<p><div id="attachment_38612" style="width: 571px" class="wp-caption aligncenter"><a class="lightbox" href="media/15df5c65.briansdumps.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/briansdumps.png"><img class="wp-image-38612 size-full" src="media/15df5c65.briansdumps.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/briansdumps.png" alt="An advertisement for the carding shop “briansdump[dot]ru” promotes “dumps from the legendary Brian Krebs.” Needless to say, this is not an endorsed site." width="561" height="71" /></a><p class="wp-caption-text">An advertisement for the carding shop “briansdump[dot]ru” promotes “dumps from the legendary Brian Krebs.” Needless to say, this is not an endorsed site.</p></div>Here&#8217;s the login page for the rather large stolen credit card bazaar known as Rescator:</p>
<div id="attachment_38613" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/185c0286.rescator-bkstamp.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/rescator-bkstamp.png"><img class="wp-image-38613 size-medium" src="media/015bd773.rescator-bkstamp-580x309.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/rescator-bkstamp-580x309.png" alt="The login page for Rescator, a major seller of credit and debit cards stolen in countless attacks targeting retailers, restaurants and hotels. " width="580" height="309" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/rescator-bkstamp-580x309.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/rescator-bkstamp-768x409.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/rescator-bkstamp-940x501.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/rescator-bkstamp.png 1083w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The login page for Rescator, a major seller of credit and debit cards stolen in countless attacks targeting retailers, restaurants and hotels.</p></div>
<p>Point-of-sale malware has driven most of the major retail industry credit card breaches over the past two years, including intrusions at <a href="https://krebsonsecurity.com/?s=target+breach&amp;x=0&amp;y=0" target="_blank">Target</a> and <a href="https://krebsonsecurity.com/?s=home+depot+breach&amp;x=0&amp;y=0" target="_blank">Home Depot</a>, as well as <a href="https://krebsonsecurity.com/?s=point-of-sale+vendor&amp;x=0&amp;y=0" target="_blank">breaches at a ridiculous number of point-of-sale vendors</a>. The malware sometimes is installed via hacked remote administration tools like LogMeIn; in other cases the malware is relayed via “spear-phishing” attacks that target company employees. Once the attackers have their malware loaded onto the point-of-sale devices, they can remotely capture data from each card swiped at that cash register.</p>
<p>Thieves can then <a href="https://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/" target="_blank">sell that data to crooks</a> who specialize in encoding the stolen data onto any card with a magnetic stripe, and using the cards to purchase high-priced electronics and gift cards from big-box stores like Target and Best Buy.</p>
<p>Readers should remember that they’re not liable for fraudulent charges on their credit or debit cards, but they still have to report the unauthorized transactions. There is no substitute for keeping a close eye on your card statements. Also, consider using credit cards instead of debit cards; having your checking account emptied of cash while your bank sorts out the situation can be a hassle and lead to secondary problems (bounced checks, for instance).</p>
<p>Finally, if your credit card is compromised, try not to lose sleep over it: The chances of your finding out how that card was compromised are extremely low. <a href="https://krebsonsecurity.com/2015/01/how-was-your-credit-card-stolen/" target="_blank">This story</a> seeks to explain why.</p>


feed_id: https://krebsonsecurity.com/?p=38635
title: Govt. Cybersecurity Contractor Hit in W-2 Phishing Scam
uri: Govt-Cybersecurity-Contractor-Hit-in-W-2-Phishing-Scam
url: https://krebsonsecurity.com/2017/03/govt-cybersecurity-contractor-hit-in-w-2-phishing-scam/
content:
<p>Just a friendly reminder that phishing scams which spoof the boss and request W-2 tax data on employees are intensifying as tax time nears. The latest victim shows that even cybersecurity experts can fall prey to these increasingly sophisticated attacks.</p>
<p><img class="alignright wp-image-37128" src="media/482749be.athook.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/athook.png" alt="athook" width="152" height="294" />On Thursday, March 16, the CEO of <strong>Defense Point Security, LLC </strong>&#8212; a Virginia company that bills itself as &#8220;the choice provider of cyber security services to the federal government&#8221; &#8212; told all employees that their W-2 tax data was handed directly to fraudsters after someone inside the company got caught in a phisher&#8217;s net.</p>
<p>Alexandria, Va.-based <a href="https://defpoint.com/" target="_blank">Defense Point Security</a> (recently acquired by management consulting giant <strong>Accenture</strong>) informed current and former employees this week via email that all of the data from their annual W-2 tax forms &#8212; including name, Social Security Number, address, compensation, tax withholding amounts &#8212; were snared by a targeted spear phishing email.</p>
<p>&#8220;I want to alert you that a Defense Point Security (DPS) team member was the victim of a targeted spear phishing email that resulted in the external release of IRS W-2 Forms for individuals who DPS employed in 2016,&#8221; Defense Point <strong>CEO George McKenzie</strong> wrote in the email alert to employees. &#8220;Unfortunately, your W-2 was among those released outside of DPS.&#8221;</p>
<p>W-2 scams start with spear phishing emails usually directed at finance and HR personnel. The scam emails will spoof a request from the organization’s CEO (or someone similarly high up in the organization) and request all employee W-2 forms.</p>
<p>Defense Point did not return calls or emails seeking comment. An Accenture spokesperson issued the following brief statement:  &#8220;Data protection and our employees are top priorities. Our leadership and security team are providing support to all impacted employees.”</p>
<p>The email that went out to Defense Point employees Thursday does not detail when this incident occurred, to whom the information was sent, or how many employees were impacted. But a review of information about the company on <strong>LinkedIn</strong> suggests the breach letter likely was sent to around 200 to 300 employees nationwide (if we count past employees also).</p>
<p>Among Defense Point&#8217;s more sensitive projects is the <strong>U.S.</strong> <strong>Immigration and Customs Enforcement </strong>(ICE) Security Operations Center (SOC) based out of Phoenix, Ariz. That SOC handles cyber incident response, vulnerability mitigation, incident handling and cybersecurity policy enforcement for the agency.</p>
<p>Fraudsters who perpetrate tax refund fraud prize W-2 information because it contains virtually all of the data one would need to fraudulently file someone’s taxes and request a large refund in their name. Scammers in tax years past also have <a href="http://krebsonsecurity.com/2014/04/tax-fraud-gang-targeted-healthcare-firms/" target="_blank">massively phished online payroll management account credentials</a> used by corporate HR professionals. This year, they are going after <a href="https://krebsonsecurity.com/2017/01/shopping-for-w2s-tax-data-on-the-dark-web/" target="_blank">people who run tax preparation firms</a>, and W-2&#8217;s are now being openly sold in underground cybercrime stores.</p>
<p>Tax refund fraud affects hundreds of thousands, if not millions, of U.S. citizens annually. Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS.<span id="more-38635"></span></p>
<h4>ANALYSIS</h4>
<p>I find it interesting that a company which obviously handles extremely sensitive data on a regular basis and one that manages a highly politicized government agency would not anticipate such attacks and deploy some kind of <a href="https://en.wikipedia.org/wiki/Data_loss_prevention_software" target="_blank">data-loss prevention</a> (DLP) technology to stop sensitive information from leaving their networks.</p>
<p>Thanks to their mandate as an agency, ICE is likely a high risk target for hacktivists and nation-state hackers. This was not a breach in which data was exfiltrated through stealthy means; the tax data was sent by an employee openly through email. This suggests that either there were no DLP technical controls active in their email environment, or they were inadequately configured to prevent information in SSN format from leaving the network.</p>
