# articles

feed_id: https://krebsonsecurity.com/?p=44932
title: For 2nd Time in 3 Years, Mobile Spyware Maker mSpy Leaks Millions of Sensitive Records
uri: For-2nd-Time-in-3-Years-Mobile-Spyware-Maker-mSpy-Leaks-Millions-of-S
url:
https://krebsonsecurity.com/2018/09/for-2nd-time-in-3-years-mobile-spyware-maker-mspy-leaks-millions-of-sensitive-records/

content:
<p><strong>mSpy</strong>, the makers of a software-as-a-service product that claims to help more than a million paying customers spy on the mobile devices of their kids and partners, has leaked millions of sensitive records online, including passwords, call logs, text messages, contacts, notes and location data secretly collected from phones running the stealthy spyware.</p>
<p>Less than a week ago, security researcher <a href="https://twitter.com/IamNitishShah" target="_blank" rel="noopener"><strong>Nitish Shah</strong></a> directed KrebsOnSecurity to an open database on the Web that allowed anyone to query up-to-the-minute mSpy records for both customer transactions at mSpy&#8217;s site and for mobile phone data collected by mSpy&#8217;s software. The database required no authentication.</p>
<div id="attachment_44971" style="width: 595px" class="wp-caption aligncenter"><a class="lightbox" href="media/27ca359c.mspy-nojb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/mspy-nojb.png"><img class="wp-image-44971" src="media/27ca359c.mspy-nojb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/mspy-nojb.png" alt="" width="585" height="352" /></a><p class="wp-caption-text">A list of data points that can be slurped from a mobile device that is secretly running mSpy&#8217;s software.</p></div>
<p>Before it was taken offline sometime in the past 12 hours, the database contained millions of records, including the username, password and private encryption key of each mSpy customer who logged in to the mSpy site or purchased an mSpy license over the past six months. The private key would allow anyone to track and view details of a mobile device running the software, Shah said.</p>
<p>In addition, the database included the <strong>Apple iCloud</strong> username and authentication token of mobile devices running mSpy, and what appear to be references to iCloud backup files. Anyone who stumbled upon this database also would have been able to browse the <strong>Whatsapp</strong> and <strong>Facebook</strong> messages uploaded from mobile devices equipped with mSpy.</p>
<div id="attachment_44979" style="width: 597px" class="wp-caption aligncenter"><a class="lightbox" href="media/90e78615.mspypass.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/mspypass.png"><img class="wp-image-44979" src="media/90e78615.mspypass.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/mspypass.png" alt="" width="587" height="278" /></a><p class="wp-caption-text">Usernames, passwords, text messages and loads of other more personal details were leaked from mobile devices running mSpy.</p></div>
<p>Other records exposed included the transaction details of all mSpy licenses purchased over the last six months, including customer name, email address, mailing address and amount paid. Also in the data set were mSpy user logs &#8212; including the browser and Internet address information of people visiting the mSpy Web site.</p>
<p>Shah said when he tried to alert mSpy of his findings, the company&#8217;s support personnel ignored him.</p>
<p>&#8220;I was chatting with their live support, until they blocked me when I asked them to get me in contact with their CTO or head of security,&#8221; Shah said.</p>
<p>KrebsOnSecurity alerted mSpy about the exposed database on Aug. 30. This morning I received an email from mSpy&#8217;s chief security officer, who gave only his first name, &#8220;Andrew.&#8221;</p>
<p>&#8220;We have been working hard to secure our system from any possible leaks, attacks, and private information disclosure,&#8221; Andrew wrote. &#8220;All our customers’ accounts are securely encrypted and the data is being wiped out once in a short period of time. Thanks to you we have prevented this possible breach and from what we could discover the data you are talking about could be some amount of customers’ emails and possibly some other data. However, we could only find that there were only a few points of access and activity with the data.&#8221;</p>
<p>Some of those &#8220;points of access&#8221; were mine. In fact, because mSpy&#8217;s Web site access logs were leaked I could view evidence of my own activity on their site in real-time via the exposed database, as could Shah of his own poking around.</p>
<div id="attachment_44978" style="width: 597px" class="wp-caption aligncenter"><a class="lightbox" href="media/37edf3c4.mspy-kibana.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/mspy-kibana.png"><img class="wp-image-44978" src="media/37edf3c4.mspy-kibana.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/mspy-kibana.png" alt="" width="587" height="275" /></a><p class="wp-caption-text">A screen shot of the exposed database. The records shown here are non-sensitive &#8220;debug&#8221; logs.</p></div>
<p><span id="more-44932"></span></p>
<h4>WHO IS MSPY?</h4>
<p>mSpy has a history of failing to protect data about its customers and &#8212; just as critically &#8212; data secretly collected from mobile devices being spied upon by its software. In May 2015, KrebsOnSecurity broke the news that <a href="https://krebsonsecurity.com/2015/05/mobile-spy-software-maker-mspy-hacked-customer-data-leaked/" target="_blank" rel="noopener">mSpy had been hacked and its customer data posted to the Dark Web</a>.</p>
<p>At the time, mSpy initially <a href="https://krebsonsecurity.com/2015/05/mspy-denies-breach-even-as-customers-confirm-it/" target="_blank" rel="noopener">denied suffering a breach for more than a week</a>, even as many of its paying customers confirmed that their information was included in the mSpy database uploaded to the Dark Web. mSpy later acknowledged a breach to the <strong>BBC</strong>, saying it had been the victim of a &#8220;predatory attack&#8221; by blackmailers, and that the company had not given in to demands for money.</p>
<p>mSpy pledged to redouble its security efforts in the wake of the 2015 breach. But more than two weeks after news of the 2015 mSpy breach broke, the company <a href="https://krebsonsecurity.com/2015/05/more-evidence-of-mspy-apathy-over-breach/" target="_blank" rel="noopener">still had not disabled links to countless screenshots on its servers</a> that were taken from mobile devices running mSpy.</p>
<div id="attachment_30952" style="width: 595px" class="wp-caption aligncenter"><a class="lightbox" href="media/4c6eebfa.mspydemo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/05/mspydemo.png"><img class="wp-image-30952" src="media/4c6eebfa.mspydemo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/05/mspydemo.png" alt="" width="585" height="454" srcset="https://krebsonsecurity.com/wp-content/uploads/2015/05/mspydemo.png 974w, https://krebsonsecurity.com/wp-content/uploads/2015/05/mspydemo-580x450.png 580w, https://krebsonsecurity.com/wp-content/uploads/2015/05/mspydemo-940x730.png 940w" sizes="(max-width: 585px) 100vw, 585px" /></a><p class="wp-caption-text">Mspy users can track Android and iPhone users, snoop on apps like Snapchat and Skype, and keep a record of everything the target does with his or her phone.</p></div>
<p>It’s unclear exactly where mSpy is based; the company’s Web site suggests it has offices in the United States, Germany and the United Kingdom, although the firm does not appear to list an official physical address. However, according to historic Web site registration records, the company is tied to a now-defunct firm called <strong>MTechnology LTD</strong> out of the United Kingdom.<span id="more-30913"></span></p>
<p>Documents obtained from <strong>Companies House</strong>, an official register of corporations in the U.K., indicate that the two founding members of the company are self-described programmers <strong>Aleksey Fedorchuk</strong> and <strong>Pavel Daletski</strong>. Those <a href="media/d1816241.OfficersMspy.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/OfficersMspy.pdf" target="_blank" rel="noopener">records</a> (PDF) indicate that Daletski is a British citizen, and that Mr. Fedorchuk is from Russia. Neither men could be reached for comment.</p>
<p><a href="media/315eae69.DaletskiTrademarkcase.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/DaletskiTrademarkcase.pdf" target="_blank" rel="noopener">Court documents</a> (PDF) obtained from the U.S. District Court in Jacksonville, Fla. regarding a trademark dispute involving mSpy and Daletski state that mSpy has a U.S.-based address of 800 West El Camino Real, in Mountain View, Calif. Those same court documents indicate that Daletski is a director at a firm based in the Seychelles called <strong>Bitex Group LTD. </strong>Interestingly, that lawsuit was brought by <strong>Retina-X Studios</strong>, an mSpy competitor based in Jacksonville, Fla. that makes a product called <strong>MobileSpy</strong>.</p>
<p>The latest mSpy security lapse comes days after <a href="https://motherboard.vice.com/en_us/article/mb4y5x/thetruthspy-spyware-domestic-abusers-hacked-data-breach" target="_blank" rel="noopener">a hacker reportedly broke into the servers of <strong>TheTruthSpy</strong></a> &#8212; another mobile spyware-as-a-service company &#8212; and stole logins, audio recordings, pictures and text messages from mobile devices running the software.</p>
<p>U.S. regulators and law enforcers have taken a dim view of companies that offer mobile spyware services like mSpy. In September 2014, U.S. authorities <a href="http://www.forbes.com/sites/kashmirhill/2014/09/30/stealthgenie-ugly-marketing-of-spyware/" target="_blank" rel="noopener">arrested</a> a 31-year-old <strong>Hammad Akbar</strong>, the CEO of a Lahore-based company that makes a spyware app called <strong>StealthGenie</strong>. The FBI noted that while the company advertised StealthGenie’s use for “monitoring employees and loved ones such as children,” the primary target audience was people who thought their partners were cheating. Akbar was charged with selling and advertising wiretapping equipment.</p>
<p>“Advertising and selling spyware technology is a criminal offense, and such conduct will be aggressively pursued by this office and our law enforcement partners,” <strong>U.S. Attorney Dana Boente</strong> said in a press release tied to Akbar’s indictment.</p>
<p>Akbar <a href="http://www.justice.gov/opa/pr/man-pleads-guilty-selling-stealthgenie-spyware-app-and-ordered-pay-500000-fine" target="_blank" rel="noopener">pleaded guilty</a> to the charges in November 2014, and according to the Justice Department he is “the first-ever person to admit criminal activity in advertising and selling spyware that invades an unwitting victim’s confidential communications.”</p>
<p>A public relations pitch from mSpy to KrebsOnSecurity in March 2015 stated that approximately 40 percent of the company’s users are parents interested in keeping tabs on their kids. Assuming that is a true statement, it’s ironic that so many parents may now have unwittingly exposed their kids to predators, bullies and other ne’er-do-wells thanks to this latest security debacle at mSpy.</p>
<p>As I wrote in a previous story about mSpy, I hope it’s clear that it is foolhardy to place any trust or confidence in a company whose reason for existence is secretly spying on people. Alas, the only customers who can truly “trust” a company like this are those who don&#8217;t care about the privacy and security of the device owner being spied upon.</p>


feed_id: https://krebsonsecurity.com/?p=44999
title: Browser Extensions: Are They Worth the Risk?
uri: Browser-Extensions-Are-They-Worth-the-Risk
url: https://krebsonsecurity.com/2018/09/browser-extensions-are-they-worth-the-risk/
content:
<p>Popular file-sharing site <strong>Mega.nz</strong> is warning users that cybercriminals hacked its browser extension for <strong>Google Chrome</strong> so that usernames and passwords submitted through the browser were copied and forwarded to a rogue server in Ukraine. This attack serves as a fresh reminder that legitimate browser extensions can and periodically do fall into the wrong hands, and that it makes good security sense to limit your exposure to such attacks by getting rid of extensions that are no longer useful or actively maintained by developers.</p>
<p><img class="aligncenter wp-image-45005" src="media/8b179f15.browsers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/browsers.png" alt="" width="583" height="107" /></p>
<p>In <a href="https://mega.nz/blog_47" target="_blank" rel="noopener">a statement posted to its Web site</a>, Mega.nz said the extension for Chrome was compromised after its Chrome Web store account was hacked. From their post:</p>
<blockquote><p>&#8220;On 4 September 2018 at 14:30 UTC, an unknown attacker uploaded a trojaned version of MEGA&#8217;s Chrome extension, version 3.39.4, to the Google Chrome webstore. Upon installation or autoupdate, it would ask for elevated permissions (Read and change all your data on the websites you visit) that MEGA&#8217;s real extension does not require and would (if permissions were granted) exfiltrate credentials for sites including <strong>amazon.com</strong>, <strong>live.com</strong>, <strong>github.com</strong>, <strong>google.com</strong> (for webstore login), <strong>myetherwallet.com</strong>, <strong>mymonero.com</strong>, <strong>idex.market</strong> and HTTP POST requests to other sites, to a server located in Ukraine. Note that mega.nz credentials were not being exfiltrated.&#8221;</p></blockquote>
<p><a href="https://chrome.google.com/webstore/category/extensions?hl=en" target="_blank" rel="noopener">Browser extensions</a> can be incredibly handy and useful, but compromised extensions &#8212; depending on the level of &#8220;permissions&#8221; or access originally granted to them &#8212; <em>also can give attackers access to all data on your computer and the Web sites you visit</em>.</p>
<p>For its part, Google tries to communicate the potential risk of extensions using three &#8220;alert&#8221; levels: Low, medium and high, as detailed in the screenshot below. In practice, however, most extensions carry the medium or high alert level, which means that if the extension is somehow compromised (or malicious from the get-go), the attacker in control of it is going to have access to ton of sensitive information on a great many Internet users.<span id="more-44999"></span></p>
<p><img class="aligncenter wp-image-45002" src="media/c24a402c.permissionlevels.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/permissionlevels.png" alt="" width="584" height="651" /></p>
<p>In many instances &#8212; as in this week&#8217;s breach with Mega &#8212; an extension gets compromised after someone with legitimate rights to alter its code <a href="https://thehackernews.com/2017/08/chrome-extension-hacking.html" target="_blank" rel="noopener">gets phished or hacked</a>. In other cases, control and ownership of an established extension may simply be abandoned or sold to shady developers. In either scenario, hacked or backdoored extensions can present a nightmare scenario for users.</p>
<p>A basic tenet of cybersecurity holds that individuals and organizations can mitigate the risk of getting hacked to some degree by reducing their overall &#8220;attack surface&#8221; &#8212; i.e., the amount of software and services they rely upon that are potentially vulnerable to compromise. That precept holds fast here as well, because limiting one&#8217;s reliance on third-party browser extensions reduces one&#8217;s risk significantly.</p>
<p>Personally, I do not make much use of browser extensions. In almost every case I&#8217;ve considered installing an extension I&#8217;ve been sufficiently spooked by the permissions requested that I ultimately decided it wasn&#8217;t worth the risk. I currently trust just three extensions in my Google Chrome installation; two of them are made by Google and carry &#8220;low&#8221; risk alert levels. The other is a third-party extension I&#8217;ve used for years that carries a &#8220;medium&#8221; risk rating, but that is also maintained by an individual I know who is extremely paranoid and security-conscious.</p>
<p>If you&#8217;re the type of person who uses multiple extensions, it may be wise to adopt a risk-based approach going forward. In other words, given the high stakes that typically come with installing an extension, consider carefully whether having a given extension is truly worth it. By the way, this applies equally to plug-ins designed for Web site content management systems like <strong>WordPress</strong> and<strong> Joomla</strong>.</p>
<p>At the very least, do not agree to update an extension if it suddenly requests more permissions than a previous version. This should be a giant red flag that something is not right.</p>
<p>Also, never download and install an extension just because a Web site says you need it to view some type of content. Doing otherwise is almost always a high-risk proposition. Here, Rule #1 from <a href="https://krebsonsecurity.com/2011/05/krebss-3-basic-rules-for-online-safety/" target="_blank" rel="noopener">KrebsOnSecurity&#8217;s Three Rules of Online Safety</a> comes into play: &#8220;If you didn&#8217;t go looking for it, don&#8217;t install it.&#8221; Finally, in the event you do wish to install something, make sure you&#8217;re getting it directly from the entity that produced the software.</p>
<p>Google Chrome users can see any extensions they have installed by clicking the three dots to the right of the address bar, selecting &#8220;More tools&#8221; in the resulting drop-down menu, then &#8220;Extensions.&#8221; In Firefox, click the three horizontal bars next to the address bar and select &#8220;Add-ons,&#8221; then click the &#8220;Extensions&#8221; link on the resulting page to view any installed extensions.</p>


feed_id: https://krebsonsecurity.com/?p=45025
title: Leader of DDoS-for-Hire Gang Pleads Guilty to Bomb Threats
uri: Leader-of-DDoS-for-Hire-Gang-Pleads-Guilty-to-Bomb-Threats
url: https://krebsonsecurity.com/2018/09/leader-of-ddos-for-hire-gang-pleads-guilty-to-bomb-threats/
content:
<p>A 19-year-old man from the United Kingdom who headed a cybercriminal group whose motto was &#8220;Feds Can&#8217;t Touch Us&#8221; pleaded guilty this week to making bomb threats against thousands of schools.</p>
<p>On Aug. 31, officers with the U.K.&#8217;s <strong>National Crime Agency</strong> (NCA) arrested Hertfordshire resident <strong>George Duke-Cohan, </strong>who admitted making bomb threats to thousands of schools and a <strong>United Airlines</strong> flight traveling from the U.K. to San Francisco last month.</p>
<div id="attachment_45027" style="width: 558px" class="wp-caption aligncenter"><img class="size-full wp-image-45027" src="media/267d1780.apophis-tweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/apophis-tweet.png" alt="" width="548" height="442" /><p class="wp-caption-text">One of many tweets from the attention-starved Apophis Squad, which launched multiple DDoS attacks against KrebsOnsecurity and Protonmail over the past few months.</p></div>
<p>Duke-Cohan &#8212; a.k.a. &#8220;7R1D3N7,&#8221; &#8220;DoubleParallax&#8221; and &#8220;Optcz1&#8221; &#8212; was among the most vocal members of a group of Internet hooligans that goes by the name &#8220;<strong>Apophis Squad</strong>,&#8221; which for the better part of 2018 has been launching <a href="https://en.wikipedia.org/wiki/Denial-of-service_attack" target="_blank" rel="noopener">distributed denial-of-service (DDoS)</a> attacks against multiple Web sites, including KrebsOnSecurity and <strong>Protonmail.com</strong>.</p>
<p>Incredibly, all self-described members of Duke-Cohan&#8217;s clique were active users of Protonmail, even as they repeatedly attacked its servers and taunted the company on social media.</p>
<p>&#8220;What we found, combined with intelligence provided by renowned <a href="http://krebsonsecurity.com/" target="_blank" rel="noopener noreferrer" data-ss1536244197="1">cyber security journalist Brian Krebs</a>, allowed us to conclusively identify Duke-Cohan as a member of Apophis Squad in the first week of August, and we promptly informed law enforcement,&#8221; Protonmail wrote in a blog post published today. &#8220;British police did not move to immediately arrest Duke-Cohan however, and we believe there were good reasons for that. Unfortunately, this meant that through much of August, ProtonMail remained under attack, but due to the efforts of Radware, ProtonMail users saw no impact.&#8221;<span id="more-45025"></span></p>
<div id="attachment_45028" style="width: 592px" class="wp-caption aligncenter"><img class=" wp-image-45028" src="media/dab13071.as-booter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/as-booter.png" alt="" width="582" height="512" /><p class="wp-caption-text">The DDoS-for-hire service run by Apophis Squad listed their members.</p></div>
<p>On Aug. 9, 2018, the attention-seeking Apophis Squad claimed on their Twitter account that flight UAL 949 had been grounded due to their actions.</p>
<p>&#8220;In a recording of one of the phone calls which was made while the plane was in the air, he takes on the persona of a worried father and claims his daughter contacted him from the flight to say it had been hijacked by gunmen, one of whom had a bomb,&#8221; the NCA said of Duke-Cohan&#8217;s actions in <a href="http://www.nationalcrimeagency.gov.uk/news/1460-british-teen-admits-school-and-flight-bomb-threats" target="_blank" rel="noopener">a press release on Sept. 4</a>. &#8220;On arrival in San Francisco the plane was the subject of a significant security operation in a quarantined area of the airport. All 295 passengers had to remain on board causing disruption to onward journeys and financial loss to the airline.&#8221;</p>
<p>The Apophis Squad modeled itself after the actions of the <a href="https://krebsonsecurity.com/?s=lizard+squad&amp;x=0&amp;y=0" target="_blank" rel="noopener">Lizard Squad</a>, another group of e-fame seeking online hoodlums who also ran a DDoS-for-hire service, called in bomb threats to airlines, DDoSed this Web site repeatedly and whose members were nearly all subsequently arrested and charged with various cybercrimes. Indeed, the Apophis Squad&#8217;s Web site and DDoS-for-hire service is hosted on the same Internet server used by a handful of other domains that were tied to the Lizard Squad.</p>
<p>Unsophisticated but otherwise time-wasting and annoying groups like Apophis Squad are a dime a dozen. But as I like to say, each time my site gets attacked by one of them two things usually happen not long after: Those responsible get arrested, and I get at least one decent story out of it. And if Protonmail is right, there are additional charges on the way.</p>
<p>&#8220;We believe further charges are pending, along with possible extradition to the US,&#8221; the company said. &#8220;In recent weeks, we have further identified a number of other individuals engaged in attacks against ProtonMail, and we are working with the appropriate authorities to bring them to justice.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=44740
title: In a Few Days, Credit Freezes Will Be Fee-Free
uri: In-a-Few-Days-Credit-Freezes-Will-Be-Fee-Free
url: https://krebsonsecurity.com/2018/09/in-a-few-days-credit-freezes-will-be-fee-free/
content:
<p>Later this month, all of the three major consumer credit bureaus will be required to offer free credit freezes to all Americans and their dependents. Maybe you&#8217;ve been holding off freezing your credit file because your home state currently charges a fee for placing or thawing a credit freeze, or because you believe it&#8217;s just not worth the hassle. If that accurately describes your views on the matter, this post may well change your mind.</p>
<p><img class="aligncenter wp-image-40941" src="media/4d359a65.creditfreeze.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/09/creditfreeze.png" alt="" width="582" height="239" /></p>
<p>A credit freeze &#8212; also known as a &#8220;security freeze&#8221; &#8212; restricts access to your credit file, making it far more difficult for identity thieves to open new accounts in your name.</p>
<p>Currently, many states allow the big three bureaus &#8212; <strong>Equifax</strong>, <strong>Experian</strong> and <strong>TransUnion</strong> &#8212; to charge a fee for placing or lifting a security freeze. But thanks to a federal law enacted earlier this year, after Sept. 21, 2018 it will be free to freeze and unfreeze your credit file and those of your children or dependents throughout the United States.</p>
<p>KrebsOnSecurity has for many years urged readers to freeze their files with the big three bureaus, as well as with a distant fourth &#8212; <a href="https://krebsonsecurity.com/2017/09/the-equifax-breach-what-you-should-know/" target="_blank" rel="noopener">Innovis</a> &#8212; and the <a href="https://krebsonsecurity.com/2018/05/another-credit-freeze-target-nctue-com/" target="_blank" rel="noopener">NCTUE</a>, an Equifax-operated credit checking clearinghouse relied upon by most of the major mobile phone providers.</p>
<p>There are dozens of private companies that specialize in providing consumer credit reports and scores to specific industries, including real estate brokers, landlords, insurers, debt buyers, employers, banks, casinos and retail stores. <a href="media/28c09604.201604_cfpb_list-of-consumer-reporting-companies.pdf" data-original-source="https://files.consumerfinance.gov/f/201604_cfpb_list-of-consumer-reporting-companies.pdf" target="_blank" rel="noopener">A handy PDF</a> produced earlier this year by the <strong>Consumer Financial Protection Bureau </strong>(CFPB) lists all of the known entities that maintain, sell or share credit data on U.S. citizens.</p>
<p>The CFPB&#8217;s document includes <em>links to Web sites for 46 different consumer credit reporting entities</em>, along with information about your legal rights to obtain data in your reports and dispute suspected inaccuracies with the companies as needed. My guess is the vast majority of Americans have never heard of most of these companies.</p>
<p>Via numerous front-end Web sites, each of these mini credit bureaus serve thousands or tens of thousands of people who work in the above mentioned industries and who have the ability to pull credit and other personal data on Americans. In many cases, online access to look up data through these companies is secured by nothing more than a username and password that can be stolen or phished by cybercrooks and abused to pull privileged information on consumers.</p>
<p>In other cases, it&#8217;s trivial for anyone to sign up for these services. For example, how do companies that provide background screening and credit report data to landlords decide who can sign up as a landlord? Answer: Anyone can be a landlord (or pretend to be one).</p>
<h4>SCORE ONE FOR FREEZES</h4>
<p>The truly scary part? Access to some of these credit lookup services is supposed to be secured behind a login page, but often isn&#8217;t. Consider the service pictured below, which for $44 will let anyone look up the credit score of any American who hasn&#8217;t already frozen their credit files with the big three. Worse yet, you don&#8217;t even need to have accurate information on a target &#8212; such as their Social Security number or current address.</p>
<p><img class="aligncenter wp-image-45053" src="media/f303249b.crof.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/crof.png" alt="" width="586" height="743" /></p>
<p>KrebsOnSecurity was made aware of this particular portal by <strong>Alex Holden</strong>, CEO of Milwaukee, Wisc.-based cybersecurity firm <a href="http://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security LLC</a> [full disclosure: This author is listed as an adviser to Hold Security, however this is and always has been a volunteer role for which I have not been compensated].</p>
<p>Holden&#8217;s wife Lisa is a real estate agent, and as such she has access to a more full-featured version of the above-pictured consumer data lookup service (among others) for the purposes of helping clients determine a range of mortgage rates available. Mrs. Holden said the version of this service that she has access to will return accurate, current and complete credit file information on consumers even if one enters a made-up SSN and old address on an individual who hasn&#8217;t yet frozen their credit files with the big three.</p>
<p>&#8220;I&#8217;ve noticed in the past when I do a hard pull on someone&#8217;s credit report and the buyer gave me the wrong SSN or transposed some digits, not only will these services give me their credit report and full account history, it also tells you what their correct SSN is,&#8221; Mrs. Holden said.</p>
<p>With Mr. Holden&#8217;s permission, I gave the site pictured above an old street address for him plus a made-up SSN, and provided my credit card number to pay for the report. The document generated by that request said TransUnion and Experian were unable to look up his credit score with the information provided. However, Equifax not only provided his current credit score, it helpfully corrected the false data I entered for Holden, providing the last four digits of his real SSN and current address.</p>
<p>&#8220;We assume our credit report is keyed off of our SSN or something unique about ourselves,&#8221; Mrs. Holden said. &#8220;But it&#8217;s really keyed off your White Pages information, meaning anyone can get your credit report if they are in the know.&#8221;</p>
<p>I was pleased to find that I was unable to pull my own credit score through this exposed online service, although the site still charged me $44. The report produced simply said the consumer in question had requested that access to this information be restricted. But the real reason was simply that I&#8217;ve had my credit file frozen for years now.</p>
<p>Many media outlets are publishing stories this week about the one-year anniversary of the <a href="https://krebsonsecurity.com/?s=equifax+breach&amp;x=0&amp;y=0" target="_blank" rel="noopener">breach at Equifax</a> that exposed the personal and financial data on more than 147 million people. But it’s important for everyone to remember that as bad as the Equifax breach was (and it was <a href="https://krebsonsecurity.com/2017/09/equifax-breach-response-turns-dumpster-fire/" target="_blank" rel="noopener">a total dumpster fire all around</a>), most of the consumer data exposed in the breach has been for sale in the cybercrime underground for many years on a majority of Americans &#8212; including access to consumer credit reports. If anything, the Equifax breach may have simply helped ID thieves refresh some of those criminal data stores.</p>
<div id="attachment_41939" style="width: 602px" class="wp-caption aligncenter"><img class=" wp-image-41939" src="media/693253e2.cp-pullcreditreport.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/cp-pullcreditreport.png" alt="" width="592" height="254" /><p class="wp-caption-text">It costs $35 worth of bitcoin through this cybercrime service to pull someone&#8217;s credit file from the three major credit bureaus. There are many services just like this one, which almost certainly abuse hacked accounts from various industries that have &#8220;legitimate&#8221; access to consumer credit reports.</p></div>
<p><span id="more-44740"></span></p>
<h4>THE FEE-FREE FREEZE</h4>
<p>According to the <strong>U.S. Federal Trade Commission</strong>, when the new law takes effect on September 21, <a href="http://www.equifax.com/" rel="noreferrer" data-ss1536587203="1">Equifax</a>, <a href="http://www.experian.com/" rel="noreferrer" data-ss1536587203="1">Experian</a> and <a href="http://www.transunion.com/" rel="noreferrer" data-ss1536587203="1">TransUnion</a> must each set up a webpage for requesting fraud alerts and credit freezes.</p>
<p>The law also provides additional ID theft protections to minors. Currently, <a href="https://krebsonsecurity.com/2016/01/the-lowdown-on-freezing-your-kids-credit/" target="_blank" rel="noopener">some state laws allow you to freeze a child&#8217;s credit file</a>, while others do not. Starting Sept. 21, no matter where you live you&#8217;ll be able to get a free credit freeze for kids under 16 years old.</p>
<p>Identity thieves can and often do target minors, but usually this type of fraud usually isn&#8217;t discovered until the affected individual tries to apply for credit for the first time, at which point it can be a long and expensive road to undo the mess. As such, I would highly recommend that readers who have children or dependents take full advantage of this offering once it&#8217;s available for free nationwide.</p>
<p>In addition, the law requires the big three bureaus to offer free electronic credit monitoring services to all active duty military personnel. It also changes the rules for &#8220;fraud alerts,&#8221; which currently are free but only last for 90 days. With a fraud alert on your credit file, lenders or service providers should not grant credit in your name without first contacting you to obtain your approval — by phone or whatever other method you specify when you apply for the fraud alert.</p>
<p>Under the new law, fraud alerts last for one year, but consumers can renew them each year. Bear in mind, however, that <em>while lenders and service providers are supposed to seek and obtain your approval if you have a fraud alert on your file,</em> <i>they’re not legally required to do this.</i></p>
<p>A key unanswered question about these changes is whether the new dedicated credit bureau freeze sites will work any more reliably than the current freeze sites operated by the big three bureaus. The Web and social media are littered with consumer complaints &#8212; particularly over the past year &#8212; about the various freeze sites freezing up and returning endless error messages, or simply discouraging consumers from filing a freeze <a href="https://krebsonsecurity.com/2018/05/another-credit-freeze-target-nctue-com/" target="_blank" rel="noopener">thanks to insecure Web site components</a>.</p>
<p>It will be interesting to see whether these new freeze sites will try to steer consumers away from freezes and toward other in-house offerings, such as paid credit reports, credit monitoring, or &#8220;credit lock&#8221; services. All three big bureaus tout their credit lock services as an easier and faster alternative to freezes.</p>
<p>According to <a href="https://www.creditkarma.com/id-theft/i/lock-freeze-credit-file/" target="_blank" rel="noopener">a recent post by CreditKarma.com</a>, consumers can use these services to quickly lock or unlock access to credit inquiries, although some bureaus can take up to 48 hours. In contrast, they can take up to five business days to act on a freeze request, although in my experience the automated freeze process via the bureaus&#8217; freeze sites has been more or less instantaneous (assuming the request actually goes through).</p>
<p>TransUnion and Equifax both offer free credit lock services, while Experian&#8217;s is free for 30 days and $19.99 for each additional month. However, TransUnion says those who take advantage of their free lock service agree to receive targeted marketing offers. What&#8217;s more, TransUnion also pushes consumers who sign up for its free lock service to subscribe to its &#8220;premium&#8221; lock services for a monthly fee with a perpetual auto-renewal.</p>
<p>Unsurprisingly, the bureaus&#8217; use of the term credit lock has confused many consumers; this was almost certainly by design. But here&#8217;s one basic fact consumers should keep in mind about these lock services: Unlike freezes, locks are not governed by any law, meaning that the credit bureaus can change the terms of these arrangements when and if it suits them to do so.</p>
<p>If you&#8217;d like to go ahead with freezing your credit files now, <a href="https://krebsonsecurity.com/2017/09/the-equifax-breach-what-you-should-know/" target="_blank" rel="noopener">this Q&amp;A post from the Equifax breach</a> explains the basics, and includes some other useful tips for staying ahead of identity thieves. Otherwise, check back here later this month for more details on the new free freeze sites.</p>