<p>This incident also suggests that perhaps Defense Point does not train their employees adequately in information security, and yet they are trusted to maintain the security environment for a major government agency. This from a company that sells <a href="https://defpoint.com/services/cyber-security-ed-training" target="_blank">cybersecurity education and training</a> as a service to others.</p>
<h4>DON’T BE THE NEXT VICTIM</h4>
<p>While there isn&#8217;t a great deal you can do to stop someone at your employer from falling for one of these W-2 phishing scams, here are some steps you can take to make it less likely that you will be the next victim of tax refund fraud:</p>
<p><strong>-File before the fraudsters do it for you</strong> – Your primary defense against becoming the next victim is to file your taxes at the state and federal level as quickly as possible. Remember, it doesn’t matter whether or not the IRS owes you money: Thieves can still try to impersonate you and claim that they do, leaving you to sort out the mess with the IRS later.</p>
<p><strong>-Get on a schedule to request a free copy of your credit report.</strong> By law, consumers are entitled to a free copy of their report from each of the major bureaus once a year. Put it on your calendar to request a copy of your file every three to four months, each time from a different credit bureau. Dispute any unauthorized or suspicious activity. This is where credit monitoring services are useful: Part of their service is to help you sort this out with the credit bureaus, so if you’re signed up for credit monitoring make them do the hard work for you.</p>
<p><strong>-File form 14039 and request an IP PIN from the government.</strong> This form requires consumers to state they believe they’re likely to be victims of identity fraud. Even if thieves haven’t tried to file your taxes for you yet, virtually all Americans have been touched by incidents that could lead to ID theft — even if we just look at breaches announced in the past year alone.</p>
<p>&#8211;<strong>Consider placing a “security freeze” on one’s credit files with the major credit bureaus.</strong> See <a href="http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">this tutorial</a> about why a security freeze &#8212; also known as a &#8220;credit freeze,&#8221; may be more effective than credit monitoring in blocking ID thieves from assuming your identity to open up new lines of credit. While it’s true that having a security freeze on your credit file won’t stop thieves from committing tax refund fraud in your name, it would stop them from fraudulently obtaining your IP PIN.</p>
<p>–<strong>Monitor, then freeze.</strong> Take advantage of any free credit monitoring available to you, and then freeze your credit file with the four major bureaus. <a href="http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">Instructions for doing that are here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=38672
title: Student Aid Tool Held Key for Tax Fraudsters
uri: Student-Aid-Tool-Held-Key-for-Tax-Fraudsters
url: https://krebsonsecurity.com/2017/03/student-aid-tool-held-key-for-tax-fraudsters/
content:
<p>Citing concerns over criminal activity and fraud, the <strong>U.S. Internal Revenue Service</strong> (IRS) has disabled an automated tool on its Web site that was used to help students and their families apply for federal financial aid. The removal of the tool has created unexpected hurdles for many families hoping to qualify for financial aid, but the action also eliminated a key source of data that fraudsters could use to conduct tax refund fraud.</p>
<p>Last week, the IRS and the <strong>Department of Education</strong> said in a joint statement that they were temporarily shutting down the IRS&#8217;s <strong>Data Retrieval Tool. </strong>The service was designed to make it easier to complete the Education Department&#8217;s <a href="https://fafsa.ed.gov/" target="_blank">Free Application for Federal Student Aid</a> (FAFSA) &#8212; a lengthy form that serves as the starting point for students seeking federal financial assistance to pay for college or career school.</p>
<div id="attachment_38676" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-38676" src="media/efc73e93.fafsaportal-580x485.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/fafsaportal-580x485.png" alt="The U.S. Department of Education's FAFSA federal student aid portal. A notice about the closure of the IRS's data retrieval tool can be seen in red at the bottom right of this image." width="580" height="485" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/fafsaportal-580x485.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/fafsaportal-768x642.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/fafsaportal.png 772w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The U.S. Department of Education&#8217;s FAFSA federal student aid portal. A notice about the closure of the IRS&#8217;s data retrieval tool can be seen in red at the bottom right of this image.</p></div>
<p>In response to requests for comment, the IRS shared the following statement: &#8220;As part of a wider, ongoing effort at the IRS to protect the security of data, the IRS decided to temporarily suspend their Data Retrieval Tool (DRT) as a precautionary step following concerns that information from the tool could potentially be misused by identity thieves.&#8221;</p>
<p>&#8220;The scope of the issue is being explored, and the IRS and FSA are jointly investigating the issue,&#8221; the statement continued. &#8220;At this point, we believe the issue is relatively isolated, and no additional action is needed by taxpayers or people using these applications. The IRS and FSA are actively working on a way to further strengthen the security of information provided by the DRT. We will provide additional information when we have a specific timeframe for returning the DRT or other details to share.&#8221;</p>
<p>The removal of the IRS&#8217;s tool received relatively broad media coverage last week. For example, <a href="https://www.wsj.com/articles/online-tool-to-apply-for-college-aid-was-taken-down-due-to-criminal-activity-1489707771?mod=e2tw" target="_blank">a story</a> in <em>The Wall Street Journal</em> notes that the Treasury Inspector General for Tax Administration &#8212; which provides independent oversight of the IRS &#8212; &#8220;opened a criminal investigation into the potentially fraudulent use of the tool.&#8221;</p>
<p>Nevertheless, I could not find a single publication that sought to explain precisely what information identity thieves were seeking from this now-defunct online resource. Two sources familiar with the matter but who asked to remain anonymous because they were not authorized to speak on the record told KrebsOnSecurity that identity thieves were using the IRS&#8217;s tool to look up the &#8220;adjusted gross income&#8221; (AGI), which is an individual or family&#8217;s total gross income minus specific deductions.</p>
<p>Anyone completing a FAFSA application will need to enter the AGI as reported on the previous year&#8217;s income tax return of their parents or guardians. The AGI is listed on the IRS-1040 forms that taxpayers must file with the IRS each year. The IRS&#8217;s online tool was intended as a resource for students who needed to look up the AGI but didn&#8217;t have access to their parents&#8217; tax returns.</p>
<p>Eligible FAFSA applicants could use the IRS&#8217;s data retrieval tool to populate relevant fields in the application with data pulled directly from the IRS. Countless college Web sites explain how the tool works in more detail; here&#8217;s <a href="media/fd505eff.to-use-the--IRS-Data-Retrieval-Tool-on-the-FAFSA-application.pdf" data-original-source="http://www.shoreline.edu/apply-and-aid/financial-aid/forms/2016-2017/How-to-use-the--IRS-Data-Retrieval-Tool-on-the-FAFSA-application.pdf" target="_blank">one example</a> (PDF).</p>
<p>As it happens, the AGI is also required <a href="https://www.irs.gov/individuals/electronic-filing-pin-request" target="_blank">to sign and validate electronic tax returns</a> filed with the IRS. Consequently, the IRS&#8217;s data retrieval tool would be a terrific resource to help identity thieves successfully file fraudulent tax refund requests with the agency.</p>
<div id="attachment_38677" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-38677" src="media/b462d533.irs-agi-580x294.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/irs-agi-580x294.png" alt="A notice from the IRS states that the adjusted gross income (AGI) is needed to validate electronically-filed tax returns." width="580" height="294" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/irs-agi-580x294.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/irs-agi-768x390.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/irs-agi.png 808w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A notice from the IRS states that the adjusted gross income (AGI) is needed to validate electronically-filed tax returns.</p></div>