feed_id: https://krebsonsecurity.com/?p=44969
title: Patch Tuesday, September 2018 Edition
uri: Patch-Tuesday-September-2018-Edition
url: https://krebsonsecurity.com/2018/09/patch-tuesday-september-2018-edition/
content:
<p><strong>Adobe</strong> and <strong>Microsoft</strong> today each released patches to fix serious security holes in their software. Adobe pushed out a new version of its beleaguered <strong>Flash Player</strong> browser plugin. Redmond issued updates to address at least 61 distinct vulnerabilities in <strong>Microsoft Windows</strong> and related programs, including several flaws that were publicly detailed prior to today and one &#8220;zero-day&#8221; bug in Windows that is already being actively exploited by attackers.</p>
<p><img class="alignright size-full wp-image-19861" src="media/61a2c64f.crackedwin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/04/crackedwin.png" alt="" width="212" height="251" />As per usual, the bulk of the fixes from Microsoft tackle security weaknesses in the company&#8217;s Web browsers, <strong>Internet Explorer</strong> and <strong>Edge</strong>. Patches also are available for Windows, <strong>Office</strong>, <strong>Sharepoint</strong>, and the <strong>.NET Framework</strong>, among other components.</p>
<p>Of the 61 bugs fixed in this patch batch, 17 earned Microsoft&#8217;s &#8220;critical&#8221; rating, meaning malware or miscreants could use them to break into Windows computers with little or no help from users.</p>
<p>The zero-day flaw, <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8440" target="_blank" rel="noopener">CVE-2018-8440</a>, affects Microsoft operating systems from <strong>Windows 7</strong> through <strong>Windows 10</strong> and allows a program launched by a restricted Windows user to gain more powerful administrative access on the system. It was first publicized August 27 in a (now deleted) Twitter post that linked users to proof-of-concept code hosted on <strong>Github</strong>. Since then, security experts have spotted versions of the code <a href="https://www.welivesecurity.com/2018/09/05/powerpool-malware-exploits-zero-day-vulnerability/" target="_blank" rel="noopener">being used in active attacks</a>.</p>
<p>According to security firm <a href="https://www.ivanti.com" target="_blank" rel="noopener">Ivanti</a>, prior to today bad guys got advance notice about three vulnerabilities in Windows targeted by these patches. The first, <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8457" target="_blank" rel="noopener">CVE-2018-8457</a>, is a critical memory corruption issue that could be exploited through a malicious Web site or Office file. <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8475" target="_blank" rel="noopener">CVE-2018-8475</a> is a critical bug in most supported versions of Windows that can be used for nasty purposes by getting a user to view a specially crafted image file. The third previously disclosed flaw, <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8409" target="_blank" rel="noopener">CVE-2018-8409</a>, is a somewhat less severe &#8220;denial-of-service&#8221; vulnerability.<span id="more-44969"></span></p>
<p>Standard advice about Windows patches: Not infrequently, Redmond ships updates that end up causing stability issues for some users, and it doesn’t hurt to wait a day or two before seeing if any major problems are reported with new updates before installing them. Windows 10 likes to install patches and reboot your computer on its own schedule, and Microsoft doesn’t make it easy for Windows 10 users to change this setting, <a href="https://www.howtogeek.com/224471/how-to-prevent-windows-10-from-automatically-downloading-updates/" target="_blank" rel="noopener">but it is possible</a>. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in Windows Update.</p>
<p>It’s a good idea to get in the habit of backing up your computer before applying monthly updates from Microsoft. Windows has some built-in tools that can help recover from bad patches, but restoring the system to a backup image taken just before installing updates is often much less hassle and an added peace of mind while you’re sitting there praying for the machine to reboot successfully after patching.</p>
<p><img class="alignleft size-full wp-image-18875" src="media/18bb50f1.brokenflash-a.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="" width="211" height="180" />The sole non-Microsoft update pushed by Redmond today fixes a single vulnerability in Adobe Flash Player, <strong>CVE-2018-15967</strong>. Curiously, Adobe <a href="https://helpx.adobe.com/security/products/flash-player/apsb18-31.html" target="_blank" rel="noopener">lists the severity of this information disclosure bug</a> as &#8220;important,&#8221; while Microsoft considers it a more dangerous &#8220;critical&#8221; flaw.</p>
<p>Regardless, if you have Adobe Flash Player installed, it&#8217;s time to either update your browser and/or operating system, or else disable this problematic and insecure plugin. Windows Update should install the Flash Patch for IE/Edge users; the newest version of <strong>Google Chrome</strong>, which bundles Flash but prompts users to run Flash elements on a Web page by default, also includes the fix (although a complete Chrome shutdown and restart may be necessary before the fix is in).</p>
<p>Loyal readers here know full well where I stand on Flash: This is a dangerous, oft-exploited program that needs to be relegated to the dustbin of Internet history (for its part, Adobe has said <a href="https://krebsonsecurity.com/2017/08/flash-player-is-dead-long-live-flash-player/" target="_blank" rel="noopener">it plans to retire Flash Player in 2020</a>). Fortunately, <a href="https://support.google.com/chrome/answer/108086?hl=en" target="_blank" rel="noopener">disabling Flash in Chrome</a> is simple enough. Paste “<a href="chrome://settings/content" target="_blank" rel="noopener">chrome://settings/content</a>” into a Chrome browser bar and then select “Flash” from the list of items.</p>
<p>By default, <strong>Mozilla Firefox</strong> on Windows computers with Flash installed runs Flash in a “<a href="http://blogs.adobe.com/security/2012/06/inside-flash-player-protected-mode-for-firefox.html" target="_blank" rel="noopener">protected mode</a>,” which prompts the user to decide if they want to enable the plugin before Flash content runs on a Web site.</p>
<p>Administrators have the ability to change Flash Player’s behavior when running Internet Explorer on <strong>Windows 7</strong> by prompting the user before playing Flash content. A guide on how to do that is <a href="media/116dd27f.flash_player_27_0_admin_guide.pdf" data-original-source="https://www.adobe.com/content/dam/acom/en/devnet/flashplayer/articles/flash_player_admin_guide/pdf/flash_player_27_0_admin_guide.pdf" target="_blank" rel="noopener">here</a> (PDF). Administrators may also consider implementing <a href="https://support.office.com/en-us/article/what-is-protected-view-d6f09ac7-e6b9-4495-8e43-2bbcdbcb6653#bm5" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=https://support.office.com/en-us/article/what-is-protected-view-d6f09ac7-e6b9-4495-8e43-2bbcdbcb6653%23bm5&amp;source=gmail&amp;ust=1517665562120000&amp;usg=AFQjCNH1N5uNNb93xTY_aa6zwH-Ou6cUGg">Protected View for Office</a>. Protected View opens a file marked as potentially unsafe in Read-only mode.</p>
<p>As always, please feel free to leave a note in the comments below if you experience any issues installing these fixes. Happy patching!</p>


feed_id: https://krebsonsecurity.com/?p=45035
title: U.S. Mobile Giants Want to be Your Online Identity
uri: U-S-Mobile-Giants-Want-to-be-Your-Online-Identity
url: https://krebsonsecurity.com/2018/09/u-s-mobile-giants-want-to-be-your-online-identity/
content:
<p>The four major U.S. wireless carriers today detailed a new initiative that may soon let Web sites eschew passwords and instead authenticate visitors by leveraging data elements unique to each customer&#8217;s phone and mobile subscriber account, such as location, customer reputation, and physical attributes of the device. Here&#8217;s a look at what&#8217;s coming, and the potential security and privacy trade-offs of trusting the carriers to handle online authentication on your behalf.</p>
<p>Tentatively dubbed &#8220;<strong>Project Verify</strong>&#8221; and still in the private beta testing phase, the new authentication initiative is being pitched as a way to give consumers both a more streamlined method of proving one&#8217;s identity when creating a new account at a given Web site, as well as replacing passwords and one-time codes for logging in to existing accounts at participating sites.</p>
<p>Here&#8217;s a promotional and explanatory video about Project Verify produced by the <a href="https://about.att.com/story/att_sprint_tmobile_and_verizon_unveil_next_generation_mobile_authentication_platform_details.html" target="_blank" rel="noopener">Mobile Authentication Task Force</a>, whose members include <strong>AT&amp;T</strong>, <strong>Sprint</strong>, <strong>T-Mobile</strong> and <strong>Verizon</strong>:</p>
<div style="text-align: center;"><iframe src="https://www.youtube.com/embed/WHShXwsER0I" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>The mobile companies say Project Verify can improve online authentication because they alone have access to several unique signals and capabilities that can be used to validate each customer and their mobile device(s). This includes knowing the approximate real-time location of the customer; how long they have been a customer and used the device in question; and information about components inside the customer&#8217;s phone that are only accessible to the carriers themselves, such as cryptographic signatures tied to the device&#8217;s <a href="https://en.wikipedia.org/wiki/Subscriber_identity_module" target="_blank" rel="noopener">SIM card</a>.</p>
<p>The Task Force currently is working on building its Project Verify app into the software that gets pre-loaded onto mobile devices sold by the four major carriers. The basic idea is that third-party Web sites could let the app (and, by extension, the user&#8217;s mobile provider) handle the process of authenticating the user&#8217;s identity, at which point the app would interactively log the user in without the need of a username and password.</p>
<p>In another example, participating sites could use Project Verify to supplement or replace existing authentication processes, such as two-factor methods that currently rely on sending the user a one-time passcode via SMS/text messages, <a href="https://krebsonsecurity.com/?s=sim+swap&amp;x=0&amp;y=0" target="_blank" rel="noopener">which can be intercepted by cybercrooks</a>.</p>
<p>The carriers also are pitching their offering as a way for consumers to pre-populate data fields on a Web site &#8212; such as name, address, credit card number and other information typically entered when someone wants to sign up for a new user account at a Web site or make purchases online.</p>
<p><strong>Johannes Jaskolski</strong>, general manager for Mobile Authentication Task Force and assistant vice president of identity security at AT&amp;T, said the group is betting that Project Verify will be attractive to online retailers partly because it can help them capture more sign-ups and sales from users who might otherwise balk at having to manually provide lots of data via a mobile device.</p>
<p>&#8220;We can be a primary authenticator where, just by authenticating to our app, you can then use that service,&#8221; Jaskolski said. &#8220;That can be on your mobile, but it could also be on another device. With subscriber consent, we can populate that information and make it much more effortless to sign up for or sign into services online. In other markets, we have found this type of approach reduced [customer] fall-out rates, so it can make third-party businesses more successful in capturing that.&#8221;</p>
<p>Jaskolski said customers who take advantage of Project Verify will be able to choose what types of data get shared between their wireless provider and a Web site on a per-site basis, or opt to share certain data elements across the board with sites that leverage the app for authentication and e-commerce.</p>
<p>&#8220;Many companies already rely on the mobile device today in their customer authentication flows, but what we&#8217;re saying is there&#8217;s going to be a better way to do this in a method that is intended from the start to serve authentication use cases,&#8221; Jaskolski said. &#8220;This is what everyone has been seeking from us already in co-opting other mobile features that were simply never designed for authentication.&#8221;<span id="more-45035"></span></p>
<h4>&#8216;A DISMAL TRACK RECORD&#8217;</h4>
<p>A key question about adoption of this fledgling initiative will be how much trust consumers place with the wireless companies, <em>which have struggled mightily over the past several years to validate that their own customers are who they say they are.</em></p>
<p>All four major mobile providers currently are struggling to protect customers against scams designed to seize control over a target&#8217;s mobile phone number. In an increasingly common scenario, attackers impersonate the customer over the phone or in mobile retail stores in a bid to get the target&#8217;s number transferred to a device they control. When successful, these attacks &#8212; known as <a href="https://krebsonsecurity.com/?s=sim+swap&amp;x=0&amp;y=0" target="_blank" rel="noopener">SIM swaps</a> and <a href="https://krebsonsecurity.com/2018/02/how-to-fight-mobile-number-port-out-scams/" target="_blank" rel="noopener">mobile number port-out scams</a> &#8212;  allow thieves to intercept one-time authentication codes sent to a customer&#8217;s mobile device via text message or automated phone-call.</p>
<p><strong>Nicholas Weaver</strong>, a researcher at the <a href="https://www.icsi.berkeley.edu/icsi/" target="_blank" rel="noopener">International Computer Science Institute</a> and lecturer at <strong>UC Berkeley</strong>, said this new solution could make mobile phones and their associated numbers even more of an attractive target for cyber thieves.</p>
<p>Weaver said after he became a victim of a SIM swapping attack a few years back, he was blown away when he learned how simple it was for thieves to impersonate him to his mobile provider.</p>
<p>&#8220;SIM swapping is very much in the news now, but it&#8217;s been a big problem for at least the last half-decade,&#8221; he said. &#8220;In my case, someone went into a Verizon store, took over the account, and added themselves as an authorized user under their name &#8212; not even under my name &#8212; and told the store he needed a replacement phone because his broke. It took me three days to regain control of the account in a way that the person wasn&#8217;t able to take it back away from me.&#8221;</p>
<p>Weaver said Project Verify could become an extremely useful way for Web sites to onboard new users. But he said he&#8217;s skeptical of the idea that the solution would be much of an improvement for multi-factor authentication on third-party Web sites.</p>
<p>&#8220;The carriers have a dismal track record of authenticating the user,&#8221; he said. <span class="pullquote pqleft">&#8220;If the carriers were trustworthy, I think this would be unequivocally a good idea. The problem is I don&#8217;t trust the carriers.&#8221;</span></p>
<p>It probably doesn&#8217;t help that all of the carriers participating in this effort were recently caught selling the real-time location data of their customers&#8217; mobile devices to a host of third-party companies that utterly failed to secure online access to that sensitive data.</p>
<p>On May 10, <em>The New York Times</em> <a href="https://www.nytimes.com/2018/05/10/technology/cellphone-tracking-law-enforcement.html" target="_blank" rel="noopener">broke the news</a> that a cell phone location tracking company called <strong>Securus Technologies</strong> had been selling or giving away location data on customers of virtually any major mobile network provider to local police forces across the United States.</p>
<p>A few weeks after the NYT scoop, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/05/tracking-firm-locationsmart-leaked-location-data-for-customers-of-all-major-u-s-mobile-carriers-in-real-time-via-its-web-site/" target="_blank" rel="noopener">broke the story</a> that <strong>LocationSmart</strong> &#8212; a wireless data aggregator &#8212; hosted a public demo page on its Web site that would let anyone look up the real-time location data on virtually any U.S. mobile subscriber.</p>
<p>In response, all of the major mobile companies said they had terminated location data sharing agreements with LocationSmart and several other companies that were buying the information. The carriers each insisted that they only shared this data with customer consent, although it soon emerged that the mobile giants were instead counting on these data aggregators to obtain customer consent before sharing this location data with third parties, a sort of transitive trust relationship that appears to have been completely flawed from the get-go.</p>
<p>AT&amp;T&#8217;s Jaskolski said the mobile giants are planning to use their new solution to further protect customers against SIM swaps.</p>
<p>&#8220;We are planning to use this as an additional preventative control,&#8221; Jaskolski said. &#8220;For example, just because you swap in a new SIM, that doesn&#8217;t mean the mobile authentication profile we&#8217;ve created is ported as well. In this case, porting your sim won&#8217;t necessarily port your mobile authentication profile.&#8221;</p>
<p>Jaskolski emphasized that Project Verify would not seek to centralize subscriber data into some new giant cross-carrier database.</p>
<p>&#8220;We&#8217;re not going to be aggregating and centralizing this subscriber data, which will remain with each carrier separately,&#8221; he said. &#8220;And this is very much a pro-competition solution, because it will be portable by design and is not designed to keep a subscriber stuck to one specific carrier. More importantly, the user will be in control of whatever gets shared with third parties.&#8221;</p>
<p>My take? The carriers can make whatever claims they wish about the security and trustworthiness of this new offering, but it&#8217;s difficult to gauge the sincerity and accuracy of those claims until the program is broadly available for beta testing and use &#8212; which is currently slated for sometime in 2019.</p>
<p>As with most things related to cybersecurity and identity online, much will depend on the default settings the carriers decide to stitch into their apps, and more importantly the default settings of third-party Web site apps designed to interact with Project Verify.</p>
<p>Jaskolski said the coalition is hoping to kick off the program next year in collaboration with some major online e-commerce platforms that have expressed interest in the initiative, although he declined to talk specifics on that front. He added that the mobile providers are currently working through exactly what those defaults might look like, but also acknowledged that some of those platforms have expressed an interest in forcing users to opt-out of sharing specific subscriber data elements.</p>
<p>&#8220;Users will be able to see exactly what attributes will be shared, and they can say yes or no to those,&#8221; he said. &#8220;In some cases, the [third-party site] can say here are some things I absolutely need, and here are some things we&#8217;d like to have. Those are some of the things we&#8217;re working through now.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=45082
title: GovPayNow.com Leaks 14M+ Records
uri: GovPayNow-com-Leaks-14M-Records
url: https://krebsonsecurity.com/2018/09/govpaynow-com-leaks-14m-records/
content:
<p><strong>Government Payment Service Inc. </strong>— a company used by thousands of U.S. state and local governments to accept online payments for everything from traffic citations and licensing fees to bail payments and court-ordered fines — has leaked more than 14 million customer records dating back at least six years, including names, addresses, phone numbers and the last four digits of the payer&#8217;s credit card.</p>
<p><a class="lightbox" href="media/f053f655.govpaynet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/govpaynet.png"><img class="aligncenter wp-image-45095" src="media/f053f655.govpaynet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/govpaynet.png" alt="" width="584" height="377" /></a></p>
<p>Indianapolis-based <strong>GovPayNet</strong>, doing business online as <a href="https://www.govpaynow.com" target="_blank" rel="noopener">GovPayNow.com</a>, serves approximately <a href="https://www.google.com/search?ei=ABqgW-DGJdCf_Qat-42ACQ&amp;q=link%3Agovpaynow.com&amp;oq=link%3Agovpaynow.com&amp;gs_l=psy-ab.3...9236.9535..9701...0.0..0.136.386.0j3......0....1..gws-wiz.eKm86bYw5yE" target="_blank" rel="noopener">2,300 government agencies in 35 states</a>. GovPayNow.com displays an online receipt when citizens use it to settle state and local government fees and fines via the site. Until this past weekend it was possible to view millions of customer records simply by altering digits in the Web address displayed by each receipt.</p>
<p>On Friday, Sept. 14, KrebsOnSecurity alerted GovPayNet that its site was exposing at least 14 million customer receipts dating back to 2012. Two days later, the company said it had addressed &#8220;a potential issue.&#8221;</p>
<p>“GovPayNet has addressed a potential issue with our online system that allows users to access copies of their receipts, but did not adequately restrict access only to authorized recipients,&#8221; the company said in a statement provided to KrebsOnSecurity.</p>
<p>The statement continues:</p>
<blockquote><p>&#8220;The company has no indication that any improperly accessed information was used to harm any customer, and receipts do not contain information that can be used to initiate a financial transaction. Additionally, most information in the receipts is a matter of public record that may be accessed through other means. Nonetheless, out of an abundance of caution and to maximize security for users, GovPayNet has updated this system to ensure that only authorized users will be able to view their individual receipts. We will continue to evaluate security and access to all systems and customer records.”</p></blockquote>
<p>In January 2018, GovPayNet was <a href="https://www.businesswire.com/news/home/20180104006153/en/Securus-Technologies-Announces-Acquisition-GovPayNet" target="_blank" rel="noopener">acquired</a> by <strong>Securus Technologies</strong>, a Carrollton, Texas- based company that provides telecommunications services to prisons and helps law enforcement personnel keep tabs on mobile devices used by former inmates.</p>
<p>Although its name may suggest otherwise, Securus does not have a great track record in securing data. In May 2018, the <em>New York Times</em> <a href="https://www.nytimes.com/2018/05/10/technology/cellphone-tracking-law-enforcement.html" target="_blank" rel="noopener">broke the news</a> that Securus’ service for tracking the cell phones of convicted felons was being abused by law enforcement agencies to track the real-time location of mobile devices used by people who had only been suspected of committing a crime. The story observed that authorities could use the service to track the real-time location of nearly any mobile phone in North America.</p>
<p>Just weeks later, Motherboard <a href="https://motherboard.vice.com/en_us/article/gykgv9/securus-phone-tracking-company-hacked" target="_blank" rel="noopener">reported</a> that hackers had broken into Securus’ systems and stolen the online credentials for multiple law enforcement officials who used the company’s systems to track the location of suspects via their mobile phone number.</p>
<p>A <a href="https://krebsonsecurity.com/2018/05/mobile-giants-please-dont-share-the-where/" target="_blank" rel="noopener">story here on May 22</a> illustrated how Securus&#8217; site appeared to allow anyone to reset the password of an authorized Securus user simply by guessing the answer to one of three pre-selected &#8220;security questions,&#8221; including &#8220;what is your pet name,&#8221; &#8220;what is your favorite color,&#8221; and &#8220;what town were you born in&#8221;. Much like GovPayNet, the Securus Web site seemed to have been erected sometime in the aughts and left to age ungracefully for years.</p>
<div id="attachment_43904" style="width: 594px" class="wp-caption aligncenter"><a class="lightbox" href="media/17438e41.travis-secretquestion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/travis-secretquestion.png"><img class="wp-image-43904" src="media/17438e41.travis-secretquestion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/travis-secretquestion.png" alt="" width="584" height="210" /></a><p class="wp-caption-text">Choose wisely and you, too, could gain the ability to look up anyone&#8217;s precise mobile location.</p></div>
<p><span id="more-45082"></span>Data exposures like these are some of the most common but easily preventable forms of information leaks online. In this case, it was trivial to enumerate how many records were exposed because each record was sequential.</p>
<p>E-commerce sites can mitigate such leaks by using something other than easily-guessed or sequential record numbers, and/or encrypting unique portions of the URL displayed to customers upon payment.</p>
<p>Although fixing these information disclosure vulnerabilities is quite simple, it&#8217;s remarkable how many organizations that should know better don&#8217;t invest the resources needed to find and fix them. In August, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/08/fiserv-flaw-exposed-customer-data-at-hundreds-of-banks/" target="_blank" rel="noopener">disclosed a similar flaw</a> at work across hundreds of small bank Web sites run by <strong>Fiserv</strong>, a major provider of technology services to financial institutions.</p>
<p>In July, identity theft protection service <strong>LifeLock</strong> fixed an information disclosure flaw that <a href="https://krebsonsecurity.com/2018/07/lifelock-bug-exposed-millions-of-customer-email-addresses/" target="_blank" rel="noopener">needlessly exposed the email address of millions of subscribers</a>. And in April 2018, PaneraBread.com <a href="https://krebsonsecurity.com/2018/04/panerabread-com-leaks-millions-of-customer-records/" target="_blank" rel="noopener">remedied a weakness</a> that exposed millions of customer names, email and physical addresses, birthdays and partial credit card numbers.</p>
<p>Got a tip about a security vulnerability similar to those detailed above, or perhaps something more serious? Please drop me a note at krebsonsecurity @ gmail.com.</p>