<p><span id="more-38672"></span>Tax-related identity theft occurs when someone uses a Social Security number (SSN) — either a client’s, a spouse’s, or dependent’s — to file a tax return claiming a fraudulent refund. Thieves may also use a stolen Employer Identification Number (EIN) from a business client to create false Forms W-2 to support refund fraud schemes. Increasingly, fraudsters are simply <a href="https://krebsonsecurity.com/?s=w-2+phishing&amp;x=0&amp;y=0" target="_blank">phishing W-2 data in large quantities</a> from human resource professionals at a variety of organizations. However, taxpayer AGI information is not listed on W-2 forms.</p>
<p>Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS.</p>
<p>This would not be the first time tax refund fraudsters abused an online tool made available by the IRS. During the height of tax-filing season in 2015, identity thieves used the irs.gov’s “Get Transcript” feature to glean salary and personal information they didn’t already have on targeted taxpayers. In May 2015, the IRS <a href="http://krebsonsecurity.com/2015/05/irs-crooks-stole-data-on-100k-taxpayers-via-get-transcript-feature/" target="_blank">suspended the Get Transcript feature</a>, citing its abuse by fraudsters and noting that some 100,000 taxpayers may have been victimized as a result.</p>
<p>In August 2015, the agency <a href="http://krebsonsecurity.com/2015/08/irs-330k-taxpayers-hit-by-get-transcript-scam/" target="_blank">revised those estimates up to 330,000</a>, but in February 2016, the IRS again more than doubled its estimate, saying the number of taxpayers targeted via abuse of the Get Transcript tool was <a href="http://krebsonsecurity.com/2016/02/irs-390k-more-victims-of-irs-gov-weakness/" target="_blank">probably closer to 724,000</a>.</p>
<p>The IRS <a href="https://krebsonsecurity.com/2016/06/irs-re-enables-get-transcript-feature/" target="_blank">re-enabled its Get Transcript service last summer</a>, saying it had fortified the system with additional security safeguards &#8212; such as requiring visitors to supply a mobile phone number that is tied to the applicant&#8217;s name.</p>
<p>Now, the IRS is touting its <a href="https://www.irs.gov/individuals/get-transcript" target="_blank">new and improved Get Transcript service</a> as an alternative method for obtaining the information needed to complete the FAFSA.</p>
<p>&#8220;If you did not retain a copy of your tax return, you may be able to access the tax software you used to prepare your return or contact your tax preparer to obtain a copy,&#8221; the IRS said in its advisory on the shutdown of its data retrieval tool. &#8220;You must verify your identity to use this tool. You also may use Get Transcript by Mail or call 1-800-908-9946, and a transcript will be delivered to your address of record within five to 10 days.&#8221;</p>
<p>The IRS advises those who still need help completing the FAFSA to visit StudentAid.gov/fafsa or call 1-800-4FED-AID (1-800-433-3243).</p>
<h4>DON&#8217;T BE THE NEXT VICTIM</h4>
<p>Here are some steps you can take to make it less likely that you will be the next victim of tax refund fraud:</p>
<p><strong>-File before the fraudsters do it for you</strong> – Your primary defense against becoming the next victim is to file your taxes at the state and federal level as quickly as possible. Remember, it doesn’t matter whether or not the IRS owes you money: Thieves can still try to impersonate you and claim that they do, leaving you to sort out the mess with the IRS later.</p>
<p><strong>-Get on a schedule to request a free copy of your credit report.</strong> By law, consumers are entitled to a free copy of their report from each of the major bureaus once a year. Put it on your calendar to request a copy of your file every three to four months, each time from a different credit bureau. Dispute any unauthorized or suspicious activity. This is where credit monitoring services are useful: Part of their service is to help you sort this out with the credit bureaus, so if you’re signed up for credit monitoring make them do the hard work for you.</p>
<p><strong>-File form 14039 and request an IP PIN from the government.</strong> This form requires consumers to state they believe they’re likely to be victims of identity fraud. Even if thieves haven’t tried to file your taxes for you yet, virtually all Americans have been touched by incidents that could lead to ID theft — even if we just look at breaches announced in the past year alone.</p>
<p>–<strong>Consider placing a “security freeze” on one’s credit files with the major credit bureaus.</strong> See <a href="http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">this tutorial</a> about why a security freeze — also known as a “credit freeze,” may be more effective than credit monitoring in blocking ID thieves from assuming your identity to open up new lines of credit. While it’s true that having a security freeze on your credit file won’t stop thieves from committing tax refund fraud in your name, it would stop them from fraudulently obtaining your IP PIN.</p>
<p>–<strong>Monitor, then freeze.</strong> Take advantage of any free credit monitoring available to you, and then freeze your credit file with the four major bureaus. <a href="http://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">Instructions for doing that are here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=38666
title: eBay Asks Users to Downgrade Security
uri: eBay-Asks-Users-to-Downgrade-Security
url: https://krebsonsecurity.com/2017/03/ebay-asks-users-to-downgrade-security/
content:
<p>Last week, KrebsOnSecurity received an email from <strong>eBay</strong>. The company wanted me to switch from using a <a href="http://pages.ebay.com/securitykey/faq.html" target="_blank">hardware key fob</a> when logging into eBay to receiving a one-time code sent via text message. I found it remarkable that eBay, which at one time was well ahead of most e-commerce companies in providing more robust online authentication options, is now essentially trying to downgrade my login experience to a less-secure option.</p>
<p><img class="aligncenter size-medium wp-image-38694" src="media/8706447a.ebay2fa-580x533.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/ebay2fa-580x533.png" alt="ebay2fa" width="580" height="533" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/ebay2fa-580x533.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/ebay2fa.png 596w" sizes="(max-width: 580px) 100vw, 580px" />In early 2007, PayPal (then part of the same company as eBay) began offering its hardware token for a one-time $5 fee, and at the time the company was among very few that were pushing this second-factor (something you have) in addition to passwords for user authentication. In fact, I <a href="http://voices.washingtonpost.com/securityfix/2007/02/paypal_selling_antifraud_token.html" target="_blank">wrote about this development</a> back when I was a reporter at <em>The Washington Post</em>:</p>
<p>&#8220;Armed with one of these keys, if you were to log on to your account from an unfamiliar computer and some invisible password stealing program were resident on the machine, the bad guys would still be required to know the numbers displayed on your token, which of course changes every 30 seconds. Likewise, if someone were to guess or otherwise finagle your PayPal password.&#8221;</p>
<div id="attachment_38706" style="width: 494px" class="wp-caption aligncenter"><img class="size-full wp-image-38706" src="media/a08a55fc.paypalsecuritykey.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/paypalsecuritykey.png" alt="The PayPal security key." width="484" height="262" /><p class="wp-caption-text">The PayPal security key.</p></div>
<p>I&#8217;ve still got the same hardware token I ordered when writing about that offering, and it&#8217;s been working well for the past decade. Now, eBay is asking me to switch from the key fob to text messages, the latter being a form of authentication that security experts say is less secure than other forms of two-factor authentication (2FA).</p>
<p>The move by eBay comes just months after the <strong>National Institute for Standards and Technology</strong> (NIST) released <a href="https://pages.nist.gov/800-63-3/sp800-63b.html" target="_blank">a draft of new authentication guidelines</a> that appear to be phasing out the use of SMS-based two-factor authentication. NIST said one-time codes that are texted to users over a mobile phone are vulnerable to interception, noting that thieves can divert the target&#8217;s SMS messages and calls to another device (either by social engineering a customer service person at the phone company, or via more advanced attacks like <a href="https://www.google.com/search?q=ss7+attack&amp;oq=ss7+attack&amp;aqs=chrome.0.0l6.1527j0j7&amp;sourceid=chrome&amp;ie=UTF-8" target="_blank">SS7 hacks</a>).<span id="more-38666"></span></p>