feed_id: https://krebsonsecurity.com/?p=45108
title: Mirai Botnet Authors Avoid Jail Time
uri: Mirai-Botnet-Authors-Avoid-Jail-Time
url: https://krebsonsecurity.com/2018/09/mirai-botnet-authors-avoid-jail-time/
content:
<p>Citing &#8220;extraordinary cooperation&#8221; with the government, a court in Alaska on Tuesday sentenced three men to probation, community service and fines for their admitted roles in authoring and using &#8220;<strong>Mirai</strong>,&#8221; a potent malware strain used in countless attacks designed to knock Web sites offline &#8212; including an enormously powerful attack in 2016 that sidelined this Web site for nearly four days.</p>
<p>The men &#8212; 22-year-old<strong> Paras Jha</strong> Fanwood, New Jersey,  <strong>Josiah White, </strong>21 of Washington, Pa., and<strong> Dalton Norman </strong>from Metairie, La<strong>. </strong>&#8212; were each sentenced to five years probation, 2,500 hours of community service, and ordered to pay $127,000 in restitution for the damage caused by their malware.</p>
<p>Mirai enslaves poorly secured &#8220;Internet of Things&#8221; (IoT) devices like security cameras, digital video recorders (DVRs) and routers for use in large-scale online attacks.</p>
<p>Not long after Mirai first surfaced online in August 2016, White and Jha were questioned by the FBI about their suspected role in developing the malware. At the time, the men were renting out slices of their botnet to other cybercriminals.</p>
<p>Weeks later, the defendants sought to distance themselves from their creation by releasing the Mirai source code online. That action quickly spawned dozens of copycat Mirai botnets, some of which were used in extremely powerful denial-of-service attacks that often caused widespread collateral damage beyond their intended targets.</p>
<div id="attachment_36755" style="width: 601px" class="wp-caption aligncenter"><img class=" wp-image-36755" src="media/532a8113.l3outage.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/10/l3outage.png" alt="" width="591" height="336" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/10/l3outage.png 778w, https://krebsonsecurity.com/wp-content/uploads/2016/10/l3outage-580x330.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/10/l3outage-768x437.png 768w" sizes="(max-width: 591px) 100vw, 591px" /><p class="wp-caption-text">A depiction of the outages caused by the Mirai attacks on Dyn, an Internet infrastructure company. Source: Downdetector.com.</p></div>
<p>The source code release also marked a period in which the three men began using their botnet for far more subtle and less noisy criminal moneymaking schemes, including <a href="https://en.wikipedia.org/wiki/Click_fraud" target="_blank" rel="noopener">click fraud</a> — a form of online advertising fraud that costs advertisers billions of dollars each year.</p>
<p>In September 2016, KrebsOnSecurity <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank" rel="noopener">was hit with a record-breaking denial-of-service attack</a> from tens of thousands of Mirai-infected devices, forcing this site offline for several days. Using the pseudonym &#8220;Anna_Senpai,&#8221; Jha admitted to a friend at the time that the attack on this site was paid for by a customer who rented tens of thousands of Mirai-infected systems from the trio.</p>
<p>In January 2017, KrebsOnSecurity <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank" rel="noopener">published the results of a four-month investigation into Mirai</a> which named both Jha and White as the likely co-authors of the malware.  Eleven months later, the U.S. Justice Department <a href="https://krebsonsecurity.com/2017/12/mirai-iot-botnet-co-authors-plead-guilty/" target="_blank" rel="noopener">announced guilty pleas</a> by Jha, White and Norman.<span id="more-45108"></span></p>
<p>Prior to Tuesday&#8217;s sentencing, the Justice Department issued a sentencing memorandum that recommended lenient punishments for the three men. FBI investigators argued the defendants deserved light sentences because they had provided the government &#8220;extraordinary cooperation&#8221; in identifying other cybercriminals engaged in related activity and helping to thwart massive cyberattacks on several companies.</p>
<div id="attachment_45113" style="width: 253px" class="wp-caption alignright"><img class=" wp-image-45113" src="media/91aee3ad.jha-li.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/jha-li.png" alt="" width="243" height="243" /><p class="wp-caption-text">Paras Jha, in an undated photo from his former LinkedIn profile.</p></div>
<p>The government said Jha was especially helpful, devoting hundreds of hours of work in helping investigators. According to the sentencing memo, Jha has since landed a paying job at at a Silicon Valley technology firm, although the government declined to name his employer.</p>
<p>However, Jha is not quite out of the woods yet: He has also admitted to using Mirai to launch a series of punishing cyberattacks against <strong>Rutgers University</strong>, where he was enrolled as a computer science student at the time. Jha is slated to be sentenced next week in New Jersey for those crimes.</p>
<p>The Mirai case was prosecuted out of Alaska because the lead FBI agent in the investigation, 36-year-old Special Agent <strong>Elliott Peterson</strong>, is stationed there. Peterson was able to secure jurisdiction for the case after finding multiple DVRs in Alaska infected with Mirai. Last week, Peterson traveled to Washington, D.C. to accept the FBI&#8217;s Director Award &#8212; one of the bureau&#8217;s highest honors &#8212; for his role in the Mirai investigation.</p>


feed_id: https://krebsonsecurity.com/?p=45121
title: Credit Freezes are Free: Let the Ice Age Begin
uri: Credit-Freezes-are-Free-Let-the-Ice-Age-Begin
url: https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/
content:
<p>It is now free in every U.S. state to freeze and unfreeze your credit file and that of your dependents, a process that blocks identity thieves and others from looking at private details in your consumer credit history. If you&#8217;ve been holding out because you&#8217;re not particularly worried about ID theft, here&#8217;s another reason to reconsider: The credit bureaus profit from selling copies of your file to others, so freezing your file also lets you deny these dinosaurs a valuable revenue stream.</p>
<p><img class="aligncenter wp-image-45129" src="media/4ccd7a38.freezeme-ed.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/freezeme-ed.png" alt="" width="591" height="121" /></p>
<p>Enacted in May 2018, the <a href="https://www.congress.gov/bill/115th-congress/senate-bill/2155" target="_blank" rel="noopener">Economic Growth, Regulatory Relief and Consumer Protection Act</a> rolls back some of the restrictions placed on banks in the wake of the Great Recession of the last decade. But it also includes a silver lining. Previously, states could charge a confusing range of fees for placing, temporarily thawing or lifting a credit freeze. Today, those fees no longer exist.</p>
<p>A security freeze essentially blocks any potential creditors from being able to view or “pull” your credit file, unless you affirmatively unfreeze or thaw your file beforehand. With a freeze in place on your credit file, ID thieves can apply for credit in your name all they want, but they will not succeed in getting new lines of credit in your name because few if any creditors will extend that credit without first being able to gauge how risky it is to loan to you (i.e., view your credit file).</p>
<p>And because each credit inquiry caused by a creditor has the potential to lower your credit score, the freeze also helps protect your score, which is what most lenders use to decide whether to grant you credit when you truly do want it and apply for it.</p>
<p>To file a freeze, consumers must contact each of the three major credit bureaus online, by phone or by mail. Here&#8217;s the updated contact information for the big three:</p>
<p>Online: <a href="https://www.equifax.com/personal/credit-report-services/" target="_blank" rel="noopener">Equifax Freeze Page</a><br />
By phone: 800-685-1111<br />
By Mail: Equifax Security Freeze<br />
P.O. Box 105788<br />
Atlanta, Georgia 30348-5788</p>
<p>Online: <a href="https://www.experian.com/freeze/center.html#content-01" target="_blank" rel="noopener">Experian</a><br />
By phone: 888-397-3742<br />
By Mail: Experian Security Freeze<br />
P.O. Box 9554, Allen, TX 75013</p>
<p>Online: <a href="https://service.transunion.com/dss/orderStep1_form.page" target="_blank" rel="noopener">TransUnion</a><br />
By Phone: 888-909-8872<br />
By Mail: TransUnion LLC<br />
P.O. Box 2000 Chester, PA 19016</p>
<p>Spouses may request freezes for each other by phone as long as they pass authentication.</p>
<p>The new law also makes it free to place, thaw and lift freezes for dependents under the age of 16, or for incapacitated adult family members. However, this process is not currently available online or by phone, as it requires parents/guardians to submit written documentation (&#8220;sufficient proof of authority&#8221;), such as a copy of a birth certificate and copy of a Social Security card issued by the Social Security Administration, or &#8212; in the case of an incapacitated family member &#8212; proof of power of attorney.</p>
<p>In addition, the law requires the big three bureaus to offer free electronic credit monitoring services to all active duty military personnel. It also changes the rules for “<strong>fraud alerts</strong>,” which currently are free but only last for 90 days. With a fraud alert on your credit file, lenders or service providers should not grant credit in your name without first contacting you to obtain your approval — by phone or whatever other method you specify when you apply for the fraud alert.</p>
<p>Another important change: Fraud alerts now last for one year (previously they lasted just 90 days) but consumers can renew them each year. Bear in mind, however, that while lenders and service providers are supposed to seek and obtain your approval before granting credit in your name if you have a fraud alert on your file, they’re not legally required to do this.<span id="more-45121"></span></p>
<h4>MANAGING EXPECTATIONS</h4>
<p>Having a freeze in place does nothing to prevent you from using existing lines of credit you may already have, such as credit, mortgage and bank accounts. By the same token, freezes do nothing to prevent crooks from abusing unauthorized access to these existing accounts.</p>
<p>According to experts, the bureaus make about $1 every time they sell access your credit file. However, a freeze on your file does nothing to prevent the bureaus from collecting information about you as a consumer — including your spending habits and preferences — and packaging, splicing and reselling that information to marketers.</p>
<p>When you place a freeze, each credit bureau will assign you a personal identification number (PIN) that needs to be supplied if and when you ever wish to open a new line of credit. When that time comes, consumers can temporarily thaw a freeze for a specified duration either online or by phone (see above resources). Needless to say, it&#8217;s a good idea to keep these PINs somewhere safe and reliable in the event you wish to unfreeze.</p>
<p><img class="aligncenter wp-image-40941 size-full" src="media/4d359a65.creditfreeze.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/09/creditfreeze.png" alt="" width="521" height="214" /></p>
<p>One important caveat: It&#8217;s best not to wait until the last minute before starting the freeze thawing process, which can be instantaneous or can take a few days. The easiest way to unfreeze your file for the purposes of gaining new credit is to spend a few minutes on the phone with the company from which you hope to gain the line of credit (or research the matter online) to see which credit bureau they rely upon for credit checks. It will most likely be one of the major bureaus. Once you know which bureau the creditor uses, contact that bureau either via phone or online and supply the PIN they gave you when you froze your credit file with them. The thawing process should not take more than 24 hours, but hiccups in the thawing process sometimes make things take longer.</p>
<h4>CREDIT LOCKS AND CREDIT MONITORING</h4>
<p>All three big bureaus tout their &#8220;<strong>credit lock&#8221; </strong>services as an easier and faster alternative to freezes &#8212; mainly because these alternatives aren&#8217;t as disruptive to their bottom lines. According to a recent post by <a href="https://www.creditkarma.com/id-theft/i/lock-freeze-credit-file/" target="_blank" rel="noopener">CreditKarma.com</a>, consumers can use these services to quickly lock or unlock access to credit inquiries, although some bureaus can take up to 48 hours. In contrast, they can take up to five business days to act on a freeze request, although in my experience the automated freeze process via the bureaus’ freeze sites has been more or less instantaneous (assuming the request actually goes through).</p>
<p>TransUnion and Equifax both offer free credit lock services, while Experian’s is free for 30 days and $19.99 for each additional month. However, TransUnion says those who take advantage of their free lock service agree to receive targeted marketing offers. What’s more, TransUnion also pushes consumers who sign up for its free lock service to subscribe to its “premium” lock services for a monthly fee with a perpetual auto-renewal.</p>
<p>Unsurprisingly, the bureaus’ use of the term credit lock has confused many consumers; this was almost certainly by design. But here’s one basic fact consumers should keep in mind about these lock services: Unlike freezes, locks are not governed by any law, meaning that the credit bureaus can change the terms of these arrangements when and if it suits them to do so.</p>
<p>If you have already signed up for credit monitoring services, placing a freeze on your file should not impact those services. However, it is generally not possible to sign up for new credit monitoring services once a freeze is in place. So if you wish to avail yourself of credit monitoring, it&#8217;s best to sign up <em>before</em> placing a freeze.</p>
<p>Many consumers erroneously believe that credit monitoring services will protect them from identity thieves. In truth, despite incessant marketing by the bureaus and others to the contrary, these services do not prevent thieves from using your identity to open new lines of credit, or from damaging your good name for years to come in the process. The most you can hope for is that credit monitoring services will alert you soon <em>after</em> an ID thief does steal your identity.</p>
<p>Credit monitoring services are principally useful in helping consumers <em>recover</em> from identity theft. Doing so often requires dozens of hours writing and mailing letters, and spending time on the phone contacting creditors and credit bureaus to straighten out the mess. In cases where identity theft leads to prosecution for crimes committed in your name by an ID thief, you may incur legal costs as well. Most of these services offer to reimburse you up to a certain amount for out-of-pocket expenses related to those efforts. But a better solution is to prevent thieves from stealing your identity in the first place by placing a freeze.</p>
<h4>WHAT ELSE SHOULD YOU DO?</h4>
<p>Freezing your credit file at the big three bureaus is a great start, but ID thieves can and do abuse other parts of the credit system to wreak havoc on consumers. Beyond the big three bureaus, <strong>Innovis</strong> is a distant fourth bureau that some entities use to check consumer creditworthiness. Fortunately, <a href="https://www.innovis.com/personal/securityFreeze" target="_blank" rel="noopener">filing a freeze with Innovis also is free</a> and relatively painless.</p>
<p>In addition, many wireless phone companies currently check consumer credit using a little-known credit reporting bureau operated by Equifax called the <strong>National Consumer Telecommunications and Utilities Exchange</strong> (NCTUE). Freezing your credit with Equifax won&#8217;t necessarily block inquiries to the NCTUE, but fortunately the NCTUE also offers a freeze process, <a href="https://krebsonsecurity.com/2018/05/another-credit-freeze-target-nctue-com/" target="_blank" rel="noopener">as detailed in this story</a>.</p>
<p>It&#8217;s a good idea to periodically order a free copy of your credit report. There are several forms of identity theft that probably will not be blocked by a freeze. But neither will they be blocked by a fraud alert or a credit lock. That’s why it’s so important to regularly review your credit file with the major bureaus for any signs of unauthorized activity.</p>
<p>By law, each of the three major credit reporting bureaus must provide a free copy of your credit report each year — but only if you request it via the government-mandated site <a href="http://annualcreditreport.com/" target="_blank" rel="noopener">annualcreditreport.com</a>. The best way to take advantage of this right is to make a notation in your calendar to request a copy of your report every 120 days, to review the report and to report any inaccuracies or questionable entries when and if you spot them. Avoid other sites that offer “free” credit reports and then try to trick you into signing up for something else.</p>
<p>According to the <strong>Federal Trade Commission</strong>, having a freeze in place should not affect a consumer’s ability to obtain copies of their credit report from annualcreditreport.com.</p>
<p>It’s also a good idea to notify a company called <strong>ChexSystems</strong> to keep an eye out for fraud committed in your name. Thousands of banks rely on ChexSystems to verify customers that are requesting new checking and savings accounts, and ChexSystems lets consumers place a security alert on their credit data to make it more difficult for ID thieves to fraudulently obtain checking and savings accounts. For more information on doing that with ChexSystems, see <a href="https://www.chexsystems.com/web/chexsystems/consumerdebit/page/securityfreeze/information/!ut/p/z1/04_Sj9CPykssy0xPLMnMz0vMAfIjo8ziDRxdHA1Ngg183AP83QwcXX39LIJDfYwMvM30w1EV-HuEGAEVuPq4Gxt5G7oHmuhHkaQfTYGBOWX6gQrA-nEARwN9L1QL0NzvaggKAaMiX2ffdP2ogsSSDN3MvLR8_QhPIFmUCw4loBOiCBmCXwEolPD6ExQMhDxSkBsaGlHlkxbsmekIAE6xunk!/dz/d5/L2dBISEvZ0FBIS9nQSEh/" target="_blank" rel="noopener">this link</a>.</p>
<p>Finally, ID thieves like to intercept offers of new credit and insurance sent via postal mail, so it’s a good idea to opt out of pre-approved credit offers. If you decide that you don’t want to receive prescreened offers of credit and insurance, you have two choices: You can opt out of receiving them for five years or opt out of receiving them permanently.</p>
<p>To opt out for five years: Call toll-free 1-888-5-OPT-OUT (1-888-567-8688) or visit <a href="https://www.optoutprescreen.com" target="_blank" rel="noopener">optoutprescreen.com</a>. The phone number and website are operated by the major consumer reporting companies. To complete your request for a permanent opt-out, you must return the signed Permanent Opt-Out Election form provided after you initiate your online request.</p>