<p>I asked eBay to explain their rationale for suggesting this switch. I received a response suggesting the change was more about bringing authentication in-house (the security key is made by <strong>Verisign</strong>) and that eBay hopes offer additional multi-factor authentication options in the future.</p>
<p>&#8220;As a company, eBay is committed to providing a safe and secure marketplace for our millions of customers around the world,&#8221; eBay spokesman <strong>Ryan Moore</strong> wrote. &#8220;Our product team is constantly working on establishing new short-term and long-term, eBay-owned factors to address our customer’s security needs. To that end, we’ve launched SMS-based 2FA as a convenient 2FA option for eBay customers who already had hardware tokens issued through PayPal. eBay continues to work on advancing multi-factor authentication options for our users, with the end goal of making every solution more secure and more convenient. We look forward to sharing more as additional solutions are ready to launch.&#8221;</p>
<p>I think I&#8217;ll keep my key fob and continue using that for two-factor authentication on both PayPal and eBay, thank you very much. It&#8217;s not clear whether eBay is also phasing out the use of <a href="http://pages.ebay.com/securitycenter/OnlineSafetyTips.html#two-factor" target="_blank">Symantec&#8217;s VIP Security Key App</a>, which has long offered eBay and PayPal users alike more security than a texted one-time code. eBay did not respond to specific questions regarding this change.</p>
<p>Although SMS is not as secure as other forms of 2FA, it is probably better than nothing. Are you taking advantage of two-factor authentication wherever it is offered? The site <a href="https://twofactorauth.org/" target="_blank">twofactorauth.org</a> maintains a fairly comprehensive list of companies that offer two-step or two-factor authentication.</p>


feed_id: https://krebsonsecurity.com/?p=38718
title: Phishing 101 at the School of Hard Knocks
uri: Phishing-101-at-the-School-of-Hard-Knocks
url: https://krebsonsecurity.com/2017/03/phishing-101-at-the-school-of-hard-knocks/
content:
<p>A recent, massive spike in sophisticated and successful phishing attacks is prompting many universities to speed up timetables for deploying mandatory two-factor authentication (2FA) &#8212; requiring a one-time code in addition to a password &#8212; for access to student and faculty services online. This is the story of one university that accelerated plans to require 2FA after witnessing nearly twice as many phishing victims in the first two-and-half months of this year than it saw in all of 2015.</p>
<p><img class="alignright size-full wp-image-38724" src="media/aafbd21f.bg.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/bg.png" alt="bg" width="232" height="172" /><strong>Bowling Green State University</strong> in Ohio has more than 20,000 students and faculty, and like virtually any other mid-sized state school its Internet users are constantly under attack from scammers trying to phish login credentials for email and online services.</p>
<p>BGSU had planned later this summer to make 2FA mandatory for access to the school&#8217;s portal &#8212; the primary place where students register for classes, pay bills, and otherwise manage their financial relationship to the university.</p>
<p>That is, until a surge in successful phishing attacks resulted in several students having bank accounts and W-2 tax forms siphoned.</p>
<p>On March 1, 2017 all BGSU account holders were required to change their passwords, and on March 15, 2017 two-factor authentication (<a href="https://duo.com/" target="_blank">Duo</a>) protection was placed in front of the MyBGSU portal [full disclosure: Duo is a longtime advertiser on KrebsOnSecurity].</p>
<p><strong>Matt Haschak</strong>, director of IT security and infrastructure at BGSU, said the number of compromised accounts detected at BGSU has risen from 250 in calendar year 2015 to 1000 in 2016, and to <em>approximately 400 in the first 75 days of 2017</em>.</p>
<p>Left unchecked, phishers are on track to steal credentials from nearly 10 percent of the BGSU student body by the end of this year. The university has offered 2FA options for its portal access since June 2016, but until this month few students or faculty were using it, Haschak said.</p>
<p><span class="pullquote pqleft">&#8220;We saw very low adoption when it was voluntary,&#8221; he said. &#8220;And typically the people who adopted it were not my big security risks.&#8221;</span></p>
<p>Haschak said it&#8217;s clear that the scale and size of the phishing problem is hardly unique to BGSU.</p>
<p>&#8220;As I keep preaching to our campus community, this is not unique to BGSU,&#8221; Haschak said. &#8220;I&#8217;ve been talking a lot lately to my counterparts at universities in Ohio and elsewhere, and we’re all getting hit with these attacks very heavily right now. Some of the phishing scams are pretty good, but unfortunately some are god-awful, and I think people are just not thinking or they&#8217;re too busy in their day, they receive something on their phone and they just click it.&#8221;</p>
<p>Last month, an especially tricky phishing scam fooled several students who are also employed at the university into giving away their BGSU portal passwords, after which the thieves changed the victims&#8217; direct deposit information so that their money went to accounts controlled by the phishers.</p>
<p>In other scams, the phishers would change the routing number for a bank account tied to a portal user, and then cancel that student&#8217;s classes near the beginning of a semester &#8212; thus kicking off a fraudulent refund.</p>
<p>One of the victims even had a <a href="https://krebsonsecurity.com/?s=tax+refund+fraud&amp;x=0&amp;y=0" target="_blank">fraudulent tax refund request</a> filed in her name with the IRS as a result, Haschak said.</p>
<p>&#8220;They went in and looked at her W-2 information, which is also available via the portal,&#8221; he said.<span id="more-38718"></span></p>
<p>While BGSU sends an email each time account information is changed, the thieves also have been phishing faculty and staff email accounts &#8212; which allows the crooks to delete the notification emails.</p>
<p>&#8220;The bad guys also went in and deleted the emails we sent, and then deleted the messages from the victim&#8217;s trash folder,&#8221; Haschak said.</p>
<div id="attachment_38722" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-38722" src="media/e6087c0c.bgsu-580x218.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/bgsu-580x218.png" alt="Part of BGSU's messaging to students and faculty about the new 2FA requirements for university portal access." width="580" height="218" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/bgsu-580x218.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/bgsu-768x288.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/bgsu.png 861w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Part of BGSU&#8217;s messaging to students and faculty about the new 2FA requirements for university portal access.</p></div>
<p>Ultimately, BGSU opted to roll out 2FA in a second stage for university email, mainly because of the logistics and support issues involved, but also because they wanted to focus on protecting the personally identifiable information in the BGSU portal as quickly as possible.</p>
<p>For now, BGSU is working on automating the opt-in for 2FA on university email. The 2FA system in front of its portal provides several 2FA options for students, including the Duo app, security tokens, or one-time codes sent via phone or SMS.</p>
<p>&#8220;If the numbers of compromised accounts keep increasing at the rate they are, we may get to that next level a lot sooner than our current roadmap for email access,&#8221; Haschak said.</p>
<p>2FA, also called multi-factor authentication or two-step verification, is a great way to dramatically improve the security of on online account &#8212; whether it&#8217;s at your bank, a file-sharing service, or your email. The idea is that even if thieves manage to snag your username and password &#8212; through phishing or via password-stealing malware &#8212; they still need access to that second factor to successfully impersonate you to the system.</p>
<p>Are you taking full advantage of 2FA options available to your various online accounts? Check out <a href="https://twofactorauth.org/" target="_blank">twofactorauth.org</a> to find out where you might be able to harden your online account security.</p>


feed_id: https://krebsonsecurity.com/?p=38712
title: Alleged vDOS Owners Poised to Stand Trial
uri: Alleged-vDOS-Owners-Poised-to-Stand-Trial
url: https://krebsonsecurity.com/2017/03/alleged-vdos-owners-poised-to-stand-trial/
content:
<p>Police in Israel are recommending that the state attorney&#8217;s office indict and prosecute two 18-year-olds suspected of operating <strong>vDOS</strong>, until recently the most popular attack service for knocking Web sites offline.</p>
<p>On Sept. 8, 2016, KrebsOnSecurity <a href="http://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">published a story</a> about the hacking of vDOS, a service that attracted tens of thousands of paying customers and facilitated countless distributed denial-of-service (DDoS) attacks over the four year period it was in business. That story named two young Israelis &#8212; <strong>Yarden Bidani</strong> and <strong>Itay Huri</strong> &#8212; as the likely owners and operators of vDOS, and within hours of its publication the two <a href="https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/" target="_blank">were arrested by Israeli police</a>, placed on house arrest for 10 days, and forbidden from using the Internet for a month.</p>
<div id="attachment_38757" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-38757" src="media/51a89b2f.vdos-front-580x392.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/vdos-front-580x392.png" alt="The front page of vDOS, when it was still online last year." width="580" height="392" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/vdos-front-580x392.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/vdos-front.png 619w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The front page of vDOS, when it was still online last year.</p></div>
<p>After those restrictions came and went, some readers expressed surprise that there were no formal charges announced against either of the young men. This week, however, Israeli police sent letters to lawyers for both men stating that the official investigation was nearing completion and that they planned to urge government prosecutors to pursue criminal charges.</p>
<p>The police are preparing to recommend prosecutors charge the men with computer fraud and extortion, alleging they caused more than six million shekels worth of damage (approximately USD $1.65 million).</p>
<p>Bidani&#8217;s attorney <strong>Perach Aroch</strong> told KrebsOnSecurity that her client has not yet been officially charged with any crime. But she said once the investigation is complete the defense will have 30 days to review the evidence and to make arguments as to why the case should be dismissed.</p>
<p>&#8220;They have to give us 30 days to see all the evidence and to try to convince them why they should not take this case to court,&#8221; Aroch said. &#8220;After that, [the prosecutors will] decide if it should go to trial.&#8221;</p>
<div id="attachment_36294" style="width: 237px" class="wp-caption alignleft"><img class=" wp-image-36294" src="media/40d39be4.yardbid-580x639.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/yardbid-580x639.png" alt="18-year-old Yarden Bidani." width="227" height="250" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/yardbid-580x639.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/yardbid-768x847.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/yardbid.png 800w" sizes="(max-width: 227px) 100vw, 227px" /><p class="wp-caption-text">18-year-old Yarden Bidani.</p></div>
<p>The arrest of Bidani and Huri came after the police received information from the <strong>Federal Bureau of Investigation</strong> (FBI). But the United States apparently isn&#8217;t the only country weighing in on this case: According to <a href="http://www.themarker.com/technation/1.3952061" target="_blank">a story</a> published Sunday by Israeli news outlet <em>TheMarker.com</em>, the government of Sweden also is urging Israeli prosecutors to pursue formal charges.</p>
<p>It&#8217;s unclear exactly why the Swedish government is so interested in this case, but the vDOS service has been implicated in a series high-profile attacks that brought down some of the country&#8217;s largest news media Web sites last year.</p>
<p>Shortly after those attacks in March 2016, Somerville, Mass.-based security intelligence firm <strong>Recorded Future</strong> published <a href="https://www.recordedfuture.com/swedish-media-attacks/" target="_blank">an analysis</a> linking the assaults against Swedish media sites to vDOS and to &#8220;applej4ck,&#8221; the hacker nickname allegedly used by Bidani.</p>
<p>In publicizing the news of vDOS&#8217;s hack last year, KrebsOnSecurity also published several months of attack logs from the vDOS service. However, those logs only dated back to May 2016.</p>
<p>Itay Huri&#8217;s lawyer declined to comment for this story, but TheMarker&#8217;s <strong>Amitai Ziv</strong> obtained a statement from Huri&#8217;s attorney, who accused Israeli police of applying pressure and terror through the media instead of looking for the truth.</p>
<p>Ziv said sources he&#8217;s spoken to believe the case will almost certainly go to trial.</p>
<p>&#8220;Professionals involved in the case said the likelihood of indictments in the affair is very high,&#8221; he wrote.</p>
<p>According to Bidani&#8217;s lawyer Aroch, the two former friends are now pointing the finger of blame at each other and are no longer speaking to one another.</p>
<p><span class="pullquote pqright">&#8220;They each now accuse each other in things, so it’s a little bit of a problem,&#8221; Aroch said.</span></p>
<p>Aroch said both Bidani and Huri are free to travel and even leave the country, although both men have had their bank and PayPal accounts frozen.</p>
<p>Bidani and Huri allegedly started vDOS when they were 14 years old. By the time the service was shut down last September, it had attracted tens of thousands of customers who paid for attacks in PayPal (when vDOS&#8217;s PayPal accounts were shut down, the service briefly shifted to accepting payment via Bitcoin).</p>
<p>My <a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">Sept. 2016 investigation</a> into the hacking of vDOS revealed that in just two of the four years the service was in operation, <em>it brought in revenues of more than $600,000.</em><span id="more-38712"></span></p>
<p>It&#8217;s unclear how many digital sieges were launched by vDOS, but it was likely several million. The aforementioned user logs stolen from vDOS and leaked to KrebsOnSecurity show that in just the span of less than three months last year the service was responsible for more than 150,000 attacks.</p>
<p>KrebsOnSecurity paid a heavy price for breaking the story on vDOS&#8217;s hacking and the subsequent arrest of its alleged proprietors. Less than two weeks after those stories were published in September 2016, this site came under <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">one of the largest DDoS attacks</a> the Internet has ever witnessed.</p>
<p>That series of attacks ultimately knocked this site offline for nearly four days. According to <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank">follow-up reporting published in January 2017</a>, the attacks were paid for by a cybercriminal who was upset and/or inconvenienced by my exposé on vDOS.</p>
<p>Lawyers for Bidani and Huri have said their clients were merely operating a defensive &#8220;stresser&#8221; service sold to companies that wished to test whether their sites could withstand large cyberattacks. The owners of these stresser services have sought to hide behind wordy “terms of service” agreements which all customers must agree to, arguing that these agreements <a href="https://krebsonsecurity.com/2013/05/ragebooter-legit-ddos-service-or-fed-backdoor/" target="_blank">absolve them of any sort of liability</a> for how their customers use the service.</p>
<p>Law enforcement officials both in the United States and abroad say stresser services enable illegal activity, and they&#8217;ve recently begun arresting both owners and users of these services.</p>
<p>In December 2016, federal investigators in the U.S. and Europe <a href="https://krebsonsecurity.com/2016/12/operation-tarpit-targets-customers-of-online-attack-for-hire-services/" target="_blank">arrested nearly three-dozen people</a> suspected of patronizing stresser services (also known as &#8220;<a href="https://krebsonsecurity.com/?s=booter&amp;x=0&amp;y=0" target="_blank">booter</a>&#8221; services). That crackdown was billed as part of an effort by authorities to weaken demand for these services, and to impress upon customers that hiring someone to launch cyberattacks on your behalf can land you in jail. In October 2016, the U.S. Justice Department <a href="https://krebsonsecurity.com/2016/10/feds-charge-two-in-lizard-squad-investigation/" target="_blank">charged two 19-year-old men</a> alleged to have operated a stresser service affiliated with the hacking group known as the <a href="https://krebsonsecurity.com/?s=lizard+squad&amp;x=0&amp;y=0" target="_blank">Lizard Squad</a>.</p>


feed_id: https://krebsonsecurity.com/?p=38802
title: Post-FCC Privacy Rules, Should You VPN?