feed_id: https://krebsonsecurity.com/?p=45138
title: Beware of Hurricane Florence Relief Scams
uri: Beware-of-Hurricane-Florence-Relief-Scams
url: https://krebsonsecurity.com/2018/09/beware-of-hurricane-florence-relief-scams/
content:
<p>If you&#8217;re thinking of donating money to help victims of <strong>Hurricane Florence</strong>, please do your research on the charitable entity before giving: A slew of new domains apparently related to Hurricane Florence relief efforts are now accepting donations on behalf of victims without much accountability for how the money will be spent.</p>
<p>For the past two weeks, KrebsOnSecurity has been monitoring dozens of new domain name registrations that include the terms &#8220;hurricane&#8221; and/or &#8220;florence&#8221; and some word related to support (e.g., &#8220;relief,&#8221; &#8220;assistance,&#8221; etc.). Most of these domains have remained parked or dormant since their creation earlier this month; however, several of them became active only in the past few days, directing visitors to donate money through private <strong>PayPal</strong> accounts without providing any information about who is running the site or what will be done with donated funds.</p>
<div id="attachment_45143" style="width: 603px" class="wp-caption aligncenter"><a class="lightbox" href="media/28df1687.flofund.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/flofund.png"><img class="wp-image-45143" src="media/28df1687.flofund.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/flofund.png" alt="" width="593" height="324" /></a><p class="wp-caption-text">The landing page for hurricaneflorencerelieffund-dot-com also is the landing page for at least 4 other Hurricane Florence donation sites that use the same anonymous PayPal address.</p></div>
<p>Among the earliest of these is <strong>hurricaneflorencerelieffund-dot-com</strong>, registered anonymously via <strong>GoDaddy</strong> on Sept. 13, 2018. Donations sent through the site&#8217;s <strong>PayPal</strong> page go to an email address tied to the PayPal account on the site (<strong>info@hurricaneflorencerelieffund-dot-com</strong>); emails to that address did not elicit a response.</p>
<p>Sometime in the past few days, several other Florence-related domains that were previous parked at GoDaddy now redirect to this domain, including <strong>hurricanflorence-dot-org</strong> (note the missing &#8220;e&#8221;); <strong>florencedisaster-dot-org</strong>; <strong>florencefunds-dot-com</strong>; and <strong>hurricaneflorencedonation-dot-com</strong>. All of these domains include the phone number <strong>833-FLO-FUND</strong>, which rings to an automated system that ultimately asks the caller to leave a message. There is no information provided about the organization or individual running the sites.</p>
<p>The domain <strong>hurricaneflorencedisasterfund-dot-com</strong> has a slightly different look and feel, invokes the name of the <strong>Red Cross</strong> and also includes the 833-FLO-FUND number. Likewise, it accepts PayPal donations tied to the same email address mentioned above. It claims &#8220;80% of all donations go directly to FIRST RESPONDERS in North &amp; South Carolina!&#8221; although it provides no clear way to verify that claim.</p>
<div id="attachment_45145" style="width: 600px" class="wp-caption aligncenter"><a class="lightbox" href="media/6207d924.flofund2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/flofund2.png"><img class="wp-image-45145" src="media/6207d924.flofund2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/flofund2.png" alt="" width="590" height="316" /></a><p class="wp-caption-text">Hurricaneflorencedisasterfund-dot-com is one of several domains anonymously accepting PayPal donations, purportedly on behalf of Hurricane Florence victims.</p></div>
<p>The domain <strong>hurricaneflorencerelief-dot-fund</strong>, registered on Sept. 11, also accepts PayPal donations with minimal information about who might benefit from monies given. The site links to Facebook, Twitter and other social network accounts set up with the same name, although none of them appear to have any meaningful content. The email address tied to that PayPal account &#8212; <strong>hurricaneflorencerelief@gmail.com</strong> &#8212; did not respond to requests for comment.</p>
<p><a class="lightbox" href="media/8c94fee8.hfrf.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/hfrf.png"><img class="aligncenter wp-image-45146" src="media/8c94fee8.hfrf.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/hfrf.png" alt="" width="590" height="423" /></a></p>
<p>The domain <strong>theflorencefund-dot-com</strong> until recently also accepted PayPal donations and had <a href="https://twitter.com/florencefund" target="_blank" rel="noopener">an associated Twitter account</a> (now deleted), but that domain recently changed its homepage to include the message, &#8220;Due to the change in Florence&#8217;s path, we&#8217;re suspending our efforts.&#8221;<span id="more-45138"></span></p>
<p><a href="https://docs.google.com/spreadsheets/d/1xX6Kx3FJ3KXOIaN_0375cBJkFRtecD9r_1qevo2iXwA/edit?usp=sharing" target="_blank" rel="noopener">Here is a Google spreadsheet</a> that tracks some of the domains I&#8217;ve been monitoring, including notations about whether the domains are active and if they point to sites that ask for donations. I&#8217;ll update this sheet as the days go by; if anyone has any updates to add, please drop a comment below. All of the domains mentioned above have been reported to the Justice Department&#8217;s <a href="https://www.justice.gov/opa/pr/tips-avoiding-fraudulent-charitable-contribution-schemes" target="_blank" rel="noopener">National Center for Disaster Fraud</a>, which accepts tips at <strong>disaster@leo.gov</strong>.</p>
<p><em>Let me be clear: Just because a site is listed here doesn&#8217;t mean it&#8217;s a scam (or that it will be).</em> Some of these sites may have been set up by well-intentioned people; others appear to have been established by legitimate aid groups who are pooling their resources to assist local victims.</p>
<p>For example, several of these domains redirect to <strong>Freedomhouse.cc</strong>, a legitimate nonprofit religious group based in North Carolina that accepts donations through several domains that use an inline donation service from <strong>churchcommunitybuilder.com</strong> &#8212; a maker of &#8220;church management software.&#8221;</p>
<p>Another domain in this spreadsheet &#8212; <strong>florencereliefeffort.org</strong> &#8212; accepts donations on its site via a third party fundraising network <strong>Qgiv.com</strong>. The site belongs to a legitimate 501(c)(3) Muslim faith-based nonprofit in Raleigh, N.C, that is collecting money for Hurricane Florence victims.</p>
<p>If you&#8217;re familiar with these charities, great. Otherwise, it&#8217;s a good idea to research the charitable group <em>before</em> giving them money to help victims.</p>
<p>As <em>The New York Times</em> <a href="https://www.nytimes.com/2018/09/15/reader-center/how-to-help-hurricane-florence-victims.html" target="_blank" rel="noopener">noted on Sept. 15</a>, one way to do that is through <a href="https://www.charitynavigator.org" target="_blank" rel="noopener">Charity Navigator</a>, which grades established charities on transparency and financial health, and has compiled a list of those active in the recovery from Florence. Other sites like <a class="css-1g7m0tk" title="" href="http://www.guidestar.org/Home.aspx" target="_blank" rel="noopener noreferrer" data-ss1537803286="1">GuideStar</a>, the Better Business Bureau’s <a class="css-1g7m0tk" title="" href="http://give.org/" target="_blank" rel="noopener noreferrer" data-ss1537803286="1">Wise Giving Alliance</a> and <a class="css-1g7m0tk" title="" href="https://www.charitywatch.org/home" target="_blank" rel="noopener noreferrer" data-ss1537803286="1">Charity Watch</a> perform similar reviews. You can find more details about how those sites work <a class="css-1g7m0tk" title="" href="https://www.nytimes.com/2013/11/08/giving/how-to-choose-a-charity-wisely.html" data-ss1537803286="1">here</a>.</p>
<p>Finally, remember that phishers and malware purveyors love to seize on the latest disasters to further their schemes. Never click on links or attachments in emails or social media messages that you weren&#8217;t expecting.</p>


feed_id: https://krebsonsecurity.com/?p=45166
title: Secret Service Warns of Surge in ATM ‘Wiretapping’ Attacks
uri: Secret-Service-Warns-of-Surge-in-ATM-Wiretapping-Attacks
url: https://krebsonsecurity.com/2018/09/secret-service-warns-of-surge-in-atm-wiretapping-attacks/
content:
<p>The <strong>U.S. Secret Service</strong> is warning financial institutions about a recent uptick in a form of ATM skimming that involves cutting cupcake-sized holes in a cash machine and then using a combination of magnets and medical devices to siphon customer account data directly from the card reader inside the ATM.</p>
<p>According to a non-public alert distributed to banks this week and shared with KrebsOnSecurity by a financial industry source, the Secret Service has received multiple reports about a complex form of skimming that often takes thieves days to implement.</p>
<p>This type of attack, sometimes called <a href="https://krebsonsecurity.com/2014/11/skimmer-innovation-wiretapping-atms/" target="_blank" rel="noopener">ATM &#8220;wiretapping&#8221;</a> or &#8220;eavesdropping,&#8221; starts when thieves use a drill to make a relatively large hole in the front of a cash machine. The hole is then concealed by a metal faceplate, or perhaps a decal featuring the bank&#8217;s logo or boilerplate instructions on how to use the ATM.</p>
<div id="attachment_45173" style="width: 597px" class="wp-caption aligncenter"><a class="lightbox" href="media/8988e219.skimhole.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/skimhole.png"><img class="wp-image-45173" src="media/8988e219.skimhole.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/skimhole.png" alt="" width="587" height="311" /></a><p class="wp-caption-text">A thin metal faceplate is often used to conceal the hole drilled into the front of the ATM. The PIN pad shield pictured here is equipped with a hidden spy camera.</p></div>
<p>Skimmer thieves will fish the card skimming device through the hole and attach it to the internal card reader via a magnet.</p>
<div id="attachment_45175" style="width: 595px" class="wp-caption aligncenter"><a class="lightbox" href="media/4d4c7253.skimmag.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/skimmag.png"><img class="wp-image-45175" src="media/4d4c7253.skimmag.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/skimmag.png" alt="" width="585" height="765" /></a><p class="wp-caption-text">Thieves often use a magnet to secure their card skimmer in place above the ATM&#8217;s internal card reader. Image: U.S. Secret Service.</p></div>
<p>Very often the fraudsters will be assisted in the skimmer installation by an endoscope, a slender, flexible instrument traditionally used in medicine to give physicians a look inside the human body. By connecting a USB-based endoscope to his smart phone, the intruder can then peek inside the ATM and ensure that his skimmer is correctly attached to the card reader.<span id="more-45166"></span></p>
<p><img class="aligncenter wp-image-45174" src="media/94be7595.decalhole.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/decalhole.png" alt="" width="590" height="244" /></p>
<p>The Secret Service says once the skimmer is in place and the hole patched by a metal plate or plastic decal, the skimmer thieves often will wait a day or so to attach the pinhole camera. &#8220;The delay is believed to take place to ensure that vibrations from the drilling didn’t trigger an alarm from anti-skimming technology,&#8221; the alert reads.</p>
<p>When the suspect is satisfied that his drilling and mucking around inside the cash machine hasn&#8217;t set off any internal alarms, he returns to finish the job by retrofitting the ATM with a hidden camera. Often this is a false fascia directly in front of or above the PIN pad, recording each victim entering his or her PIN in a time-stamped video.</p>
<p>In other cases, the thieves may replace the PIN pad security shield on the ATM with a replica that includes a hidden pinhole camera, tucking the camera components behind the cut hole and fishing the camera wiring and battery through the hole drilled in the front of the machine.</p>
<div id="attachment_45172" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/1cf40a7b.pinshieldskim.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/pinshieldskim.png"><img class="wp-image-45172" src="media/1cf40a7b.pinshieldskim.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/pinshieldskim.png" alt="" width="594" height="285" /></a><p class="wp-caption-text">The image on the left shows the spy camera guts and battery hidden behind the hole (this view is from the inside of the ATM, and the card reader is on the left). The image on the right shows a counterfeit PIN pad shield equipped with a hidden camera that is wired to the taped components pictured in the left image.</p></div>
<p>It&#8217;s difficult to cite all of the Secret Service&#8217;s report without giving thieves a precise blueprint on how to conduct these attacks. But I will say that several sources who spend a great deal of time monitoring cybercrime forums and communications have recently shared multiple how-to documents apparently making the rounds that lay out in painstaking detail how to execute these wiretapping attacks. So that knowledge is definitely being shared more widely in the criminal community now.</p>
<p>Overall, it’s getting tougher to spot ATM skimming devices, many of which are designed to be embedded inside various ATM components (e.g., <a href="https://krebsonsecurity.com/?s=insert+skimmer&amp;x=0&amp;y=0" target="_blank" rel="noopener">insert skimmers</a>). It’s best to focus instead on protecting your own physical security while at the cash machine. If you visit an ATM that looks strange, tampered with, or out of place, try to find another machine. Use only ATMs in public, well-lit areas, and avoid those in secluded spots.</p>
<p><em>Most importantly, cover the PIN pad with your hand when entering your PIN</em>: That way, even if the thieves somehow skim your card, there is less chance that they will be able to snag your PIN as well. You’d be amazed at <a href="https://krebsonsecurity.com/2012/09/a-handy-way-to-foil-atm-skimmer-scams/" target="_blank" rel="noopener">how many people fail to take this basic precaution</a>.</p>
<p>Sure, there is still a chance that thieves could use <a href="media/5bc9676d.skimgallery1.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2010/08/skimgallery1.jpg" target="_blank" rel="noopener">a PIN-pad overlay device</a> to capture your PIN, but in my experience these are far less common than hidden cameras (and quite a bit more costly for thieves who aren’t making their own skimmers). Done properly, covering the PIN pad with your hand could even block hidden cameras like those embedded in the phony PIN pad security shield pictured above.</p>
<p><center><iframe src="//www.youtube.com/embed/JbDdsUh_sTg" width="420" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></center>Fascinated by all things skimmer-related? Check out my series <a href="https://krebsonsecurity.com/all-about-skimmers/" target="_blank" rel="noopener">All About Skimmers</a> for more images, videos and ingenious skimmer scams.</p>


feed_id: https://krebsonsecurity.com/?p=45203
title: Facebook Security Bug Affects 90M Users
uri: Facebook-Security-Bug-Affects-90M-Users
url: https://krebsonsecurity.com/2018/09/facebook-security-bug-affects-90m-users/
content:
<p><strong>Facebook</strong> said today some 90 million of its users may get forcibly logged out of their accounts after the company fixed a rather glaring security vulnerability in its Web site that may have let attackers hijack user profiles. </p>
<p>In <a href="https://newsroom.fb.com/news/2018/09/security-update/" rel="noopener" target="_blank">a short blog post</a> published this afternoon, Facebook said hackers have been exploiting a vulnerability in Facebook&#8217;s site code that impacted a feature called &#8220;View As,&#8221; which lets users see how their profile appears to other people. </p>
<p>&#8220;This allowed them to steal Facebook access tokens which they could then use to take over people’s accounts,&#8221; Facebook wrote. &#8220;Access tokens are the equivalent of digital keys that keep people logged in to Facebook so they don’t need to re-enter their password every time they use the app.&#8221;</p>
<p>Facebook said it was removing the insecure &#8220;View As&#8221; feature, and resetting the access tokens of 50 million accounts that the company said it knows were affected, as well as the tokens for another 40 million users that may have been impacted over the past year. </p>
<p>The company said it was just beginning its investigation, and that it doesn&#8217;t yet know some basic facts about the incident, such as whether these accounts were misused, if any private information was accessed, or who might be responsible for these attacks. </p>
<p>Although Facebook didn&#8217;t mention this in their post, <em>one other major unanswered question about this incident is whether the access tokens could have let attackers interactively log in to third-party sites as the user</em>. Tens of thousands of Web sites let users log in using nothing more than their Facebook profile credentials. If users have previously logged in at third-party sites using their Facebook profile, there&#8217;s a good chance the attackers could have had access to those third-party sites as well. </p>
<p>I have asked for clarification from Facebook on this point and will update this post when and if I receive a response. However, I would have expected Facebook to mention this as a mitigating factor if authorized logins at third-party sites were <em>not</em> impacted. </p>
<p><strong>Update: 4:46 p.m. ET:</strong> A Facebook spokesperson confirmed that while it was technically possible that an attacker could have abused this bug to target third-party apps and sites that use Facebook logins, the company doesn&#8217;t have any evidence so far that this has happened.</p>
<p>&#8220;We have invalidated data access for third-party apps for the affected individuals,&#8221; the spokesperson said, referring to the 90 million account that were forcibly logged out today and presented with a notification about the incident at the top of their feed. </p>
<p><em>Original story:</em><br />
Facebook says there is no need for users to reset their passwords as a result of this breach, although that is certainly an option. </p>
<p>More importantly, it&#8217;s a good idea for all Facebook users to review their login activity. <a href="https://www.facebook.com/settings?tab=security&#038;section=sessions&#038;view" rel="noopener" target="_blank">This page</a> should let you view which devices are logged in to your account and approximately where in the world those devices are at the moment. That page also has an option to force a simultaneous logout of all devices connected to your account.</p>


feed_id: https://krebsonsecurity.com/?p=45154
title: Voice Phishing Scams Are Getting More Clever
uri: Voice-Phishing-Scams-Are-Getting-More-Clever
url: https://krebsonsecurity.com/2018/10/voice-phishing-scams-are-getting-more-clever/
content:
<p>Most of us have been trained to be wary of clicking on links and attachments that arrive in emails unexpected, but it&#8217;s easy to forget scam artists are constantly dreaming up innovations that put a new shine on old-fashioned telephone-based phishing scams. Think you&#8217;re too smart to fall for one? Think again: Even technology experts are getting taken in by some of the more recent schemes (or very nearly).</p>
<p><img class="aligncenter wp-image-45224" src="media/57d2a628.phonescam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/phonescam.png" alt="" width="590" height="372" /></p>
<p><strong>Matt Haughey</strong> is the creator of the community Weblog <a href="https://www.metafilter.com/" target="_blank" rel="noopener">MetaFilter</a> and a writer at <a href="https://www.slack.com" target="_blank" rel="noopener">Slack</a>. Haughey banks at a small Portland credit union, and last week he got a call on his mobile phone from an 800-number that matched the number his credit union uses.</p>
<p>Actually, he got three calls from the same number in rapid succession. He ignored the first two, letting them both go to voicemail. But he picked up on the third call, thinking it must be something urgent and important. After all, his credit union had rarely ever called him.</p>
<p>Haughey said he was greeted by a female voice who explained that the credit union had blocked two phony-looking charges in Ohio made to his debit/ATM card. She proceeded to then read him the last four digits of the card that was currently in his wallet. It checked out.</p>
<p>Haughey told the lady that he would need a replacement card immediately because he was about to travel out of state to California. Without missing a beat, the caller said he could keep his card and that the credit union would simply block any future charges that weren&#8217;t made in either Oregon or California.</p>
<p>This struck Haughey as a bit off. Why would the bank say they were freezing his card but then say they could keep it open for his upcoming trip? It was the first time the voice inside his head spoke up and said, &#8220;Something isn&#8217;t right, Matt.&#8221; But, he figured, the customer service person at the credit union was trying to be helpful: She was doing him a favor, he reasoned.</p>
<p>The caller then read his entire home address to double check it was the correct destination to send a new card at the conclusion of his trip. Then the caller said she needed to verify his mother&#8217;s maiden name. The voice in his head spoke out in protest again, but then banks had asked for this in the past. He provided it.</p>
<p>Next she asked him to verify the three digit security code printed on the back of his card. Once more, the voice of caution in his brain was silenced: He&#8217;d given this code out previously in the few times he&#8217;d used his card to pay for something over the phone.</p>
<p>Then she asked him for his current card PIN, just so she could apply that same PIN to the new card being mailed out, she assured him. Ding, ding, ding went the alarm bells in his head. Haughey hesitated, then asked the lady to repeat the question. When she did, he gave her the PIN, and she assured him she&#8217;d make sure his existing PIN also served as the PIN for his new card.</p>
<p>Haughey said after hanging up he felt fairly certain the entire transaction was legitimate, although the part about her requesting the PIN kept nagging at him.</p>
<p>&#8220;I balked at challenging her because everything lined up,&#8221; he said in an interview with KrebsOnSecurity. &#8220;But when I hung up the phone and told a friend about it, he was like, &#8216;Oh man, you just got scammed, there&#8217;s no way that&#8217;s real.'&#8221;</p>
<p>Now more concerned, Haughey visited his credit union to make sure his travel arrangements were set. When he began telling the bank employee what had transpired, he could tell by the look on her face that his friend was right.</p>
<p>A review of his account showed that there were indeed two fraudulent charges on his account from earlier that day totaling $3,400, but neither charge was from Ohio. Rather, someone used a counterfeit copy of his debit card to spend more than $2,900 at a Kroger near Atlanta, and to withdraw almost $500 from an ATM in the same area. After the unauthorized charges, he had just $300 remaining in his account.</p>
<p>&#8220;People I&#8217;ve talked to about this say there’s no way they&#8217;d fall for that, but when someone from a trustworthy number calls, says they&#8217;re from your small town bank, and sounds incredibly professional, you’d fall for it, too,&#8221; Haughey said.</p>
<p>Fraudsters can use a variety of open-source and free tools to fake or &#8220;spoof&#8221; the number displayed as the caller ID, lending legitimacy to phone phishing schemes. Often, just sprinkling in a little foreknowledge of the target&#8217;s personal details &#8212; SSNs, dates of birth, addresses and other information that can be purchased for a nominal fee from any one of several underground sites that sell such data &#8212; adds enough detail to the call to make it seem legitimate.<span id="more-45154"></span></p>
<h4>A CLOSE CALL</h4>
<p><strong>Cabel Sasser</strong> is founder of a Mac and iOS software company called <a href="https://panic.com/" target="_blank" rel="noopener">Panic Inc.</a> Sasser said he almost got scammed recently after receiving a call that appeared to be the same number as the one displayed on the back of his Wells Fargo ATM card.</p>
<p>&#8220;I answered, and a Fraud Department agent said my ATM card has just been used at a Target in Minnesota, was I on vacation?&#8221; Sasser recalled in a tweet about the experience.</p>
<p>What Sasser didn&#8217;t mention in his tweet was that his corporate debit card had just been hit with two instances of fraud: Someone had charged $10,000 worth of metal air ducts to his card. When he disputed the charge, his bank sent a replacement card.</p>
<p><img class="alignright wp-image-16248" src="media/9836de0f.phonefraud.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2012/08/phonefraud.jpg" alt="" width="248" height="372" srcset="https://krebsonsecurity.com/wp-content/uploads/2012/08/phonefraud.jpg 283w, https://krebsonsecurity.com/wp-content/uploads/2012/08/phonefraud-266x400.jpg 266w" sizes="(max-width: 248px) 100vw, 248px" />&#8220;I used the new card at maybe four places and immediately another fraud charge popped up for like $20,000 in custom bathtubs,&#8221; Sasser recalled in an interview with KrebsOnSecurity. &#8220;The morning this scam call came in I was spending time trying to figure out who might have lost our card data and was already in that frame of mind when I got the call about fraud on my card.&#8221;</p>
<p>And so the card-replacement dance began.</p>
<p>&#8220;Is the card in your possession?,&#8221; the caller asked. It was. The agent then asked him to read the three-digit CVV code printed on the back of his card.</p>
<p>After verifying the CVV, the agent offered to expedite a replacement, Sasser said. &#8220;First he had to read some disclosures. Then he asked me to key in a new PIN. I picked a random PIN and entered it. Verified it again. Then he asked me to key in my current PIN.&#8221;</p>
<p>That made Sasser pause. Wouldn&#8217;t an actual representative from Wells Fargo&#8217;s fraud division already have access to his current PIN?</p>
<p>&#8220;It&#8217;s just to confirm the change,&#8221; the caller told him. &#8220;I can&#8217;t see what you enter.&#8221;</p>
<p>&#8220;But&#8230;you&#8217;re the bank,&#8221; he countered. &#8220;You have my PIN, and you <em>can</em> see what I enter&#8230;&#8221;</p>
<p>The caller had a snappy reply for this retort as well.</p>
<p>&#8220;Only the IVR [interactive voice response] system can see it,&#8221; the caller assured him. &#8220;Hey, if it helps, I have all of your account info up&#8230;to confirm, the last four digits of your Social Security number are XXXX, right?&#8221;</p>
<p>Sure enough, that was correct. But something still seemed off. At this point, Sasser said he told the agent he would call back by dialing the number printed on his ATM card &#8212; the same number his mobile phone was already displaying as the source of the call. After doing just that, the representative who answered said there had been no such fraud detected on his account.</p>
<p>&#8220;I was just four key presses away from having all my cash drained by someone at an ATM,&#8221; Sasser recalled. A visit to the local Wells Fargo branch before his trip confirmed that he&#8217;d dodged a bullet.</p>
<p><span class="pullquote pqleft">&#8220;The Wells person was super surprised that I bailed out when I did, and said most people are 100 percent taken by this scam,&#8221; Sasser said.</span></p>
<h4>HUMAN, ROBOT OR HYBRID?</h4>
<p>In Sasser&#8217;s case, the scammer was a live person, but some equally convincing voice phishing schemes &#8212; sometimes called &#8220;<strong>vishing</strong>&#8221; &#8212; use a combination of humans and automation. Consider the following vishing attempt, reported to KrebsOnSecurity in August by &#8220;Curt,&#8221; a longtime reader from Canada.</p>
<p>&#8220;I&#8217;m both a TD customer and Rogers phone subscriber and just experienced what I consider a very convincing and/or elaborate social engineering/vishing attempt,&#8221; Curt wrote. &#8220;At 7:46pm I received a call from (647-475-1636) purporting to be from Credit Alert (alertservice.ca) on behalf of <strong>TD Canada Trust</strong> offering me a free 30-day trial for a credit monitoring service.&#8221;</p>
<p>The caller said her name was Jen Hansen, and began the call with what Curt described as &#8220;over-the-top courtesy.&#8221;</p>
<p>&#8220;It sounded like a very well-scripted Customer Service call, where they seem to be trying so hard to please that it seems disingenuous,&#8221; Curt recalled. &#8220;But honestly it still sounded very much like a real person, not like a text to speech voice which sounds robotic. This sounded VERY natural.&#8221;</p>
<p>Ms. Hansen proceeded to tell Curt that TD Bank was offering a credit monitoring service free for one month, and that he could cancel at any time. To enroll, he only needed to confirm his home mailing address.</p>
<p>&#8220;I’m mega paranoid (I read krebsonsecurity.com daily) and asked her to tell me what address I had on their file, knowing full well my home address can be found in a variety of ways,&#8221; Curt wrote in an email to this author. &#8220;She said, &#8216;One moment while I access that information.'&#8221;</p>
<p>After a short pause, a new voice came on the line.</p>
<p>&#8220;And here’s where I realized I was finally talking to a real human &#8212; a female with a slight French accent &#8212; who read me my correct address,&#8221; Curt recalled.</p>
<p><img class="aligncenter wp-image-45226" src="media/c61b924f.cell8.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/cell8.png" alt="" width="589" height="678" /></p>
<p>After another pause, Ms. Hansen&#8217;s voice came back on the line. While she was explaining that part of the package included free antivirus and anti-keylogging software, Curt asked her if he could opt-in to receive his credit reports while opting-out of installing the software.</p>
<p>&#8220;I’m sorry, can you repeat that?&#8221; the voice identifying itself as Ms. Hansen replied. Curt repeated himself. After another, &#8220;I’m sorry, can you repeat that,&#8221; Curt asked Ms. Hansen where she was from.</p>
<p>The voice confirmed what was indicated by the number displayed on his caller ID: That she was calling from Barrie, Ontario. Trying to throw the robot voice further off-script, Curt asked what the weather was like in Barrie, Ontario. Another Long pause. The voice continued describing the offered service.</p>
<p>&#8220;I asked again about the weather, and she said, &#8216;I’m sorry, I don’t have that information. Would you like me to transfer you to someone that does?&#8217; I said yes and again the real person with a French accent started speaking, ignoring my question about the weather and saying that if I’d like to continue with the offer I needed to provide my date of birth. This is when I hung up and immediately called TD Bank.&#8221; No one from TD had called him, they assured him.</p>
<h4>FULLY AUTOMATED PHONE PHISHING</h4>
<p>And then there are the fully-automated voice phishing scams, which can be be equally convincing. Last week I heard from &#8220;Jon,&#8221; a cybersecurity professional with more than 30 years of experience under his belt (Jon asked to leave his last name out of this story).</p>
<p>Answering a call on his mobile device from a phone number in Missouri, Jon was greeted with the familiar four-note <a href="https://www.youtube.com/watch?v=hbCbJjq1ETI" target="_blank" rel="noopener">AT&amp;T jingle</a>, followed by a recorded voice saying AT&amp;T was calling to prevent his phone service from being suspended for non-payment.</p>
<p>&#8220;It then prompted me to enter my security PIN to be connected to a billing department representative,&#8221; Jon said. &#8220;My number was originally an AT&amp;T number (it reports as Cingular Wireless) but I have been on T-Mobile for several years, so clearly a scam if I had any doubt. However, I suspect that the average Joe would fall for it.&#8221;</p>
<h4>WHAT CAN YOU DO?</h4>
<p>Just as you would never give out personal information if asked to do so via email, <em>never give out any information about yourself in response to an unsolicited phone call</em>.</p>
<p>Phone phishing, like email scams, usually invokes an element of urgency in a bid to get people to let their guard down. If call has you worried that there might be something wrong and you wish to call them back, don&#8217;t call the number offered to you by the caller. If you want to reach your bank, call the number on the back of your card. If it&#8217;s another company you do business with, go to the company&#8217;s site and look up their main customer support number.</p>
<p>Unfortunately, this may take a little work. It&#8217;s not just banks and phone companies that are being impersonated by fraudsters. Reports on social media suggest many consumers also are receiving voice phishing scams that spoof customer support numbers at Apple, Amazon and other big-name tech companies. In many cases, the scammers are <a href="https://krebsonsecurity.com/2018/02/money-laundering-via-author-impersonation-on-amazon/" target="_blank" rel="noopener">polluting top search engine results with phony 800-numbers for customer support lines that lead directly to fraudsters</a>.</p>
<p>These days, scam calls happen on my mobile so often that I almost never answer my phone unless it appears to come from someone in my contacts list. The Federal Trade Commission&#8217;s do-not-call list does not appear to have done anything to block scam callers, and the major wireless carriers seem to be <a href="https://krebsonsecurity.com/2017/06/got-robocalled-dont-get-mad-get-busy/" target="_blank" rel="noopener">pretty useless in blocking incessant robocalls</a>, <a href="https://krebsonsecurity.com/2017/06/got-robocalled-dont-get-mad-get-busy/" target="_blank" rel="noopener">even when the scammers are impersonating the carriers themselves</a>, as in Jon&#8217;s case above.</p>
<p>I suspect people my age (mid-40s) and younger also generally let most unrecognized calls go to voicemail. It seems to be a very different reality for folks from an older generation, many of whom still primarily call friends and family using land lines, and who will always answer a ringing phone whenever it is humanly possible to do so.</p>
<p>It&#8217;s a good idea to advise your loved ones to ignore calls unless they appear to come from a friend or family member, and to just hang up the moment the caller starts asking for personal information.</p>