uri: Post-FCC-Privacy-Rules-Should-You-VPN
url: https://krebsonsecurity.com/2017/03/post-fcc-privacy-rules-should-you-vpn/
content:
<p>Many readers are understandably concerned about recent moves by the U.S. Congress that would roll back privacy rules barring broadband Internet service providers (ISPs) from sharing or selling customer browsing history, among other personal data. Some are concerned enough by this development that they&#8217;re looking at obfuscating all of their online browsing by paying for a subscription to a virtual private networking (VPN) service. This piece is intended to serve as a guidepost for those contemplating such a move.</p>
<p><img class="alignright wp-image-38809" src="media/a94e55f2.vpn-580x585.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/vpn-580x585.png" alt="vpn" width="255" height="258" />On Tuesday, the House approved a Senate resolution to roll back data privacy regulations enacted late last year at the <strong>Federal Communications Commission</strong> (FCC) that would block ISPs from selling to advertisers information about where you go and what you do online. <strong>President Trump</strong> has signaled his intent to sign the bill (<a href="https://www.congress.gov/bill/115th-congress/senate-joint-resolution/34" target="_blank">S.J. Res. 34</a>) into law soon.</p>
<p>As shocking as this sounds, virtually nothing has changed about the privacy of the average American&#8217;s connection to the Internet as a result of this action by Congress, except perhaps a greater awareness that ISP customers don&#8217;t really have many privacy protections by default. The FCC rules hadn&#8217;t yet gone into effect, and traditional broadband providers successfully made the case to lawmakers that the new rules put them at a competitive disadvantage vis-a-vis purely Web-based rivals such as Facebook and Google.</p>
<p>Nevertheless, this hasn&#8217;t stopped news outlets from breathlessly urging concerned citizens to reclaim their privacy by turning to VPN providers. And VPN providers have certainly capitalized on the news. One quite large (and savvy) VPN provider even took out <a href="https://twitter.com/courosa/status/846133691571056641" target="_blank">a full-page ad</a> in the <em>New York Times</em> listing the names of the Republican senators who voted to repeal the still-dormant regulations.</p>
<p>I&#8217;m happy if this issue raises the general level of public awareness about privacy and the need for Internet users everywhere to take a more active role in preserving it. And VPNs can be a useful tool for protecting one&#8217;s privacy online. However, it&#8217;s important to understand the limitations of this technology, and to take the time to research providers before entrusting them with virtually all your browsing data &#8212; and possibly even compounding your privacy woes in the process.</p>
<p>In case any readers are unclear on the technology, in a nutshell VPNs rely on specialized software that you download and install on your computer. Some VPN providers will supply customers with their own custom brand of VPN software, while others may simply assign customers a set user credentials and allow users to connect to the service via open-source VPN software like OpenVPN.</p>
<p>Either way, the software creates an encrypted tunnel between your computer and the VPN provider, effectively blocking your ISP or anyone else on the network (aside from you and the VPN provider) from being able to tell which sites you are visiting or viewing the contents of your communications. A VPN service allows a customer in, say, New York City, to tunnel his traffic through one of several servers around the world, making it appear to any Web sites that his connection is coming from those servers, not from his ISP in New York.</p>
<p>If you just want a VPN provider that will keep your ISP from snooping on your everyday browsing, virtually any provider can do that for you. But if you care about choosing from among VPN providers with integrity and those that provide reliable, comprehensive, trustworthy and affordable offerings, you&#8217;re going to want to do your homework before making a selection. And there are plenty of factors to consider.</p>
<p>For better or worse, there are hundreds of VPN providers out there today. Simply searching the Web for &#8220;VPN&#8221; and &#8220;review&#8221; is hardly the best vetting approach, as a great many VPN companies offer &#8220;affiliate&#8221; programs that pay people a commission for each new customer they help sign up. I say this not to categorically discount VPN providers that offer affiliate programs, but more as a warning that such programs can skew search engine results in favor of larger providers.</p>
<p>That&#8217;s because affiliate programs often create a perverse incentive for unscrupulous marketers to do things like manufacture phony VPN reviews by the virtual truckload, reviews that are aimed at steering as many people as possible to signing up with the service and earning them commissions. In my admittedly limited experience, this seems to have the effect of funneling search results toward VPN providers which spend a lot of money marketing their offerings and paying for affiliate programs.</p>
<p>Also, good luck figuring out who owns and operates many of these companies. Again, from the admittedly few instances in which I&#8217;ve attempted to determine exactly who or what is at the helm of a specific VPN provider, I can say that this has not been a particularly fruitful endeavor.</p>
<p>My bar for choosing a VPN provider has more to do with selecting one that makes an effort to ensure its customers understand how to use the service securely and safely, and to manage their customers&#8217; expectations about the limitations of using the service. Those include VPN companies that take the time to explain seemingly esoteric but important concepts, such as <a href="https://www.howtogeek.com/253475/how-to-see-if-your-vpn-is-leaking-your-personal-information/" target="_blank">DNS and IPv6 leaks</a>, and whether they keep any logs of customer activity. I also tend to put more stock in VPN providers that offer payment mechanisms which go beyond easily-traceable methods such as credit cards or PayPal, to offering more privacy-friendly payment options like Bitcoin (or even cash).</p>
<p>Many VPN providers claim they keep zero records of customer activity. However, this is almost always untrue if you take the time to read the fine print. Also, some VPN services can&#8217;t truthfully make this claim because they merely resell network services offered by third-parties. Providers that are honest and up-front about what information they collect and keep and for how long carry more weight in my book.</p>
<p>Most VPN providers will keep basic information about their customers, including any information supplied at the creation of the account, as well as the true Internet address of the customer and the times that customers connect and disconnect from the service. I&#8217;ve found that VPN providers which collect the minimum amount of information about their customers also tend to offer little or no customer support. This isn&#8217;t necessarily a bad thing, especially if you know what you&#8217;re doing and don&#8217;t need or want a lot of hand-holding. For my part, I would avoid any VPN provider which asks for personal information that isn&#8217;t required by the form of payment I choose.</p>
<p>Then there are more practical, day-to-day considerations that may have little to do with privacy and anonymity. For example, some VPN providers pay a great deal of attention to privacy and security, but may not offer a huge number of servers and locations to chose from. This can present issues for people who frequently watch streaming video services that are restricted for use in specific countries. Other VPN providers may offer an impressive range of countries and/or states to chose from, but do not provide fast enough speeds to reliably satisfy data-intensive applications, such as streaming video.<span id="more-38802"></span></p>