feed_id: https://krebsonsecurity.com/?p=45246
title: When Security Researchers Pose as Cybercrooks, Who Can Tell the Difference?
uri: When-Security-Researchers-Pose-as-Cybercrooks-Who-Can-Tell-the-Differ
url:
https://krebsonsecurity.com/2018/10/when-security-researchers-pose-as-cybercrooks-who-can-tell-the-difference/

content:
<p>A ridiculous number of companies are exposing some or all of their proprietary and customer data by putting it in the cloud without any kind of authentication needed to read, alter or destroy it. When cybercriminals are the first to discover these missteps, usually the outcome is a demand for money in return for the stolen data. But when these screw-ups are unearthed by security professionals seeking to make a name for themselves, the resulting publicity often can leave the breached organization wishing they&#8217;d instead been quietly extorted by anonymous crooks.</p>
<p>Last week, I was on a train from New York to Washington, D.C. when I received a phone call from <strong>Vinny Troia</strong>, a security researcher who runs a startup in Missouri called <strong>NightLion Security</strong>. Troia had discovered that <strong>All American Entertainment</strong>, a speaker bureau which represents a number of celebrities who also can be hired to do public speaking, had exposed thousands of speaking contracts via an unsecured <strong>Amazon</strong> cloud instance.</p>
<p>The contracts laid out how much each speaker makes per event, details about their travel arrangements, and any requirements or obligations stated in advance by both parties to the contract. No secret access or password was needed to view the documents.</p>
<p>It was a juicy find to be sure: I can now tell you how much <strong>Oprah</strong> makes per event (it&#8217;s <em>a</em> <em>lot</em>). Ditto for <strong>Gwyneth Paltrow</strong>, <strong>Olivia Newton John</strong>, <strong>Michael J. Fox </strong>and a host of others. But I&#8217;m not going to do that.</p>
<p>Firstly, it&#8217;s nobody&#8217;s business what they make. More to the point, All American also is <a href="https://krebsonsecurity.com/cpm/" target="_blank" rel="noopener"><em>my</em> speaker bureau</a>, and included in the cache of documents the company exposed in the cloud were some of my speaking contracts. In fact, when Troia called about his find, I was on my way home from <a href="https://twitter.com/briankrebs/status/1045097555112136704" target="_blank" rel="noopener">one such engagement</a>.</p>
<p>I quickly informed my contact at All American and asked them to let me know the moment they confirmed the data was removed from the Internet. While awaiting that confirmation, my pent-up frustration <a href="https://twitter.com/briankrebs/status/1045091640480804864" target="_blank" rel="noopener">seeped into a tweet</a> that seemed to touch a raw nerve among others in the security industry.</p>
<p><img class="aligncenter wp-image-45250" src="media/2c8bcf2c.leakhackloselift.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/leakhackloselift.png" alt="" width="597" height="370" /></p>
<p>The same day I alerted them, All American took down its bucket of unsecured speaker contract data, and apologized profusely for the oversight (although I have yet to hear a good explanation as to why this data needed to be stored in the cloud to begin with).</p>
<p>This was hardly the first time Troia had alerted me about a huge cache of important or sensitive data that companies have left exposed online. On Monday, <em>TechCrunch</em> <a href="https://techcrunch.com/2018/10/01/apollo-contacts-data-breach/" target="_blank" rel="noopener">broke the story</a> about a &#8220;breach&#8221; at <strong>Apollo</strong>, a sales engagement startup boasting a database of more than 200 million contact records. Calling it a breach seems a bit of a stretch; it probably would be more accurate to describe the incident as a data leak.</p>
<p>Just like my speaker bureau, Apollo had simply put all this data up on an Amazon server that anyone on the Internet could access without providing a password. And Troia was again the one who figured out that the data had been leaked by Apollo &#8212; the result of an intensive, months-long process that took some extremely interesting twists and turns.</p>
<p>That journey &#8212; which I will endeavor to describe here &#8212; offered some uncomfortable insights into how organizations frequently learn about data leaks these days, and indeed whether they derive any lasting security lessons from the experience at all. It also gave me a new appreciation for how difficult it can be for organizations that screw up this way to tell the difference between a security researcher and a bad guy.</p>
<h4>THE DARK OVERLORD</h4>
<p>I began hearing from Troia almost daily beginning in mid-2017. At the time, he was on something of a personal mission to discover the real-life identity behind <strong>The Dark Overlord</strong> (TDO), the pseudonym used by an individual or group of criminals who have been extorting dozens of companies &#8212; particularly healthcare providers &#8212; after hacking into their systems and stealing sensitive data.</p>
<p>The Dark Overlord&#8217;s method was roughly the same in each attack. Gain access to sensitive data (often <a href="https://krebsonsecurity.com/2013/12/hacked-via-rdp-really-dumb-passwords/" target="_blank" rel="noopener">by purchasing access through crimeware-as-a-service offerings</a>), and send a long, rambling ransom note to the victim organization demanding tens of thousands of dollars in Bitcoin for the safe return of said data.</p>
<p>Victims were typically told that if they refused to pay, the stolen data would be sold to cybercriminals lurking on Dark Web forums. Worse yet, TDO also promised to make sure the news media knew that victim organizations were more interested in keeping the breach private than in securing the privacy of their customers or patients.</p>
<p>In fact, the apparent ringleader of TDO reached out to KrebsOnSecurity in May 2016 with a remarkable offer. Using the nickname &#8220;<strong>Arnie</strong>,&#8221; the public voice of TDO said he was offering exclusive access to news about their latest extortion targets.</p>
<div id="attachment_45265" style="width: 588px" class="wp-caption aligncenter"><a class="lightbox" href="media/69d825c0.tdoconvo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/tdoconvo.png"><img class="wp-image-45265 size-full" src="media/69d825c0.tdoconvo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/tdoconvo.png" alt="" width="578" height="758" /></a><p class="wp-caption-text">Snippets from a long email conversation in May 2016 with a hacker who introduced himself as Adam but would later share his nickname as &#8220;Arnie&#8221; and disclose that he was a member of The Dark Overlord. In this conversation, he is offering to sell access to scoops about data breaches that he caused.</p></div>
<p>Arnie claimed he was an administrator or key member on several top Dark Web forums, and provided a handful of convincing clues to back up his claim. He told me he had real-time access to dozens of healthcare organizations they&#8217;d hacked into, and that each one which refused to give in to TDO&#8217;s extortion demands could turn into a juicy scoop for KrebsOnSecurity.</p>
<p>Arnie said he was coming to me first with the offer, but that he was planning to approach other journalists and news outlets if I declined. I balked after discovering that Arnie wasn&#8217;t offering this access for free: He wanted 10 bitcoin in exchange for exclusivity (at the time, his asking price was roughly equivalent to USD $5,000).</p>
<p>Perhaps other news outlets are accustomed to paying for scoops, but that is not something I would ever consider. And in any case the whole thing was starting to smell like a shakedown or scam. I declined the offer. It&#8217;s possible other news outlets or journalists did not; I will not speculate on this matter further, other than to say readers can draw their own conclusions based on the timeline and the public record.<span id="more-45246"></span></p>
<h4>WHO IS SOUNDCARD?</h4>
<p>Fast-forward to September 2017, and Troia was contacting me almost daily to share tidbits of research into email addresses, phone numbers and other bits of data apparently tied to TDO&#8217;s communications with victims and their various identities on Dark Web forums.</p>
<p>His research was exhaustive and occasionally impressive, and for a while I caught the TDO bug and became engaged in a concurrent effort to learn the identities of the TDO members. For better or worse, the results of that research will have to wait for another story and another time.</p>
<p>At one point, Troia told me he&#8217;d gained acceptance on the Dark Web forum <strong>Kickass</strong>, using the hacker nickname &#8220;<strong>Soundcard</strong>&#8220;. He said he believed a presence on all of the forums TDO was active on was necessary for figuring out once and for all who was behind this brazen and very busy extortion group.</p>
<p>Here is a screen shot Troia shared with me of Soundcard&#8217;s posting there, which concerned a July 2018 forum discussion thread about a data leak of 340 million records from Florida-based marketing firm <strong>Exactis</strong>. <a href="https://www.wired.com/story/exactis-database-leak-340-million-records/" target="_blank" rel="noopener">As detailed by <em>Wired.com</em> in June 2018</a>, Troia had discovered this huge cache of data unprotected and sitting wide open on a cloud server, and ultimately traced it back to Exactis.</p>
<div id="attachment_45258" style="width: 598px" class="wp-caption aligncenter"><a class="lightbox" href="media/07d2121b.soundcard.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/soundcard.png"><img class="wp-image-45258" src="media/07d2121b.soundcard.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/soundcard.png" alt="" width="588" height="587" /></a><p class="wp-caption-text">Vinny Troia, a.k.a. &#8220;Soundcard&#8221; on the Dark Web forum Kickass.</p></div>
<p>After several weeks of comparing notes about TDO with Troia, I learned that he was telling random people that we were &#8220;working together,&#8221; and that he was throwing my name around to various security industry sources and friends as a way of gaining access to new sources of data.</p>
<p>I respectfully told Troia that this was not okay &#8212; that I never told people about our private conversations (or indeed that we spoke at all) &#8212; and I asked him to stop doing that. He apologized, said he didn&#8217;t understand he&#8217;d overstepped certain boundaries, and that it would never happen again.</p>
<p>But it would. Multiple times. Here&#8217;s one time that really stood out for me. Earlier this summer, Troia sent me a link to a database of truly staggering size &#8212; nearly 10 terabytes of data &#8212; that someone had left open to anyone via a cloud instance. Again, no authentication or password was needed to access the information.</p>
<p>At first glance, it appeared to be <strong>LinkedIn</strong> profile data. Working off that assumption, I began a hard target search of the database for specific LinkedIn profiles of important people. I first used the Web to locate the public LinkedIn profile pages for nearly all of the CEOs of the world&#8217;s top 20 largest companies, and then searched those profile names in the database that Troia had discovered.</p>
<p>Suddenly, I had the cell phone numbers, addresses, email addresses and other contact data for some of the most powerful people in the world. Immediately, I reached out to contacts at LinkedIn and <strong>Microsoft</strong> (which bought LinkedIn in 2016) and arranged a call to discuss the findings.</p>
<p>LinkedIn&#8217;s security team told me the data I was looking at was in fact an amalgamation of information scraped from LinkedIn and dozens of public sources, and being sold by the same firm that was doing the scraping and profile collating. LinkedIn declined to name that company, and it has not yet responded to follow-up questions about whether the company it was referring to was Apollo.</p>
<p>Sure enough, a closer inspection of the database revealed the presence of other public data sources, including startup web site <strong>AngelList</strong>, <strong>Facebook</strong>, <strong>Salesforce</strong>, <strong>Twitter</strong>, and <strong>Yelp</strong>, among others.</p>
<p>Several other trusted sources I approached with samples of data spliced from the nearly 10 TB trove of data Troia found in the cloud said they believed LinkedIn&#8217;s explanation, and that the data appeared to have been scraped off the public Internet from a variety of sources and combined into a single database.</p>
<p>I told Troia it didn&#8217;t look like the data came exclusively from LinkedIn, or at least wasn&#8217;t stolen from them, and that all indications suggested it was a collection of data scraped from public profiles. He seemed unconvinced.</p>
<p>Several days after my second call with LinkedIn&#8217;s security team &#8212; around Aug. 15 &#8212; I was made aware of a sales posting on the Kickass crime forum by someone selling what they claimed was &#8220;all of the LinkedIN user-base.&#8221; The ad, a blurry, partial screenshot of which can be seen below, was posted by the Kickass user Soundcard. The text of the sales thread was as follows:</p>
<div id="attachment_45259" style="width: 603px" class="wp-caption aligncenter"><a class="lightbox" href="media/c93afabb.soundcard-li.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/soundcard-li.png"><img class="wp-image-45259" src="media/c93afabb.soundcard-li.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/soundcard-li.png" alt="" width="593" height="354" /></a><p class="wp-caption-text">Soundcard, a.k.a. Troia, offering to sell what he claimed was all of LinkedIn&#8217;s user data, on the Dark Web forum Kickass.</p></div>
<blockquote><p>&#8220;KA users &#8211;</p>
<p>I present you with exclusive opportunity to purchase all (yes ALL) of the LinkedIN user-base for the low low price of 2 BTC.</p>
<p>I found a database server with all LinkedIN users. All of user&#8217;s personal information is included in this database (including private email and phone number NOT listed on public profile). No passwords, sorry.</p>
<p>Size: 2.1TB.</p>
<p>user count: 212 million</p>
<p>Why so large for 212 million users? See the sample data per record. There is lot of marketing and CRM data as well. I sell original data only. no editz.</p>
<p>Here is index of server. The LinkedIN users spread across people and contacts indexes. Sale includes both of those indexes.</p>
<p>Questions, comments, purchase? DM me, or message me &#8211; soundcard@exploit[.]im</p></blockquote>
<p>The &#8220;sample data&#8221; included in the sales thread was from <em>my records</em> in this huge database, although Soundcard said he had sanitized certain data elements from this snippet. He explained his reasoning for that in a short Q&amp;A from his sales thread:</p>
<p>Question 1: Why you sanitize Brian Krebs&#8217; information in sample?</p>
<p>Answer 1: Because nothing in life free. This only to show i have data.</p>
<p><img class="aligncenter wp-image-45260" src="media/5a89c554.question1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/question1.png" alt="" width="587" height="536" /></p>
<p>I soon confronted Troia not only for offering to sell leaked data on the Dark Web, but also for once again throwing my name around in his various activities &#8212; despite past assurances that he would not. Also, his actions had boxed me into a corner: Any plans I had to credit him in a story for eventually helping to determine the source of the leaked data (which we now know to be Apollo) became more complicated without also explaining his Dark Web alter ego as Soundcard, and I am not in the habit of omitting such important details from stories.</p>
<p>Troia assured me that he never had any intention of selling the data, and that the whole thing had been a ruse to help smoke out some of the suspected TDO members.</p>
<p>For its part, LinkedIn&#8217;s security team was not amused, and <a href="https://news.linkedin.com/2018/8/members-trust-linkedin-with-their-data-and-we-work-to-protect-th" target="_blank" rel="noopener">published a short post</a> to its media page denying that the company had suffered a security breach.</p>
<p>&#8220;We want our members to know that a recent claim of a LinkedIn data breach is not accurate,&#8221; the company wrote. &#8220;Our investigation into this claim found that a third-party sales intelligence company that is not associated with LinkedIn was compromised and exposed a large set of data aggregated from a number of social networks, websites, and the company&#8217;s own customers. It also included a limited set of publicly available data about LinkedIn members, such as profile URL, industry and number of connections. This was not a breach of LinkedIn.&#8221;</p>
<p>It is quite a fine line to walk when self-styled security researchers mimic cyber criminals in the name of making things more secure. On the one hand, reaching out to companies that are inadvertently exposing sensitive data and getting them to secure it or pull it offline altogether is a worthwhile and often thankless effort, and clearly many organizations still need a lot of help in this regard.</p>
<p>On the other hand, most organizations that fit this description simply lack the security maturity to tell the difference between someone trying to make the Internet a safer place and someone trying to sell them a product or service.</p>
<p>As a result, victim organizations tend to react with deep suspicion or even hostility to legitimate researchers and security journalists who alert them about a data breach or leak. And stunts like the ones described above tend to have the effect of deepening that suspicion, and sowing fear, uncertainty and doubt about the security industry as a whole.</p>


feed_id: https://krebsonsecurity.com/?p=45297
title: Supply Chain Security is the Whole Enchilada, But Who’s Willing to Pay for It?
uri: Supply-Chain-Security-is-the-Whole-Enchilada-But-Who-s-Willing-to-P
url:
https://krebsonsecurity.com/2018/10/supply-chain-security-is-the-whole-enchilada-but-whos-willing-to-pay-for-it/

content:
<p>From time to time, there emerge cybersecurity stories of such potential impact that they have the effect of making all other security concerns seem minuscule and trifling by comparison. Yesterday was one of those times. <em>Bloomberg</em> <em>Businessweek</em> on Thursday <a href="https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies?srnd=businessweek-v2" target="_blank" rel="noopener">published a bombshell</a> investigation alleging that Chinese cyber spies had used a U.S.-based tech firm to secretly embed tiny computer chips into electronic devices purchased and used by almost 30 different companies. There aren&#8217;t any corroborating accounts of this scoop so far, but it is both fascinating and terrifying to look at why threats to the global technology supply chain can be so difficult to detect, verify and counter.</p>
<p><img class="alignright wp-image-45324" src="media/57cfb505.bbb-chip.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/bbb-chip.png" alt="" width="288" height="395" />In the context of computer and Internet security, supply chain security refers to the challenge of validating that a given piece of electronics &#8212; and by extension the software that powers those computing parts &#8212; does not include any extraneous or fraudulent components beyond what was specified by the company that paid for the production of said item.</p>
<p>In a nutshell, the Bloomberg story claims that San Jose, Calif. based tech giant <strong>Supermicro</strong> was somehow caught up in a plan to quietly insert a rice-sized computer chip on the circuit boards that get put into a variety of servers and electronic components purchased by major vendors, allegedly including <strong>Amazon</strong> and <strong>Apple</strong>. The chips were alleged to have spied on users of the devices and sent unspecified data back to the Chinese military.</p>
<p>It&#8217;s critical to note up top that Amazon, Apple and Supermicro <a href="https://www.bloomberg.com/news/articles/2018-10-04/the-big-hack-amazon-apple-supermicro-and-beijing-respond" target="_blank" rel="noopener">have categorically denied most of the claims in the Bloomberg piece</a>. That is, their positions refuting core components of the story would appear to leave little wiggle room for future backtracking on those statements. Amazon also <a href="https://aws.amazon.com/blogs/security/setting-the-record-straight-on-bloomberg-businessweeks-erroneous-article/" target="_blank" rel="noopener">penned a blog post</a> that more emphatically stated their objections to the Bloomberg piece.</p>
<p>Nevertheless, Bloomberg reporters write that &#8220;the companies’ denials are countered by six current and former senior national security officials, who—in conversations that began during the Obama administration and continued under the Trump administration—detailed the discovery of the chips and the government’s investigation.&#8221;</p>
<p>The story continues:</p>
<blockquote><p>Today, Supermicro sells more server motherboards than almost anyone else. It also dominates the $1 billion market for boards used in special-purpose computers, from MRI machines to weapons systems. Its motherboards can be found in made-to-order server setups at banks, hedge funds, cloud computing providers, and web-hosting services, among other places. Supermicro has assembly facilities in California, the Netherlands, and Taiwan, but its motherboards—its core product—are nearly all manufactured by contractors in China.</p></blockquote>
<p>Many readers have asked for my take on this piece. I heard similar allegations earlier this year about Supermicro and tried mightily to verify them but could not. That in itself should be zero gauge of the story&#8217;s potential merit. After all, I am just one guy, whereas this is the type of scoop that usually takes entire portions of a newsroom to research, report and vet. By Bloomberg&#8217;s own account, the story took more than a year to report and write, and cites 17 anonymous sources as confirming the activity.</p>
<p>Most of what I have to share here is based on conversations with some clueful people over the years who would probably find themselves confined to a tiny, windowless room for an extended period if their names or quotes ever showed up in a story like this, so I will tread carefully around this subject.</p>
<p>The U.S. Government isn&#8217;t eager to admit it, but there has long been an unofficial inventory of tech components and vendors that are forbidden to buy from if you&#8217;re in charge of procuring products or services on behalf of the U.S. Government. Call it the &#8220;brown list, &#8220;black list,&#8221; &#8220;entity list&#8221; or what have you, but it&#8217;s basically an indelible index of companies that are on the permanent Shit List of Uncle Sam for having been caught pulling some kind of supply chain shenanigans.</p>
<p>More than a decade ago when I was a reporter with <em>The Washington Post</em>, I heard from an extremely well-placed source that one Chinese tech company had made it onto Uncle Sam&#8217;s entity list because they sold a custom hardware component for many Internet-enabled printers that secretly made a copy of every document or image sent to the printer and forwarded that to a server allegedly controlled by hackers aligned with the Chinese government.</p>
<p>That example gives a whole new meaning to the term &#8220;supply chain,&#8221; doesn&#8217;t it? If Bloomberg&#8217;s reporting is accurate, that&#8217;s more or less what we&#8217;re dealing with here in Supermicro as well.</p>
<p>But here&#8217;s the thing: Even if you identify which technology vendors are guilty of supply-chain hacks, it can be difficult to enforce their banishment from the procurement chain. One reason is that it is often tough to tell from the brand name of a given gizmo who actually makes all the multifarious components that go into any one electronic device sold today.</p>
<p>Take, for instance, the problem right now with insecure <strong>Internet of Things</strong> (IoT) devices &#8212; cheapo security cameras, Internet routers and digital video recorders &#8212; sold at places like Amazon and Walmart. Many of these IoT devices have become a major security problem because they are massively insecure by default and difficult if not also impractical to secure after they are sold and put into use.</p>
<p>For every company in China that produces these IoT devices, there are dozens of &#8220;white label&#8221; firms that market and/or sell the core electronic components as their own. So while security researchers might identify a set of security holes in IoT products made by one company whose products are white labeled by others, actually informing consumers about which third-party products include those vulnerabilities can be extremely challenging. In some cases, a technology vendor responsible for some part of this mess may simply go out of business or close its doors and re-emerge under different names and managers.</p>
<p>Mind you, there is no indication anyone is purposefully engineering so many of these IoT products to be insecure; a more likely explanation is that building in more security tends to make devices considerably more expensive and slower to market. In many cases, their insecurity stems from a combination of factors: They ship with every imaginable feature turned on by default; they bundle outdated software and firmware components; and their default settings are difficult or impossible for users to change.</p>
<p>We don&#8217;t often hear about <em>intentional</em> efforts to subvert the security of the technology supply chain simply because these incidents tend to get quickly classified by the military when they are discovered. But the U.S. Congress has held multiple hearings about supply chain security challenges, and the U.S. government has taken steps on several occasions to block Chinese tech companies from doing business with the federal government and/or U.S.-based firms.</p>
<p>Most recently, the Pentagon <a href="https://www.washingtonpost.com/news/the-switch/wp/2018/05/02/pentagon-tells-u-s-military-bases-to-stop-selling-zte-huawei-phones/" target="_blank" rel="noopener">banned the sale of Chinese-made ZTE and Huawei phones on military bases</a>, according to a Defense Department directive that cites security risks posed by the devices. The <strong>U.S. Department of Commerce</strong> also has <a href="https://techcrunch.com/2018/04/16/u-s-companies-banned-from-selling-components-to-zte/" target="_blank" rel="noopener">instituted a seven-year export restriction for ZTE</a>, resulting in a ban on U.S. component makers selling to ZTE.</p>
<p>Still, the issue here isn&#8217;t that we can&#8217;t trust technology products made in China. Indeed there are numerous examples of other countries &#8212; including the United States and its allies &#8212; slipping their own &#8220;backdoors&#8221; into hardware and software products.</p>
<p><em>Like it or not, the vast majority of electronics are made in China, and this is unlikely to change anytime soon. The central issue is that we don&#8217;t have any other choice right now</em>. <em>The reason is that by nearly all accounts it would be punishingly expensive to replicate that manufacturing process here in the United States.</em></p>
<p>Even if the U.S. government and Silicon Valley somehow mustered the funding and political will to do that, insisting that products sold to U.S. consumers or the U.S. government be made only with components made here in the U.S.A. would massively drive up the cost of all forms of technology. Consumers would almost certainly balk at buying these way more expensive devices. Years of experience has shown that consumers aren&#8217;t interested in paying a huge premium for security when a comparable product with the features they want is available much more cheaply.<span id="more-45297"></span></p>
<p>Indeed, noted security expert <strong>Bruce Schneier</strong> calls supply-chain security &#8220;an insurmountably hard problem.&#8221;</p>
<p>&#8220;Our IT industry is inexorably international, and anyone involved in the process can subvert the security of the end product,&#8221; Schneier wrote in <a href="https://www.washingtonpost.com/news/posteverything/wp/2018/05/08/banning-chinese-phones-wont-fix-security-problems-with-our-electronic-supply-chain/?utm_term=.734fa11f0611" target="_blank" rel="noopener">an opinion piece</a> published earlier this year in <em>The Washington Post</em>. &#8220;No one wants to even think about a US-only anything; prices would multiply many times over. We cannot trust anyone, yet we have no choice but to trust everyone. No one is ready for the costs that solving this would entail.&#8221;</p>
<p>The Bloomberg piece also addresses this elephant in the room:</p>
<blockquote><p>&#8220;The problem under discussion wasn’t just technological. It spoke to decisions made decades ago to send advanced production work to Southeast Asia. In the intervening years, low-cost Chinese manufacturing had come to underpin the business models of many of America’s largest technology companies. Early on, Apple, for instance, made many of its most sophisticated electronics domestically. Then in 1992, it closed a state-of-the-art plant for motherboard and computer assembly in Fremont, Calif., and sent much of that work overseas.</p>
<p>Over the decades, the security of the supply chain became an article of faith despite repeated warnings by Western officials. A belief formed that China was unlikely to jeopardize its position as workshop to the world by letting its spies meddle in its factories. That left the decision about where to build commercial systems resting largely on where capacity was greatest and cheapest. “You end up with a classic Satan’s bargain,” one former U.S. official says. “You can have less supply than you want and guarantee it’s secure, or you can have the supply you need, but there will be risk. Every organization has accepted the second proposition.”</p></blockquote>
<p>Another huge challenge of securing the technology supply chain is that it&#8217;s quite time consuming and expensive to detect when products may have been intentionally compromised during some part of the manufacturing process. Your typical motherboard of the kind produced by a company like Supermicro can include hundreds of chips, but it only takes one hinky chip to subvert the security of the entire product.</p>
<p>Also, most of the U.S. government&#8217;s efforts to police the global technology supply chain <a href="https://www.scientificamerican.com/article/the-pentagon-rsquo-s-seek-and-destroy-mission-for-counterfeit-electronics/" target="_blank" rel="noopener">seem to be focused on preventing counterfeits</a> &#8212; not finding secretly added spying components.</p>
<p>Finally, it&#8217;s not clear that private industry is up to the job, either. At least not yet.</p>
<p>&#8220;In the three years since the briefing in McLean, no commercially viable way to detect attacks like the one on Supermicro’s motherboards has emerged—or has looked likely to emerge,&#8221; the Bloomberg story concludes. &#8220;Few companies have the resources of Apple and Amazon, and it took some luck even for them to spot the problem. &#8216;This stuff is at the cutting edge of the cutting edge, and there is no easy technological solution,&#8217; one of the people present in McLean says. &#8216;You have to invest in things that the world wants. You cannot invest in things that the world is not ready to accept yet.'&#8221;</p>
<p>For my part, I try not to spin my wheels worrying about things I can&#8217;t change, and the supply chain challenges definitely fit into that category. I&#8217;ll have some more thoughts on the supply chain problem and what we can do about it in an interview to be published next week.</p>
<p>But for the time being, there are some things worth thinking about that can help mitigate the threat from stealthy supply chain hacks. Writing for this week&#8217;s newsletter put out by the <strong>SANS Institute</strong>, a security training company based in Bethesda, Md., editorial board member <strong>William Hugh Murray</strong> has a few provocative thoughts:</p>
<ol>
<li><strong>Abandon the password for all but trivial applications.</strong> Steve Jobs and the ubiquitous mobile computer have lowered the cost and improved the convenience of strong authentication enough to overcome all arguments against it.</li>
<li><strong>Abandon the flat network.</strong> Secure and trusted communication now trump ease of any-to-any communication.</li>
<li><strong>Move traffic monitoring from encouraged to essential.</strong></li>
<li><strong>Establish and maintain end-to-end encryption for all applications.</strong> Think TLS, VPNs, VLANs and physically segmented networks. Software Defined Networks put this within the budget of most enterprises.</li>
<li><strong>Abandon the convenient but dangerously permissive default access control rule of “read/write/execute” in favor of restrictive “read/execute-only” or even better, “Least privilege.”</strong> Least privilege is expensive to administer but it is effective. Our current strategy of “ship low-quality early/patch late” is proving to be ineffective and more expensive in maintenance and breaches than we could ever have imagined.</li>
</ol>


feed_id: https://krebsonsecurity.com/?p=45290
title: Naming & Shaming Web Polluters: Xiongmai
uri: Naming-Shaming-Web-Polluters-Xiongmai
url: https://krebsonsecurity.com/2018/10/naming-shaming-web-polluters-xiongmai/
content:
<p>What do we do with a company that regularly pumps metric tons of virtual toxic sludge onto the Internet and yet refuses to clean up their act? If ever there were a technology giant that deserved to be named and shamed for polluting the Web, it is <strong>Xiongmai</strong> &#8212; a Chinese maker of electronic parts that power a huge percentage of cheap digital video recorders (DVRs) and Internet-connected security cameras.</p>
<div id="attachment_45349" style="width: 598px" class="wp-caption aligncenter"><img class=" wp-image-45349" src="media/5221554c.xmbldg.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/xmbldg.png" alt="" width="588" height="358" /><p class="wp-caption-text">A rendering of Xiongmai&#8217;s center in Hangzhou, China. Source: xiongmaitech.com</p></div>
<p>In late 2016, the world witnessed the sheer disruptive power of <a href="https://krebsonsecurity.com/?s=mirai&amp;x=0&amp;y=0" target="_blank" rel="noopener">Mirai</a>, a powerful botnet strain fueled by Internet of Things (IoT) devices like DVRs and IP cameras that were <a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" target="_blank" rel="noopener">put online with factory-default passwords and other poor security settings</a>.</p>
<p>Security experts <a href="https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/" target="_blank" rel="noopener">soon discovered</a> that a majority of Mirai-infected devices were chiefly composed of components made by Xiongmai (a.k.a. <strong>Hangzhou Xiongmai Technology Co., Ltd.</strong>) and a handful of other Chinese tech firms that seemed to have a history of placing product market share and price above security.</p>
<p>Since then, two of those firms &#8212; <strong>Huawei</strong> and <strong>Dahua</strong> &#8212; have taken steps to increase the security of their IoT products out-of-the-box. But Xiongmai &#8212; despite repeated warnings from researchers about deep-seated vulnerabilities in its hardware &#8212; has continued to ignore such warnings and to ship massively insecure hardware and software for use in products that are white-labeled and sold by more than 100 third-party vendors.</p>
<p>On Tuesday, Austrian security firm <a href="https://www.sec-consult.com/en/" target="_blank" rel="noopener">SEC Consult</a> released the results of extensive research into multiple, lingering and serious security holes in Xiongmai&#8217;s hardware.</p>
<p>SEC Consult said it began the process of working with Xiongmai on these problems back in March 2018, but that it finally published its research after it became clear that Xiongmai wasn&#8217;t going to address any of the problems.</p>
<p>&#8220;Although Xiongmai had seven months notice, they have not fixed any of the issues,&#8221; the researchers wrote in a blog post published today. &#8220;The conversation with them over the past months has shown that security is just not a priority to them at all.&#8221;</p>
<p>Xiongmai did not respond to requests for comment.</p>
<h4>PROBLEM TO PROBLEM</h4>
<p>A core part of the problem is the peer-to-peer (P2P) communications component called &#8220;<strong>XMEye</strong>&#8221; that ships with all Xiongmai devices and automatically connects them to a cloud network run by Xiongmai. The P2P feature is designed so that consumers can access their DVRs or security cameras remotely anywhere in the world and without having to configure anything.</p>
<div id="attachment_45350" style="width: 605px" class="wp-caption aligncenter"><img class=" wp-image-45350" src="media/a530783f.xmeyesolutions.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/xmeyesolutions.png" alt="" width="595" height="262" /><p class="wp-caption-text">The various business lines of Xiongmai. Source: xiongmaitech.com</p></div>
<p>To access a Xiongmai device via the P2P network, one must know the Unique ID (UID) assigned to each device. The UID is essentially derived in an easily reproducible way using the device&#8217;s built-in <a href="https://en.wikipedia.org/wiki/MAC_address" target="_blank" rel="noopener">MAC address</a> (a 16-character string of numbers and letters, such as 68ab8124db83c8db).</p>
<p>Electronics firms are <a href="http://standards-oui.ieee.org/oui.txt" target="_blank" rel="noopener">assigned</a> ranges of MAC address that they may use, but SEC Consult discovered that Xiongmai for some reason actually uses MAC address ranges assigned to a number of other companies, including tech giant <a href="https://www.cisco.com" target="_blank" rel="noopener">Cisco Systems</a>, German printing press maker <a href="https://www.koenig-bauer.com/en/" target="_blank" rel="noopener">Koenig &amp; Bauer AG</a>, and Swiss chemical analysis firm <a href="https://www.metrohm.com/en-us/" target="_blank" rel="noopener">Metrohm AG</a>.</p>
<p>SEC Consult learned that it was trivial to find Xiongmai devices simply by computing all possible ranges of UIDs for each range of MAC addresses, and then scanning Xiongmai&#8217;s public cloud for XMEye-enabled devices. Based on scanning just two percent of the available ranges, SEC Consult conservatively estimates there are around 9 million Xiongmai P2P devices online.</p>
<p>[For the record, KrebsOnSecurity has <a href="https://krebsonsecurity.com/2016/02/this-is-why-people-fear-the-internet-of-things/" target="_blank" rel="noopener">long</a> <a href="https://krebsonsecurity.com/2016/12/researchers-find-fresh-fodder-for-iot-attack-cannons/" target="_blank" rel="noopener">advised</a> buyers of IoT devices to avoid those advertise P2P capabilities for just this reason. The Xiongmai debacle is yet another example of why this remains solid advice].</p>
<h4>BLANK TO BANK</h4>
<p>While one still needs to provide a username and password to remotely access XMEye devices via this method, SEC Consult notes that the default password of the all-powerful administrative user (username &#8220;admin&#8221;) is blank (i.e, no password).</p>
<p>The admin account can be used to do anything to the device, such as changing its settings or uploading software &#8212; including malware like Mirai. And because users are not required to set a secure password in the initial setup phase, it is likely that a large number of devices are accessible via these default credentials.</p>
<div id="attachment_45351" style="width: 543px" class="wp-caption aligncenter"><img class=" wp-image-45351" src="media/be48f589.xiongcam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/xiongcam.png" alt="" width="533" height="582" /><p class="wp-caption-text">The raw, unbranded electronic components of an IP camera produced by Xiongmai.</p></div>
<p>Even if a customer has changed the default admin password, SEC Consult discovered there is an undocumented user with the name &#8220;default,&#8221; whose password is &#8220;tluafed&#8221; (default in reverse). While this user account can&#8217;t change system settings, it is still able to view any video streams.</p>
<p>Normally, hardware devices are secured against unauthorized software updates by requiring that any new software pushed to the devices be digitally signed with a secret cryptographic key that is held only by the hardware or software maker. However, XMEye-enabled devices have no such protections.</p>
<p>In fact, the researchers found it was trivial to set up a system that mimics the XMEye cloud and push malicious firmware updates to any device. Worse still, unlike with the Mirai malware &#8212; which gets permanently wiped from memory when an infected device powers off or is rebooted &#8212; the update method devised by SEC Consult makes it so that any software uploaded survives a reboot.<span id="more-45290"></span></p>
<h4>CAN XIONGMAI REALLY BE THAT BAD?</h4>
<p>In the wake of the Mirai botnet&#8217;s emergence in 2016 and the subsequent record denial-of-service attacks that brought down chunks of the Internet at a time (including this Web site and my DDoS protection provider at times), multiple security firms said Xiongmai&#8217;s insecure products were a huge contributor to the problem.</p>
<p>Among the company&#8217;s strongest critics was New York City-based security firm <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a>, which pointed out that even basic security features built into Xiongmai&#8217;s hardware had completely failed at basic tasks.</p>
<p>For example, Flashpoint&#8217;s analysts discovered that the login page for a camera or DVR running Xiongmai hardware and software could be bypassed just by navigating to a page called “DVR.htm” prior to login.</p>
<p>Flashpoint&#8217;s researchers also found that any changes to passwords for various user accounts accessible via the Web administration page for Xiongmai products did nothing to change passwords for accounts that were hard-coded into these devices and accessible only via more obscure, command-line communications interfaces like Telnet and SSH.</p>
<p>Not long after Xiongmai was publicly shamed for failing to fix obvious security weaknesses that helped contribute to the spread of Mirai and related IoT botnets, Xiongmai <a href="https://krebsonsecurity.com/2016/10/iot-device-maker-vows-product-recall-legal-action-against-western-accusers/" target="_blank" rel="noopener">lashed out at multiple security firms and journalists, promising to sue its critics for defamation</a> (it never followed through on that threat, as far as I can tell).</p>
<p>At the same time, Xiongmai promised that it would be issuing a product recall on millions of devices to ensure they were not deployed with insecure settings and software. But according to Flashpoint&#8217;s <strong>Zach Wikholm</strong>, Xiongmai never followed through with the recall, either. Rather, it was all a way for the company to save face publicly and with its business partners.</p>
<p>&#8220;This company said they were going to do a product recall, but it looks like they never got around to it,&#8221; Wikholm said. &#8220;They were just trying to cover up and keep moving.&#8221;</p>
<p>Wikholm said Flashpoint discovered a number of additional glaring vulnerabilities in Xiongmai&#8217;s hardware and software that left them wide open to takeover by malicious hackers, and that several of those weaknesses still exist in the company&#8217;s core product line.</p>
<p>&#8220;We could have kept releasing our findings, but it just got really difficult to keep doing that because Xiongmai wouldn&#8217;t fix them and it would only make it easier for people to compromise these devices,&#8221; Wikholm said.</p>
<p>The Flashpoint analyst said he believes SEC Consult&#8217;s estimates of the number of vulnerable Xiongmai devices to be extremely conservative.</p>
<p>&#8220;Nine million devices sounds quite low because these guys hold 25 percent of the world&#8217;s DVR market,&#8221; to say nothing of the company&#8217;s share in the market for cheapo IP cameras, Wikholm said.</p>
<p>What&#8217;s more, he said, Xiongmai has turned a deaf ear to reports about dangerous security holes across its product lines principally because it doesn&#8217;t answer directly to customers who purchase the gear.</p>
<p>&#8220;The only reason they&#8217;ve maintained this level of [not caring] is they&#8217;ve been in this market for a long time and established very strong regional sales channels to dozens of third-party companies,&#8221; that ultimately rebrand Xiongmai&#8217;s products as their own, he said.</p>
<p>Also, the typical consumer of cheap electronics powered by Xiongmai&#8217;s kit don&#8217;t really care how easily these devices can be commandeered by cybercriminals, Wikholm observed.</p>
<p>&#8220;They just want a security system around their house or business that doesn&#8217;t cost an arm and leg, and Xiongmai is by far the biggest player in that space,&#8221; he said. &#8220;Most companies at least have some sort of incentive to make things better when faced with public pressure. But they don&#8217;t seem to have that drive.&#8221;</p>
<h4>A PHANTOM MENACE</h4>
<p>SEC Consult concluded its technical advisory about the security flaws by saying Xiongmai &#8220;<em>does not provide any mitigations and hence it is recommended not to use any products associated with the XMeye P2P Cloud until all of the identified security issues have been fixed and a thorough security analysis has been performed by professionals.&#8221;</em></p>
<p>While this may sound easy enough, acting on that advice is difficult in practice because very few devices made with Xiongmai&#8217;s deeply flawed hardware and software advertise that fact on the label or product name. Rather, the components that Xiongmai makes are sold downstream to vendors who then use it in their own products and slap on a label with their own brand name.</p>
<p>How many vendors? It&#8217;s difficult to say for sure, but a search on the term XMEye via the e-commerce sites where Xiongmai&#8217;s white-labeled products typically are sold (Amazon, Aliexpress.com, Homedepot.com and Walmart) reveals more than 100 companies that you&#8217;ve probably never heard of which brand Xionmai&#8217;s hardware and software as their own.  That list is available <a href="media/172422ae.XiongmaiResellers.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/XiongmaiResellers.pdf" target="_blank" rel="noopener">here</a> (PDF) and is also pasted at the conclusion of this post for the benefit of search engines.</p>
<p>SEC Consult&#8217;s technical advisory about their findings lists a number of indicators that system and network administrators can use to quickly determine whether any of these vulnerable P2P Xiongmai devices happen to be on your network.</p>
<p>For end users concerned about this, one way of fingerprinting Xiongmai devices is to search Amazon.com, aliexpress.com, walmart.com and other online merchants for the brand on the side of your device and the term &#8220;XMEye.&#8221; If you get a hit, chances are excellent you&#8217;ve got a device built on Xionmai&#8217;s technology.</p>
<p>Another option: open a browser and navigate to the local Internet address of your device. If you have one of these devices on your local network, the login page should look like the one below:</p>
<div id="attachment_45347" style="width: 604px" class="wp-caption aligncenter"><img class=" wp-image-45347" src="media/adddccbd.xiongmailogin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/xiongmailogin.png" alt="" width="594" height="238" /><p class="wp-caption-text">The administrative login screen for IoT devices powered by Xiongmai&#8217;s software and hardware.</p></div>
<p>Another giveaway on virtually all Xiongmai devices is pasting &#8220;http://IP/err.htm&#8221; into a browser address bar should display the following error message (where IP= the local IP address of the device):</p>
<div id="attachment_45352" style="width: 596px" class="wp-caption aligncenter"><img class="wp-image-45352" src="media/9612b237.xmerror.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/xmerror.png" alt="" width="586" height="259" /><p class="wp-caption-text">Ironically, even the error page for Xiongmai devices contains errors.</p></div>
<p>According to SEC Consult, Xiongmai&#8217;s electronics and hardware make up the guts of IP cameras and DVRs marketed and sold under the company names below.</p>
<p>What&#8217;s most remarkable about many of the companies listed below is that about half of them don&#8217;t even have their own Web sites, and instead simply rely on direct-to-consumer product listings at Amazon.com or other e-commerce outlets. Among those that do sell Xiongmai&#8217;s products directly via the Web, very few of them seem to even offer secure (https://) Web sites.</p>
<p>SEC Consult&#8217;s <a href="https://r.sec-consult.com/xmeye" target="_blank" rel="noopener">blog post</a> about their findings has more technical details, as does <a href="https://sec-consult.com/en/blog/advisories/vulnerabilities-xiongmai-ip-cameras-nvrs-dvrs-cve-2018-17915-cve-2018-17917-cve-2018-17919/" target="_blank" rel="noopener">the security advisory</a> they released today.</p>
<p>Here&#8217;s the current list of companies that white label Xiongmai&#8217;s insecure products, according to SEC Consult:</p>
<p>9Trading<br />
Abowone<br />
AHWVSE<br />
ANRAN<br />
ASECAM<br />
Autoeye<br />
AZISHN<br />
A-ZONE<br />
BESDER/BESDERSEC<br />
BESSKY<br />
Bestmo<br />
BFMore<br />
BOAVISION<br />
BULWARK<br />
CANAVIS<br />
CWH<br />
DAGRO<br />
datocctv<br />
DEFEWAY<br />
digoo<br />
DiySecurityCameraWorld<br />
DONPHIA<br />
ENKLOV<br />
ESAMACT<br />
ESCAM<br />
EVTEVISION<br />
Fayele<br />
FLOUREON<br />
Funi<br />
GADINAN<br />
GARUNK<br />
HAMROL<br />
HAMROLTE<br />
Highfly<br />
Hiseeu<br />
HISVISION<br />
HMQC<br />
IHOMEGUARD<br />
ISSEUSEE<br />
iTooner<br />
JENNOV<br />
Jooan<br />
Jshida<br />
JUESENWDM<br />
JUFENG<br />
JZTEK<br />
KERUI<br />
KKMOON<br />
KONLEN<br />
Kopda<br />
Lenyes<br />
LESHP<br />
LEVCOECAM<br />
LINGSEE<br />
LOOSAFE<br />
MIEBUL<br />
MISECU<br />
Nextrend<br />
OEM<br />
OLOEY<br />
OUERTECH<br />
QNTSQ<br />
SACAM<br />
SANNCE<br />
SANSCO<br />
SecTec<br />
Shell film<br />
Sifvision/sifsecurityvision<br />
smar<br />
SMTSEC<br />
SSICON<br />
SUNBA<br />
Sunivision<br />
Susikum<br />
TECBOX<br />
Techage<br />
Techege<br />
TianAnXun<br />
TMEZON<br />
TVPSii<br />
Unique Vision<br />
unitoptek<br />
USAFEQLO<br />
VOLDRELI<br />
Westmile<br />
Westshine<br />
Wistino<br />
Witrue<br />
WNK Security Technology<br />
WOFEA<br />
WOSHIJIA<br />
WUSONLUSAN<br />
XIAO MA<br />
XinAnX<br />
xloongx<br />
YiiSPO<br />
YUCHENG<br />
YUNSYE<br />
zclever<br />
zilnk<br />
ZJUXIN<br />
zmodo<br />
ZRHUNTER</p>