<p>These are only some of the many factors that are important to weigh when selecting a VPN provider. I asked my favorite source for online privacy &#8212; the <a href="https://www.eff.org/" target="_blank">Electronic Frontier Foundation</a> (EFF) &#8212; if they had any recommendations for VPN providers. Alas, their press folks told me the EFF has not yet sought to vet the claims made by various VPN companies. Instead, their media folks referred me to <a href="https://thatoneprivacysite.net/choosing-the-best-vpn-for-you/" target="_blank">this site</a>, which covers many of the concerns raised in this post in greater detail, and includes what appear to be fairly straightforward reviews and <a href="https://thatoneprivacysite.net/simple-vpn-comparison-chart/" target="_blank">side-by-side comparisons</a> of many popular VPN services.</p>
<p>For personal privacy reasons, I&#8217;m not interested in sharing the name of the VPN service that I&#8217;ve paid for and trusted for years. But I can say with some gratification that they are one of the highest rated (greens almost across the board) providers listed <a href="https://thatoneprivacysite.net/simple-vpn-comparison-chart/" target="_blank">here</a>.</p>
<p>A quick note about &#8220;free VPN&#8221; services. Just as with &#8220;free&#8221; services like Facebook and Gmail, it&#8217;s important to know that with free VPN services you probably aren&#8217;t so much the customer as the product. Operating a business like a VPN service takes considerable effort and cost, and it&#8217;s very likely that anyone operating a free VPN service is also somehow monetizing your use of their service in some way &#8212; probably in an way that may be at odds with your reason for using the service in the first place.</p>
<p>Alternatively, if you&#8217;re looking for a free option, consider using <a href="https://www.torproject.org/" target="_blank">Tor</a> instead. Short for &#8220;The Onion Router,&#8221; Tor takes your communications and bounces them through a series of layers or &#8220;relays&#8221; around the globe, encrypting your data at every hop. The practical and privacy limitations of Tor are explained rather succinctly in <a href="https://www.howtogeek.com/142380/htg-explains-is-tor-really-anonymous-and-secure/" target="_blank">this story</a> at <em>How-to Geek</em>, but many of the traditional concerns about Tor are mitigated by the technical limitations that ship with the current Tor Browser Bundle. For most users, the principal drawback of Tor versus paid VPN services is that Tor is likely to be far slower than your average VPN (although, to be fair Tor has gotten quite a bit faster in recent years).</p>
<p>Finally, from the read-my-mind department, I fell asleep last night ruminating over what a grass-roots effort to lawfully and publicly resist this move by Congress might look like, and briefly considered that someone could even set up a site that would offer to purchase the Internet browsing records of the top lawmakers who voted for repealing the FCC rules (should those records ever go on sale by the major broadband providers). Incredibly, I awoke this morning to an email from a reader about exactly such an experiment &#8212; <a href="https://www.searchinternethistory.com/" target="_blank">searchinternethistory.com</a> &#8212; which has raised more than $170,000 so far toward a $1 million goal via GoFundMe.</p>
<p>As cathartic as this effort may be, I can&#8217;t recommend supporting it financially. However, if you&#8217;re in a generous mood I would wholeheartedly recommend <a href="https://supporters.eff.org/donate/button" target="_blank">supporting</a> groups like the EFF, which orchestrates efforts to educate lawmakers on important technology policy issues and &#8212; failing that &#8212; to derail and sometimes overturn bone-headed policy moves in Washington, D.C. that endanger our security and privacy. KrebsOnSecurity supports the EFF with four-figure donations each year, and I would encourage anyone with the means and interest to likewise support the work of this important organization.</p>
<p><em>Author&#8217;s note: On any given week, I probably remove a dozen or so comments from people who appear to be shilling for various VPN providers. Any comments to that effect on this post will be similarly deleted without hesitation or explanation.</em></p>


feed_id: https://krebsonsecurity.com/?p=38837
title: Why I Always Tug on the ATM
uri: Why-I-Always-Tug-on-the-ATM
url: https://krebsonsecurity.com/2017/03/why-i-always-tug-on-the-atm/
content:
<p>Once you understand how easy and common it is for thieves to attach &#8220;skimming&#8221; devices to ATMs and other machines that accept debit and credit cards, it&#8217;s difficult not to closely inspect and even tug on the machines before using them. Several readers who are in the habit of doing just that recently shared images of skimmers they discovered after gently pulling on various parts of a cash machine they were about to use.</p>
<p>Viewed from less than two feet away, this ATM looks reasonably safe to use, right?</p>
<div id="attachment_38838" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-38838" src="media/ac846d9b.atm-stepback-580x556.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/atm-stepback-580x556.png" alt="Although it's difficult to tell from even this close, this ATM's card acceptance slot and cash dispenser are both compromised by skimming devices." width="580" height="556" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/atm-stepback-580x556.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/atm-stepback-768x737.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/atm-stepback.png 878w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Although it may be difficult to tell from even this close, this ATM&#8217;s card acceptance slot and cash dispenser are both compromised by skimming devices.</p></div>
<p>But something fishy comes into view when we change our perspective slightly. Can you spot what doesn&#8217;t belong here?</p>
<div id="attachment_38839" style="width: 560px" class="wp-caption aligncenter"><img class="size-full wp-image-38839" src="media/2e8d5674.cashcamsideview.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/cashcamsideview.png" alt="Can you spot what doesn't belong here?" width="550" height="849" /><p class="wp-caption-text">Can you spot what doesn&#8217;t belong here?</p></div>
<p>Congratulations if you noticed the tiny pinhole in the upper right corner of the phony black bezel that was affixed over top of the cash dispenser slot. That fake bezel overlay contained a tiny pinhole camera angled toward the PIN pad to record time-stamped videos of people entering their PINs:</p>
<div id="attachment_38840" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-38840" src="media/e3526edf.cashskimmercloseup-580x378.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/cashskimmercloseup-580x378.png" alt="A closeup of the tiny pinhole that allows a mini spy camera embedded in the fake cash dispenser bezel to record customers entering their PINs." width="580" height="378" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/cashskimmercloseup-580x378.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/cashskimmercloseup-768x500.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/cashskimmercloseup-940x612.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/cashskimmercloseup.png 1186w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A closeup of the tiny pinhole that allows a mini spy camera embedded in the fake cash dispenser bezel to record customers entering their PINs.</p></div>
<p>How about the card acceptance slot? Looks legit (if a tad shinier than the rest of the ATM), right?</p>
<p><img class="aligncenter size-medium wp-image-38841" src="media/b994fee4.fakecardbezel-580x504.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/fakecardbezel-580x504.png" alt="fakecardbezel" width="580" height="504" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/fakecardbezel-580x504.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/fakecardbezel-768x668.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/fakecardbezel-940x818.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/fakecardbezel.png 967w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>What happens if we apply a tiny bit of pressure to the anti-skimming green bezel where customers are expected to insert their ATM cards? Look at that! The cheap plastic bezel that skimmer thieves placed on top of the real card acceptance slot starts to pull away. Also, you can see some homemade electronics that are not very well hidden at the mouth of the bezel.</p>