feed_id: https://krebsonsecurity.com/?p=45380
title: Patch Tuesday, October 2018 Edition
uri: Patch-Tuesday-October-2018-Edition
url: https://krebsonsecurity.com/2018/10/patch-tuesday-october-2018-edition/
content:
<p><strong>Microsoft</strong> this week released software updates to fix roughly 50 security problems with various versions of its <strong>Windows</strong> operating system and related software, including one flaw that is already being exploited and another for which exploit code is publicly available.</p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />The zero-day bug &#8212; <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8453" target="_blank" rel="noopener">CVE-2018-8453</a> &#8212; affects Windows versions 7, 8.1, 10 and Server 2008, 2012, 2016 and 2019. According to security firm <strong>Ivanti</strong>, an attacker first needs to log into the operating system, but then can exploit this vulnerability to gain administrator privileges.</p>
<p>Another vulnerability patched on Tuesday &#8212; <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8423" target="_blank" rel="noopener">CVE-2018-8423</a> &#8212; was publicly disclosed last month along with sample exploit code. This flaw involves a component shipped on all Windows machines and used by a number of programs, and could be exploited by getting a user to open a specially-crafted file &#8212; such as a booby-trapped <strong>Microsoft Office</strong> document.</p>
<p>KrebsOnSecurity has frequently suggested that Windows users wait a day or two after Microsoft releases monthly security updates before installing the fixes, with the rational that occasionally buggy patches can cause serious headaches for users who install them before all the kinks are worked out.</p>
<p>This month, Microsoft briefly paused updates for Windows 10 users after many users reported losing all of the files in their &#8220;My Documents&#8221; folder. The worst part? Rolling back to previous saved versions of Windows prior to the update did not restore the files.<span id="more-45380"></span></p>
<p>Microsoft appears to have since fixed the issue, but these kinds of incidents illustrate the value of not only waiting a day or two to install updates but also manually backing up your data prior to installing patches (i.e., not just simply counting on Microsoft&#8217;s System Restore feature to save the day should things go haywire).</p>
<p>Mercifully, <strong>Adobe</strong> has spared us an update this month for its <strong>Flash Player</strong> software, although it has shipped a non-security update for Flash.</p>
<p>For more on this month&#8217;s Patch Tuesday batch, check out posts from <a href="https://www.ivanti.com/blog/october-patch-tuesday-2018" target="_blank" rel="noopener">Ivanti</a> and <a href="https://blog.qualys.com/laws-of-vulnerabilities/2018/10/09/october-2018-patch-tuesday-49-vulns-critical-browser-patches-hyper-v-adobe-vulns" target="_blank" rel="noopener">Qualys</a>.</p>
<p>As always, if you experience any issues installing any of these patches this month, please feel free to leave a comment about it below; there&#8217;s a good chance other readers have experienced the same and may even chime in here with some helpful tips. My apologies for the tardiness of this post; I have been traveling in Australia this past week with only sporadic access to the Internet.</p>


feed_id: https://krebsonsecurity.com/?p=45356
title: Supply Chain Security 101: An Expert’s View
uri: Supply-Chain-Security-101-An-Expert-s-View
url: https://krebsonsecurity.com/2018/10/supply-chain-security-101-an-experts-view/
content:
<p>Earlier this month I spoke at a <a href="https://symposium.greycastlesecurity.com/2018/" target="_blank" rel="noopener">cybersecurity conference in Albany, N.Y.</a> alongside <strong>Tony Sager</strong>, senior vice president and chief evangelist at the <a href="https://www.cisecurity.org/" target="_blank" rel="noopener">Center for Internet Security</a> and a former bug hunter at the <strong>U.S. National Security Agency</strong>. We talked at length about many issues, including supply chain security, and I asked Sager whether he&#8217;d heard anything about rumors that <strong>Supermicro</strong> &#8212; a high tech firm in San Jose, Calif. &#8212; had allegedly inserted hardware backdoors in technology sold to a number of American companies.</p>
<div id="attachment_45392" style="width: 271px" class="wp-caption alignright"><img class=" wp-image-45392" src="media/f4edcf11.tonysager.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/tonysager.png" alt="" width="261" height="281" /><p class="wp-caption-text">Tony Sager, senior vice president and chief evangelist at the <strong>Center for Internet Security.</strong></p></div>
<p>The event Sager and I spoke at was prior to the publication of <em>Bloomberg Businessweek</em>&#8216;s <a href="https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies?srnd=businessweek-v2" target="_blank" rel="noopener">controversial story</a> alleging that Supermicro had duped almost 30 companies into buying backdoored hardware. Sager said he hadn&#8217;t heard anything about Supermicro specifically, but we chatted at length about the <a href="https://krebsonsecurity.com/2018/10/supply-chain-security-is-the-whole-enchilada-but-whos-willing-to-pay-for-it/" target="_blank" rel="noopener">challenges of policing the technology supply chain</a>.</p>
<p>Below are some excerpts from our conversation. I learned quite bit, and I hope you will, too.</p>
<p><strong>Brian Krebs (BK):</strong> Do you think Uncle Sam spends enough time focusing on the supply chain security problem? It seems like a pretty big threat, but also one that is really hard to counter.</p>
<p class="p1"><span class="s1"><b>Tony Sager (TS):</b> The federal government has been worrying about this kind of problem for decades. In the 70s and 80s, the government was more dominant in the technology industry and didn&#8217;t have this massive internationalization of the technology supply chain.</span></p>
<p class="p1"><span class="s1">But even then there were people who saw where this was all going, and there were some pretty big government programs to look into it.</span></p>
<p class="p1"><span class="s1"><b>BK:</b> Right, the <a href="https://en.wikipedia.org/wiki/Trusted_Foundry_Program"><span class="s2">Trusted Foundry</span></a> program I guess is a good example.</span></p>
<p class="p1"><span class="s1"><b>TS:</b> Exactly. That was an attempt to help support a U.S.-based technology industry so that we had an indigenous place to work with, and where we have only cleared people and total control over the processes and parts.</span></p>
<p class="p1"><span class="s1"><b>BK:</b> Why do you think more companies aren&#8217;t insisting on producing stuff through code and hardware foundries here in the U.S.?</span></p>
<p class="p1"><span class="s1"><b>TS:</b> Like a lot of things in security, the economics always win. And eventually the cost differential for offshoring parts and labor overwhelmed attempts at managing that challenge.</span></p>
<p class="p1"><span class="s1"><b>BK:</b> But certainly there are some areas of computer hardware and network design where you absolutely must have far greater integrity assurance?</span></p>
<p class="p1"><span class="s1"><b>TS:</b> Right, and this is how they approach things at <a href="https://en.wikipedia.org/wiki/Sandia_National_Laboratories"><span class="s2">Sandia National Laboratories</span></a> [one of three national nuclear security research and development laboratories]. One of the things they&#8217;ve looked at is this whole business of whether someone might sneak something into the design of a nuclear weapon.</span></p>
<p class="p1"><span class="s1">The basic design principle has been to assume that one person in the process may have been subverted somehow, and the whole design philosophy is built around making sure that no one person gets to sign off on what goes into a particular process, and that there is never unobserved control over any one aspect of the system. So, there are a lot of technical and procedural controls there.</span></p>
<p class="p1"><span class="s1">But the bottom line is that doing this is really much harder [for non-nuclear electronic components] because of all the offshoring now of electronic parts, as well as the software that runs on top of that hardware.</span></p>
<p class="p1"><span class="s1"><b>BK:</b> So is the government basically only interested in supply chain security so long as it affects stuff they want to buy and use?</span></p>
<p class="p1"><span class="s1"><b>TS:</b> The government still has regular meetings on supply chain risk management, but there are no easy answers to this problem. The technical ability to detect something wrong has been outpaced by the ability to do something about it.</span></p>
<p class="p1"><span class="s1"><b>BK:</b> Wait&#8230;what?</span></p>
<p class="p1"><span class="s1"><b>TS:</b> Suppose a nation state dominates a piece of technology and in theory could plant something inside of it. The attacker in this case has a risk model, too. Yes, he could put something in the circuitry or design, but his risk of exposure also goes up.</span></p>
<p class="p1"><span class="s1">Could I as an attacker control components that go into certain designs or products? Sure, but it&#8217;s often not very clear what the target is for that product, or how you will guarantee it gets used by your target. And there are still a limited set of bad guys who can pull that stuff off. In the past, it&#8217;s been much more lucrative for the attacker to attack the supply chain on the distribution side, to go after targeted machines in targeted markets to lessen the exposure of this activity.</span></p>
<p class="p1"><span class="s1"><b>BK:</b> So targeting your attack becomes problematic if you&#8217;re not really limiting the scope of targets that get hit with compromised hardware.</span></p>
<p class="p1"><span class="s1"><b>TS:</b> Yes, you can put something into everything, but all of a sudden you have this massive big data collection problem on the back end where you as the attacker have created a different kind of analysis problem. Of course, some nations have more capability than others to sift through huge amounts of data they&#8217;re collecting.</span></p>
<p class="p1"><span class="s1"><b>BK:</b> Can you talk about some of the things the government has typically done to figure out whether a given technology supplier might be trying to slip in a few compromised devices among an order of many?</span></p>
<p class="p1"><span class="s1"><b>TS:</b> There&#8217;s this concept of the &#8220;blind buy,&#8221; where if you think the threat vector is someone gets into my supply chain and subverts the security of individual machines or groups of machines, the government figures out a way to purchase specific systems so that no one can target them. In other words, the seller doesn&#8217;t know it&#8217;s the government who&#8217;s buying it. This is a pretty standard technique to get past this, but it&#8217;s an ongoing cat and mouse game to be sure.</span><span id="more-45356"></span></p>
<p class="p1"><span class="s1"><b>BK:</b> I know you said before this interview that you weren&#8217;t prepared to comment on the specific claims in the recent Bloomberg article, but it does seem that supply chain attacks targeting cloud providers could be very attractive for an attacker. Can you talk about how the big cloud providers could mitigate the threat of incorporating factory-compromised hardware into their operations?</span></p>
<p class="p1"><span class="s1"><b>TS:</b> It&#8217;s certainly a natural place to attack, but it&#8217;s also a complicated place to attack &#8212; particularly the very nature of the cloud, which is many tenants on one machine. If you&#8217;re attacking a target with on-premise technology, that&#8217;s pretty simple. But the purpose of the cloud is to abstract machines and make more efficient use of the same resources, so that there could be many users on a given machine. So how do you target that in a supply chain attack?</span></p>
<p class="p1"><span class="s1"><b>BK:</b> Is there anything about the way these cloud-based companies operate&#8230;.maybe just sheer scale&#8230;that makes them perhaps uniquely more resilient to supply chain attacks vis-a-vis companies in other industries?</span></p>
<p class="p1"><span class="s1"><b>TS:</b> That&#8217;s a great question. The counter positive trend is that in order to get the kind of speed and scale that the Googles and Amazons and Microsofts of the world want and need, these companies are far less inclined now to just take off-the-shelf hardware and they&#8217;re actually now more inclined to build their own.</span></p>
<p class="p1"><span class="s1"><b>BK:</b> Can you give some examples?</span></p>
<p class="p1"><span class="s1"><b>TS:</b> There&#8217;s a fair amount of discussion among these cloud providers about commonalities &#8212; what parts of design could they cooperate on so there&#8217;s a marketplace for all of them to draw upon. And so we&#8217;re starting to see a real shift from off-the-shelf components to things that the service provider is either designing or pretty closely involved in the design, and so they can also build in security controls for that hardware. Now, if you&#8217;re counting on people to exactly implement designs, you have a different problem. But these are really complex technologies, so it&#8217;s non-trivial to insert backdoors. It gets harder and harder to hide those kinds of things.</span></p>
<p class="p1"><span class="s1"><b>BK:</b> That&#8217;s interesting, given how much each of us have tied up in various cloud platforms. Are there other examples of how the cloud providers can make it harder for attackers who might seek to subvert their services through supply chain shenanigans?</span></p>
<p class="p1"><span class="s1"><b>TS:</b> One factor is they&#8217;re rolling this technology out fairly regularly, and on top of that the shelf life of technology for these cloud providers is now a very small number of years. They all want faster, more efficient, powerful hardware, and a dynamic environment is much harder to attack. This actually turns out to be a very expensive problem for the attacker because it might have taken them a year to get that foothold, but in a lot of cases the short shelf life of this technology [with the cloud providers] is really raising the costs for the attackers.</span></p>
<p class="p1"><span class="s1">When I looked at what Amazon and Google and Microsoft are pushing for it&#8217;s really a lot of horsepower going into the architecture and designs that support that service model, including the building in of more and more security right up front. Yes, they&#8217;re still making lots of use of non-U.S. made parts, but they&#8217;re really aware of that when they do. That doesn&#8217;t mean these kinds of supply chain attacks are impossible to pull off, but by the same token they don&#8217;t get easier with time.</span></p>
<p class="p1"><span class="s1"><strong>BK:</strong> It seems to me that the majority of the government’s efforts to help secure the tech supply chain come in the form of looking for counterfeit products that might somehow wind up in tanks and ships and planes and cause problems there — as opposed to using that microscope to look at commercial technology. Do you think that’s accurate?</span></p>
<p class="p1"><span class="s1"><strong>TS:</strong> I think that&#8217;s a fair characterization. It’s a logistical issue. This problem of counterfeits is a related problem. Transparency is one general design philosophy. Another is accountability and traceability back to a source. There’s this buzzphrase that if you can&#8217;t build in security then build in accountability. Basically the notion there was you often can&#8217;t build in the best or perfect security, but if you can build in accountability and traceability, that&#8217;s a pretty powerful deterrent as well as a necessary aid.</span></p>
<p class="p1"><span class="s1"><strong>BK:</strong> For example….?</span></p>
<p class="p1"><span class="s1"><strong>TS:</strong> Well, there’s this emphasis on high quality and unchangeable logging. If you can build strong accountability that if something goes wrong I can trace it back to who caused that, I can trace it back far enough to make the problem more technically difficult for the attacker. Once I know I can trace back the construction of a computer board to a certain place, you’ve built a different kind of security challenge for the attacker. So the notion there is while you may not be able to prevent every attack, this causes the attacker different kinds of difficulties, which is good news for the defense. </span></p>
<p class="p1"><span class="s1"><strong>BK:</strong> So is supply chain security more of a physical security or cybersecurity problem?</span></p>
<p class="p1"><span class="s1"><strong>TS:</strong> We like to think of this as we’re fighting in cyber all the time, but often that’s not true. If you can force attackers to subvert your supply chain, they you first off take away the mid-level criminal elements and you force the attackers to do things that are outside the cyber domain, such as set up front companies, bribe humans, etc. And in those domains — particularly the human dimension — we have other mechanisms that are detectors of activity there. </span></p>
<p class="p1"><span class="s1"><strong>BK:</strong> What role does network monitoring play here? I&#8217;m hearing a lot right now from tech experts who say organizations should be able to detect supply chain compromises because at some point they should be able to see truckloads of data leaving their networks if they&#8217;re doing network monitoring right. What do you think about the role of effective network monitoring in fighting potential supply chain attacks.</span></p>
<p class="p1"><span class="s1"><strong>TS: </strong> I&#8217;m not so optimistic about that. It&#8217;s too easy to hide. Monitoring is about finding anomalies, either in the volume or type of traffic you&#8217;d expect to see. It&#8217;s a hard problem category. For the US government, with perimeter monitoring there&#8217;s always a trade off in the ability to monitor traffic and the natural movement of the entire Internet towards encryption by default. So a lot of things we don&#8217;t get to touch because of tunneling and encryption, and the Department of Defense in particular has really struggled with this. </span></p>
<p class="p1"><span class="s1">Now obviously what you can do is man-in-the-middle traffic with proxies and inspect everything there, and the perimeter of the network is ideally where you’d like to do that, but the speed and volume of the traffic is often just too great. </span></p>
<p class="p1"><span class="s1"><strong>BK:</strong> Isn’t the government already doing this with the “trusted internet connections” or <a href="https://www.dhs.gov/einstein" target="_blank" rel="noopener">Einstein program</a>, where they consolidate all this traffic at the gateways and try to inspect what’s going in and out? </span></p>
<p class="p1"><span class="s1"><strong>TS:</strong> Yes, so they’re creating a highest volume, highest speed problem. To monitor that and to not interrupt traffic you have to have bleeding edge technology to do that, and then handle a ton of it which is already encrypted. If you’re going to try to proxy that, break it out, do the inspection and then re-encrypt the data, a lot of times that’s hard to keep up with technically and speed-wise. </span></p>
<p class="p1"><span class="s1"><strong>BK:</strong> Does that mean it’s a waste of time to do this monitoring at the perimeter? </span></p>
<p class="p1"><span class="s1"><strong>TS:</strong> No. The initial foothold by the attacker could have easily been via a legitimate tunnel and someone took over an account inside the enterprise. The real meaning of a particular stream of packets coming through the perimeter you may not know until that thing gets through and executes. So you can’t solve every problem at the perimeter. Some things only because obvious and make sense to catch them when they open up at the desktop. </span></p>
<p class="p1"><span class="s1"><strong>BK:</strong> Do you see any parallels between the challenges of securing the supply chain and the challenges of getting companies to secure <strong>Internet of Things</strong> (IoT) devices so that they don’t continue to become a national security threat for just about any critical infrastructure, such as with DDoS attacks like we’ve seen over the past few years? </span></p>
<p class="p1"><span class="s1"><strong>TS:</strong> Absolutely, and again the economics of security are so compelling. With IoT we have the cheapest possible parts, devices with a relatively short life span and it’s interesting to hear people talking about regulation around IoT. But a lot of the discussion I’ve heard recently does not revolve around top-down solutions but more like how do we learn from places like the <strong>Food and Drug Administration</strong> about certification of medical devices. In other words, are there known characteristics that we would like to see these devices put through before they become in some generic sense safe. </span></p>
<p class="p1"><span class="s1"><strong>BK:</strong> How much of addressing the IoT and supply chain problems is about being able to look at the code that powers the hardware and finding the vulnerabilities there? Where does accountability come in?</span></p>
<p class="p1"><span class="s1"><strong>TS:</strong> I used to look at other peoples’ software for a living and find zero-day bugs. What I realized was that our ability to find things as human beings with limited technology was never going to solve the problem. The deterrent effect that people believed someone was inspecting their software usually got more positive results than the actual looking. If they were going to make a mistake &#8211; deliberately or otherwise — they would have to work hard at it and if there was some method of transparency, us finding the one or two and making a big deal of it when we did was often enough of a deterrent. </span></p>
<p class="p1"><span class="s1"><strong>BK:</strong> Sounds like an approach that would work well to help us feel better about the security and code inside of these election machines that have become the subject of so much intense scrutiny of late.</span></p>
<p class="p1"><span class="s1"><strong>TS:</strong> We’re definitely going through this now in thinking about the election devices. We’re kind of going through this classic argument where hackers are carrying the noble flag of truth and vendors are hunkering down on liability. So some of the vendors seem willing to do something different, but at the same time they&#8217;re kind of trapped now by the good intentions of open vulnerability community. </span></p>
<p class="p1"><span class="s1">The question is, how do we bring some level of transparency to the process, but probably short of vendors exposing their trade secrets and the code to the world? What is it that they can demonstrate in terms of cost effectiveness of development practices to scrub out some of the problems before they get out there. This is important, because elections need one outcome: Public confidence in the outcome. And of course, one way to do that is through greater transparency.</span></p>
<p class="p1"><span class="s1"><strong>BK:</strong> What, if anything, are the takeaways for the average user here? With the proliferation of IoT devices in consumer homes, is there any hope that we&#8217;ll see more tools that help people gain more control over how these systems are behaving on the local network? </span></p>
<p class="p1"><span class="s1"><strong>TS:</strong> Most of [the supply chain problem] is outside the individual&#8217;s ability to do anything about, and beyond ability of small businesses to grapple with this. It&#8217;s in fact outside of the autonomy of the average company to figure it out. We do need more national focus on the problem. </span></p>
<p class="p1"><span class="s1">It&#8217;s n</span><span class="s1">ow almost impossible to for consumers to buy electronics stuff that isn&#8217;t Internet-connected. The chipsets are so cheap and the ability for every device to have its own Wi-Fi chip built in means that [manufacturers] are adding them whether it makes sense to or not. I think we&#8217;ll see more security coming into the marketplace to manage devices. So for example you might define rules that say appliances can talk to the manufacturer only. </span></p>
<p class="p1"><span class="s1">We&#8217;re going to see more easy-to-use tools available to consumers to help manage all these devices. We&#8217;re starting to see the fight for dominance in this space already at the home gateway and network management level. As these devices get more numerous and complicated, there will be more consumer oriented ways to manage them. Some of the broadband providers already offer services that will tell what devices are operating in your home and let users control when those various devices are allowed to talk to the Internet.</span></p>
<hr />
<p>Since Bloomberg&#8217;s story broke, The <strong>U.S. Department of Homeland Security</strong> and the <strong>National Cyber Security Centre</strong>, a unit of Britain’s eavesdropping agency, <a href="https://en.wikipedia.org/wiki/Government_Communications_Headquarters" target="_blank" rel="noopener">GCHQ</a>, <a href="https://www.reuters.com/article/us-china-cyber-britain/uk-cyber-security-agency-backs-apple-amazon-china-hack-denials-idUSKCN1MF1DN" target="_blank" rel="noopener">both came out with statements</a> saying they had no reason to doubt <a href="https://www.bloomberg.com/news/articles/2018-10-04/the-big-hack-amazon-apple-supermicro-and-beijing-respond" target="_blank" rel="noopener">vehement denials by <strong>Amazon</strong> and <strong>Apple</strong></a> that they were affected by any incidents involving Supermicro&#8217;s supply chain security. Apple also penned a <a href="https://twitter.com/reneritchie/status/1049329985968922625" target="_blank" rel="noopener">strongly-worded letter</a> to lawmakers denying claims in the story.</p>
<p>Meanwhile, Bloomberg reporters <a href="https://www.bloomberg.com/news/articles/2018-10-09/new-evidence-of-hacked-supermicro-hardware-found-in-u-s-telecom" target="_blank" rel="noopener">published a follow-up story</a> citing new, on-the-record evidence to back up claims made in their original story.</p>