<div id="attachment_38842" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-38842" src="media/1693e300.phonycardbezel-580x475.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/phonycardbezel-580x475.png" alt="Notice the left side of this card skimmer overlay starts to pull away from the rest of the facade when squeezed. Also note the presence of a circuit board close to the mouth of the fake bezel." width="580" height="475" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/phonycardbezel-580x475.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/phonycardbezel-768x629.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/03/phonycardbezel-940x770.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/03/phonycardbezel.png 987w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Notice the left side of this card skimmer overlay starts to pull away from the rest of the facade when squeezed. Also note the presence of a circuit board close to the mouth of the fake bezel.</p></div>
<p><span id="more-38837"></span>ATM card skimmers contain tiny bits of electronics that record payment card data from the magnetic stripe on the backs of cards inserted into a hacked ATM. Most commonly (as in this case), a card skimmer is paired with a pinhole spy camera hidden above or beside the PIN pad to record time-stamped video of cardholders entering their PINs. Taken together, the stolen data allows thieves to fabricate new cards and use PINs to withdraw cash from victim accounts.</p>
<p>Card skimmers <a href="https://krebsonsecurity.com/2011/03/green-skimmers-skimming-green/" target="_blank">designed to look like the green anti-skimming devices</a> found on many ATMs are some of the most common cash machine skimming devices in use today, probably because they are relatively cheap to manufacture en masse and there are many fraudsters peddling these in the cybercrime underground.</p>
<p>Typically, the fake anti-skimmer bezels like the one pictured above are <a href="http://krebsonsecurity.com/2011/12/pro-grade-3d-printer-made-atm-skimmer/" target="_blank">made of hard plastic</a>. However, the reader who shared these images said this bezel card skimming device was made of a semi-flexible, vinyl-like plastic material.</p>
<p>&#8220;I immediately went in and notified the manager who shut down the machine,&#8221; the reader said in an email to KrebsOnSecurity. &#8220;All the tellers were busy so he asked me to stand by the ATM and stop people from trying to use it while he called his security team. In the three minutes I was standing there a young woman came up and started to dip her card in the slot even thought the screen was black. I stopped her and told her and pointed out what was going. She was thankful.&#8221;</p>
<p>Normally, these bezel skimmers look more like the hard plastic one that came off of this ATM at a 7-Eleven convenience store in Texas in February, after a customer yanked on the ATM&#8217;s card acceptance slot:</p>
<div id="attachment_38846" style="width: 537px" class="wp-caption aligncenter"><img class="size-full wp-image-38846" src="media/0dc67ca0.7-11bezel.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/7-11bezel.png" alt="A skimmer overlay that came off an ATM at a 7-Eleven convenience store in Texas after a curious customer tugged on the card slot." width="527" height="796" /><p class="wp-caption-text">A skimmer overlay that came off an ATM at a 7-Eleven convenience store in Texas after a curious customer tugged on the card slot.</p></div>
<p>Many people believe that skimmers are mainly a problem in the United States, where most ATMs still do not require more secure chip-based cards that are far more expensive and difficult for thieves to clone. However, it&#8217;s precisely because most U.S. ATMs lack this security requirement that skimming remains so prevalent in Europe.</p>
<p>Mainly for reasons of backward compatibility to accommodate American tourists, many European ATMs allow non-chip-based cards to be inserted into the cash machine. What&#8217;s more, many chip-based cards issued by American and European banks alike still have cardholder data encoded on a magnetic stripe in addition to the chip.</p>
<p>When thieves skim ATMs in Europe, they generally sell the stolen card and PIN data to fraudsters on the other side of the pond. Those fraudsters in turn will encode the card data onto counterfeit cards and withdraw cash at ATMs here in the United States.</p>
<p>Interestingly, even after most U.S. banks put in place chip-capable ATMs, the magnetic stripe will still be needed because it’s an integral part of the way ATMs work: Most ATMs in use today require a magnetic stripe for the card to be accepted into the machine. The main reason for this is to ensure that customers are putting the card into the slot correctly, as embossed letters and numbers running across odd spots in the card reader can take their toll on the machines over time.</p>
<p>Below is part of a skimming device that a reader recently pulled off of a compromised ATM in Dusseldorf, Germany. This component actually cracked off of the hard plastic fake anti-skimming bezel that was placed by a fraudster over top of the card acceptance device of an NCR cash machine there.</p>
<p><img class="aligncenter size-medium wp-image-38847" src="media/34a68b9d.de-brokenskim-580x845.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/de-brokenskim-580x845.png" alt="de-brokenskim" width="580" height="845" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/de-brokenskim-580x845.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/de-brokenskim.png 599w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>Here&#8217;s the plastic overlay that the piece pictured in the reader&#8217;s hand above broke away from:</p>
<p><img class="aligncenter size-medium wp-image-38848" src="media/e246f528.de-crackedbezel-580x434.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/03/de-crackedbezel-580x434.png" alt="de-crackedbezel" width="580" height="434" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/03/de-crackedbezel-580x434.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/03/de-crackedbezel.png 644w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>It&#8217;s fine to tug on parts of an ATM before using it (heck, I&#8217;ve been known to do this even for machines I have no intention of using), but just know that doing so doesn&#8217;t guarantee that you will detect <a href="https://krebsonsecurity.com/2011/01/atm-skimmers-that-never-touch-the-atm/" target="_blank">a cleverly hidden skimmer</a>.</p>
<p>As I’ve noted in countless skimmer stories here, the simplest way to protect yourself from ATM skimming is to cover your hand when entering your PIN. That’s because most skimmers rely on hidden cameras to steal the victim’s PIN. As easy as this is, <a title="http://krebsonsecurity.com/2012/09/a-handy-way-to-foil-atm-skimmer-scams/" href="http://krebsonsecurity.com/2012/09/a-handy-way-to-foil-atm-skimmer-scams/" target="_blank">you’d be amazed at how many people fail to take this basic precaution</a>.</p>
<p>Yes, there is still a chance that thieves could use <a title="http://krebsonsecurity.com/wp-content/uploads/2010/08/skimgallery1.jpg" href="media/b2afe186.skimgallery1.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2010/08/skimgallery1.jpg" target="_blank">a PIN-pad overlay device</a> to capture your PIN, but in my experience these are far less common than hidden cameras (and quite a bit more costly for thieves who aren’t making their own skimmers).</p>
<p>Also, if you visit an ATM that looks strange, tampered with, or out of place, try to find another cash machine. Use only machines in public, well-lit areas, and avoid ATMs in secluded spots. Finally, don&#8217;t neglect your own physical security while at the cash machine: As common as these skimmers are, you&#8217;re probably more likely to get mugged withdrawing cash from an ATM than you are to find a skimmer attached to it.</p>
<p>Did you enjoy this post? Are you fascinated by skimming devices? Check out my series, <a href="https://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers</a>.</p>