feed_id: https://krebsonsecurity.com/?p=44783
title: Who Is Agent Tesla?
uri: Who-Is-Agent-Tesla
url: https://krebsonsecurity.com/2018/10/who-is-agent-tesla/
content:
<p>A powerful, easy-to-use password stealing program known as <strong>Agent Tesla</strong> has been infecting computers since 2014, but recently this malware strain has seen a surge in popularity &#8212; attracting more than 6,300 customers who pay monthly fees to license the software. Although Agent Tesla includes a multitude of features designed to help it remain undetected on host computers, the malware&#8217;s apparent creator seems to have done little to hide his real-life identity.</p>
<p>The proprietors of Agent Tesla market their product at <strong>agenttesla-dot-com</strong>, selling access to the software in monthly licenses paid for via bitcoin, for prices ranging from $15 to $69 per month depending on the desired features.</p>
<p><a class="lightbox" href="media/7b093be5.agent-tesla-pricing.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/agent-tesla-pricing.png"><img class="aligncenter wp-image-45417" src="media/7b093be5.agent-tesla-pricing.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/agent-tesla-pricing.png" alt="" width="588" height="336" /></a></p>
<p>The Agent Tesla Web site emphasizes that the software is strictly &#8220;for monitoring your personel [sic] computer.&#8221; The site&#8217;s &#8220;about&#8221; page states that Agent Tesla &#8220;is not a malware. Please, don&#8217;t use for computers which is not access permission.&#8221; To backstop this disclaimer, the site warns that any users caught doing otherwise will have their software licenses revoked and subscriptions canceled.</p>
<p>At the same time, the Agent Tesla Web site and its 24/7 technical support channel (offered via <a href="https://en.wikipedia.org/wiki/Discord_(software)" target="_blank" rel="noopener">Discord</a>) is replete with instances of support personnel instructing users on ways to evade antivirus software detection, use software vulnerabilities to deploy the product, and secretly bundle the program inside of other file types, such as images, text, audio and even <strong>Microsoft Office</strong> files.</p>
<div id="attachment_45418" style="width: 597px" class="wp-caption aligncenter"><a class="lightbox" href="media/2f5a82f1.user-friendly.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/user-friendly.png"><img class="wp-image-45418" src="media/2f5a82f1.user-friendly.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/user-friendly.png" alt="" width="587" height="397" /></a><p class="wp-caption-text">A description of some of the options posted to the Agent Tesla sales Web site.</p></div>
<p>In August 2018, computer security firm LastLine <a href="https://www.lastline.com/labsblog/surge-of-agent-tesla-threat-report/" target="_blank" rel="noopener">said it witnessed a 100 percent increase in Agent Tesla instances</a> detected in the wild over just a three month period.</p>
<p>&#8220;Acting as a fully-functional information stealer, it is capable of extracting credentials from different browsers, mail, and FTP clients,&#8221; LastLine wrote. &#8220;It logs keys and clipboards data, captures screen and video, and performs form-grabbing (Instagram, Twitter, Gmail, Facebook, etc.) attacks.&#8221;</p>
<div id="attachment_45419" style="width: 599px" class="wp-caption aligncenter"><a class="lightbox" href="media/9a75b64a.ateslaoptions.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/ateslaoptions.png"><img class="wp-image-45419" src="media/9a75b64a.ateslaoptions.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/ateslaoptions.png" alt="" width="589" height="326" /></a><p class="wp-caption-text">Most of the options included in Agent Tesla revolve around stealth, persistence, evading security tools, spreading to other computers, or tampering with system settings.</p></div>
<h4>I CAN HAZ TESLA</h4>
<p>The earliest versions of Agent Tesla were made available for free via a Turkish-language <strong>WordPress</strong> site that oddly enough remains online (agenttesla.wordpress-dot-com), although its home page now instructs users to visit the current AgentTesla-dot-com domain. Not long after that WordPress site was erected, its author(s) began charging for the software, accepting payments via a variety of means, including <a href="https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&amp;hosted_button_id=96EVAEPNZ6728" target="_blank" rel="noopener">PayPal</a>, Bitcoin and even wire transfer to several bank accounts in Turkey.</p>
<p><a class="lightbox" href="media/aa954b1e.agenttestla-fb-red.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/agenttestla-fb-red.png"><img class="alignright wp-image-45424" src="media/aa954b1e.agenttestla-fb-red.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/agenttestla-fb-red.png" alt="" width="254" height="264" /></a>Historic WHOIS Web site registration records maintained by <a href="https://www.domaintools.com" target="_blank" rel="noopener">Domaintools.com</a> show that the current domain for the software &#8212; agenttesla-dot-com &#8212; was registered in 2014 to a young man from Antalya, Turkey named <strong>Mustafa can Ozaydin</strong>, and to the email address <strong>mcanozaydin@gmail.com</strong>. Sometime in mid-2016 the site&#8217;s registration records were hidden behind WHOIS privacy services [full disclosure: Domaintools is a previous advertiser on KrebsOnSecurity].</p>
<p>That Gmail address is tied to <a href="https://www.youtube.com/channel/UCzER3hOQTA31t5blFfJ4xzQ" target="_blank" rel="noopener">a Youtube.com account</a> for a Turkish individual by the same name who has uploaded exactly three videos over the past four years. In <a href="https://www.youtube.com/watch?v=26wjwj4S_2o" target="_blank" rel="noopener">one of them</a>, uploaded in October 2017 and titled &#8220;web panel,&#8221; Mr. can Ozaydin demonstrates how to configure a Web site. At around 3:45 in the video, we can see the purpose of this demonstration is to show people one way to install an Agent Tesla control panel to keep track of systems infected with the malware.</p>
<p>Incidentally, the administrator of the 24/7 live support channel for Agent Tesla users at one point instructed customers to view this same video if they were having trouble figuring out how to deploy the control panel.</p>
<p>The profile picture shown in that Youtube account is remarkably similar to the one displayed on the <a href="https://twitter.com/MCanOZAYDIN" target="_blank" rel="noopener">Twitter account &#8220;MCanOZAYDIN</a>.&#8221; This Twitter profile makes no mention of Agent Tesla, but it does state that Mustafa can Ozaydin is an &#8220;information technology specialist&#8221; in Antalya, Turkey.</p>
<p>That Twitter profile also shows up on <a href="https://www.facebook.com/mustafacanozaydin" target="_blank" rel="noopener">a Facebook account for a Mustafa can Ozaydin</a> from Turkey. A <a href="https://www.linkedin.com/in/mustafa-can-%C3%B6zaydin-b2365678/" target="_blank" rel="noopener">LinkedIn profile</a> for a person by the same name from Antalya, Turkey states that Mr. can Ozaydin is currently a &#8220;systems support expert&#8221; for <a href="https://www.linkedin.com/company/memorial-health-group/" target="_blank" rel="noopener">Memorial Healthcare Group</a>, a hospital in Istanbul.</p>
<p>KrebsOnSecurity first reached out for comment to all of these accounts back in August 2018, but received no reply. Repeated attempts to reach those accounts this past week also elicited no response.<span id="more-44783"></span></p>
<h4>MALWARE OR BENIGN REMOTE ACCESS TOOL?</h4>
<p>Many readers here have taken the view that tools like Agent Tesla are functionally no different from more mainstream &#8220;remote administration tools&#8221; like <a href="https://get.gotomypc.com/" target="_blank" rel="noopener">GoToMyPC</a>, <a href="https://www.realvnc.com/en/" target="_blank" rel="noopener">VNC</a>, or <a href="https://www.logmein.com/" target="_blank" rel="noopener">LogMeIn</a>, products that are frequently used by tech support personnel to remotely manage one or more systems to which those personnel legitimately have access rights.</p>
<p>U.S. federal prosecutors, meanwhile, have adopted a different position. Namely, when someone selling a remote administration tool begins instructing customers on how to install the product in ways that are arguably deceptive (such as through the use of software exploits, spam or disguising the tool as another program), the proprietor has crossed a legal line and can be criminally prosecuted under computer misuse laws.</p>
<p>In previous such cases, the prosecution&#8217;s argument has hinged on the procurement of chat logs showing that the software seller knew full well his product was being used to infect computers without the users&#8217; knowledge or permission.</p>
<p>Last week, a Lexington, Ky. man was sentenced to 30 months in federal prison after pleading guilty to conspiracy to unlawfully access computers in connection with his admitted authorship of a remote access tool called <strong>LuminosityLink</strong>.</p>
<p><strong>Colton Grubbs</strong>, 21, <a href="https://krebsonsecurity.com/2018/07/luminositylink-rat-author-pleads-guilty/" target="_blank" rel="noopener">admitted</a> to selling his software for $39.99 apiece to more than 6,000 customers in at least 78 different countries. LuminosityLink allowed his customers to record the keys that victims pressed on their keyboards, spy on victims using their computers’ cameras and microphones, view and download the computers’ files, and steal names and passwords used to access websites.</p>
<p>&#8220;Directly and indirectly, Grubbs offered assistance to his customers on how to use LuminosityLink for unauthorized computer intrusions through posts and group chats on websites such as <a href="https://krebsonsecurity.com/?s=hackforums&amp;x=0&amp;y=0" target="_blank" rel="noopener">HackForums</a>,&#8221; the Justice Department <a href="https://www.justice.gov/usao-edky/pr/stanford-man-sentenced-30-months-computer-intrusion-crimes" target="_blank" rel="noopener">wrote</a> in a press release about the sentencing. Grubbs must also forfeit the proceeds of his crimes, including 114 bitcoin, presently valued at more than $725,000.</p>
<p>Around the time that Grubbs stopped responding to support requests on Hackforums, federal prosecutors were <a href="https://krebsonsecurity.com/2018/02/bot-roundup-avalanche-kronos-nanocore/" target="_blank" rel="noopener">securing a guilty plea</a> against <strong>Taylor Huddleston</strong>, a then 27-year-old programmer from Arkansas who sold the “<strong>NanoCore RAT</strong>.”  Like Grubbs, Huddleston initially pleaded not guilty to computer intrusion charges, arguing that <a href="https://krebsonsecurity.com/2017/04/dual-use-software-criminal-case-not-so-novel/" target="_blank" rel="noopener">he wasn’t responsible for how customers used his products</a>.</p>
<p>That is, until prosecutors presented Skype logs showing that Huddleston routinely helped buyers work out how to use the tools to secretly compromise remote computers. Huddleston is currently serving a 33-month sentence after pleading guilty to selling the NanoCore RAT.</p>


feed_id: https://krebsonsecurity.com/?p=45452
title: Mirai Co-Author Gets 6 Months Confinement, $8.6M in Fines for Rutgers Attacks
uri: Mirai-Co-Author-Gets-6-Months-Confinement-8-6M-in-Fines-for-Rutgers
url:
https://krebsonsecurity.com/2018/10/mirai-co-author-gets-6-months-confinement-8-6m-in-fines-for-rutgers-attacks/

content:
<p>The convicted co-author of the highly disruptive <strong>Mirai</strong> botnet malware strain has been sentenced to 2,500 hours of community service, six months home confinement, and ordered to pay $8.6 million in restitution for repeatedly using Mirai to take down Internet services at <strong>Rutgers University</strong>, his former alma mater.</p>
<div id="attachment_45113" style="width: 257px" class="wp-caption alignright"><img class=" wp-image-45113" src="media/91aee3ad.jha-li.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/jha-li.png" alt="" width="247" height="247" /><p class="wp-caption-text">Paras Jha, in an undated photo from his former LinkedIn profile.</p></div>
<p><strong>Paras Jha,</strong> a 22-year-old computer whiz from Fanwood, N.J., was studying computer science at Rutgers when he developed Mirai along with two other convicted co-conspirators. According to sentencing memo submitted by government prosecutors, in his freshman and sophomore years at Rutgers Jha used a collection of hacked devices to launch at least four <a href="https://en.wikipedia.org/wiki/Denial-of-service_attack" target="_blank" rel="noopener">distributed denial-of-service</a> (DDoS) attacks against the university&#8217;s networks.</p>
<p>Jha told investigators he carried out the attacks not for profit but purely for personal, juvenile reasons: &#8220;He reveled in the uproar caused by the first attack, which he launched to delay upper-classmen registration for an advanced computer science class he wanted to take,&#8221; the government&#8217;s sentencing memo stated. &#8220;The second attack was launched to delay his calculus exam. The last two attacks were motivated in part by the publicity and outrage&#8221; his previous attacks had generated. Jha would later drop out of Rutgers after struggling academically.</p>
<p>In January 2017, almost a year before Jha&#8217;s arrest and guilty plea, KrebsOnSecurity <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank" rel="noopener">identified Jha as the likely co-author of Mirai</a> &#8212; which sprang to notoriety after <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank" rel="noopener">a record-smashing Sept. 2016 attack</a> that sidelined this Web site for nearly four days.</p>
<p>That story posited that Jha, operating under the pseudonyms &#8220;Ogmemes&#8221; and &#8220;OgRichardStallman,&#8221; gave interviews with a local paper in which he taunted Rutgers and encouraged the school to consider purchasing some kind of DDoS protection service to ward off future attacks. At the time, Jha was president and co-founder of <strong>ProTraf Solutions</strong>, a DDoS mitigation firm that provided just such a service.<span id="more-45452"></span></p>
<p>The sentence handed down by a federal judge in Trenton today comes on the heels of Jha&#8217;s <a href="https://krebsonsecurity.com/2018/09/mirai-botnet-authors-avoid-jail-time/" target="_blank" rel="noopener">September 2018 sentencing in an Alaska court</a> for his admitted role in creating, wielding and selling access to Mirai &#8212; malware which enslaves poorly-secured Internet of Things (IoT) devices like security cameras and digital video recorders for use in extremely powerful attacks capable of knocking most Web sites offline.</p>
<p>Prosecutors in the Alaska case said Jha and two co-conspirators did not deserve jail time for their crimes because the trio had cooperated fully with the government and helped investigators with multiple other ongoing cybercrime investigations. The judge in that case agreed, giving Jha and each of his two co-defendants sentences of five years probation, 2,500 hours of community service, and $127,000 in fines.</p>
<p>Prosecutors in Alaska argued that Jha had completely turned over a new leaf, noting that he was once again attending school and had even landed a job at an unnamed cybersecurity company. Sending him to prison, they reasoned, would only disrupt a remarkable transformation for a gifted young man.</p>
<p>However, the punishment meted out today for the Rutgers attack requires Jha to remain sequestered in his parent&#8217;s New Jersey home for the next six months &#8212; with excursions allowed only for medical reasons. The sentence also piles on an additional 2,500 hours of community service. Further, Jha will be on the hook to pay $8.6 million in restitution &#8212; the amount Rutgers estimated it cost the university to respond to Jha&#8217;s attacks.</p>
<p>Jha could not be immediately reached for comment. But his attorney <strong>Robert Stahl</strong> told KrebsOnSecurity today&#8217;s decision by the New Jersey court was &#8220;thoughtful and reasoned.&#8221;</p>
<p>&#8220;The judge noted that Paras&#8217; cooperation has been much more extensive and valuable than any he&#8217;s ever seen while on the bench,&#8221; Stahl said. &#8220;He won&#8217;t be going to back to school right now or to his job.&#8221;</p>
<p>It is likely that Jha&#8217;s creation will outlive his probation and community service. After the Sept. 2016 attack on KrebsOnSecurity and several other targets, Jha and his cohorts <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank" rel="noopener">released the source code for Mirai</a> in a bid to throw investigators off their trail. That action has since spawned legions of copycat Mirai botnets and Mirai malware variants that persist to this day.</p>
<p><strong>Update, Oct. 27, 9;30 am. ET:</strong> A previous version of this story incorrectly stated that the courthouse in Friday&#8217;s sentencing was located in Newark. It was in Trenton. The above copy has been changed.</p>


feed_id: https://krebsonsecurity.com/?p=45292
title: How Do You Fight a $12B Fraud Problem? One Scammer at a Time
uri: How-Do-You-Fight-a-12B-Fraud-Problem-One-Scammer-at-a-Time
url: https://krebsonsecurity.com/2018/10/how-do-you-fight-a-12b-fraud-problem-one-scammer-at-a-time/
content:
<p>The fraudsters behind the often laughable <a href="https://en.wikipedia.org/wiki/Advance-fee_scam" target="_blank" rel="noopener">Nigerian prince email scams</a> have long since branched out into far more serious and lucrative forms of fraud, including account takeovers, phishing, dating scams, and malware deployment. Combating such a multifarious menace can seem daunting, and it calls for concerted efforts to tackle the problem from many different angles. This post examines the work of a large, private group of volunteers dedicated to doing just that.</p>
<p><img class="alignright size-full wp-image-37128" src="media/d6565fd1.athook.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/12/athook.png" alt="" width="194" height="375" />According to the most recent statistics from the <strong>FBI</strong>&#8216;s <a href="https://www.ic3.gov/default.aspx" target="_blank" rel="noopener">Internet Crime Complaint Center</a>, the most costly form of cybercrime stems from a complex type of fraud known as the &#8220;<strong>B</strong>usiness <strong>E</strong>mail <strong>C</strong>ompromise&#8221; or BEC scam. A typical BEC scam involves phony e-mails in which the attacker <a href="https://krebsonsecurity.com/2016/04/fbi-2-3-billion-lost-to-ceo-email-scams/" target="_blank" rel="noopener">spoofs a message from an executive at a company</a> or a <a href="https://krebsonsecurity.com/2017/04/blind-trust-in-email-could-cost-you-your-home/" target="_blank" rel="noopener">real estate escrow firm</a> and tricks someone into wiring funds to the fraudsters.</p>
<p>The FBI says BEC scams <a href="https://www.ic3.gov/media/2018/180712.aspx" target="_blank" rel="noopener">netted thieves more than $12 billion between 2013 and 2018</a>. However, BEC scams succeed thanks to help from a variety of seemingly unrelated types of online fraud &#8212; most especially dating scams. I recently interviewed <strong>Ronnie Tokazowski</strong>, a reverse engineer at New York City-based security firm <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a> and something of an expert on BEC fraud.</p>
<p>Tokazowski is an expert on the subject thanks to his founding in 2015 of the <strong>BEC Mailing List</strong>, a private discussion group comprising more than 530 experts from a cross section of security firms, Internet and email providers and law enforcement agents that is dedicated to making life more difficult for scammers who perpetrate these schemes.</p>
<p>Earlier this month, Tokazowski <a href="https://www.m3aawg.org/Rel-FalkAward-2018" target="_blank" rel="noopener">was given the JD Falk award</a> by the <strong>Messaging Malware Mobile Anti-Abuse Working Group</strong> (M3AAWG) for his efforts in building and growing the BEC List (loyal readers here may recognize the M3AAWG name: KrebsOnSecurity <a href="https://www.m3aawg.org/news/investigative-journalist-brian-krebs-receives-m3aawg-mary-litynski-award-for-protecting-online" target="_blank" rel="noopener">received a different award from M3AAWG in 2014</a>). M3AAWG presents its JD Falk Award annually to recognize &#8220;a project that helps protect the internet and embodies a spirit of volunteerism and community building.&#8221;</p>
<p>Here are some snippets from our conversation:</p>
<p><strong>Brian Krebs (BK)</strong>: You were given the award by M3AAWG in part for your role in starting the BEC mailing list, but more importantly for the list’s subsequent growth and impact on the BEC problem as a whole. Talk about why and how that got started and evolved.</p>
<p><strong>Ronnie Tokazowski (RT): </strong>The why is that there&#8217;s a lot of money being lost to this type of fraud. If you just look at the financial losses across cybercrime &#8212; including ransomware, banking trojans and everything else &#8212; BEC is number one. Something like 63 percent of fraud losses reported to the FBI are related to it.</p>
<p>When we started the list around Christmas of 2015, it was just myself and one FBI agent. When we had our first conference in May 2016, there were about 20 people attending to try to figure out how to tackle all of the individual pieces of this type of fraud.</p>
<p>Fast forward to today, and the group now has about 530 people, we’ve now held three conferences, and collectively the group has directly or indirectly contributed to over 100 arrests for people involved in BEC scams.</p>
<p><strong>BK:</strong> What did you discover as the group began to coalesce?</p>
<p><strong>RT:</strong> As we started getting more and more people involved, we realized BEC was much broader than just phishing emails. These guys actually maintain vast networks of money mules, technical and logistical infrastructure, as well as tons of romance scam accounts that they have to maintain over time.</p>
<p><strong>BK:</strong> I want to ask you more about the romance scam aspect of BEC fraud in just a moment, because that’s one of the most fascinating cogs in this enormous crime machine. But I’m curious about what short-term goals the group set in identifying the individuals behind these extremely lucrative scams?</p>
<p><strong>RT:</strong> We wanted to start a collaboration group to fight BEC, and really a big part of that involved just trying to social engineer the actors and get them to click on links that we could use to find out more about them and where they’re coming from.<span id="more-45292"></span></p>
<p><strong>BK:</strong> And where are they coming from? When I’ve written about BEC scams previously and found most of them trace back to criminals in Nigeria, people often respond that this is just a stereotype, prejudice, or over-generalization. What’s been your experience?</p>
<p><strong>RT:</strong> Right. A lot of people think Nigeria is just a scapegoat. However, when we trace back phone numbers, IP addresses and language usage, the vast majority of that is coming out of Nigeria.</p>
<p><strong>BK:</strong> Why do you think so much of this type of fraud comes out of Nigeria?</p>
<p><strong>RT:</strong> Well, corruption is a big problem there, but also there’s this subculture where doing this type of wire fraud isn’t seen as malicious exactly. There’s not only a lot of poverty there, but also a very strong subculture there to support this type of fraud, and a lot of times these actors justify their actions by seeing it as attacking organizations, and not the people behind those organizations. I think also because they rationalize that individuals who are victimized will ultimately get their money back. But of course in a lot of cases, they don’t.</p>
<p><strong>BK:</strong> Is that why so many of these Nigerian prince, romance and BEC scams aren’t exactly worded in proper English and tend to read kind of funny sometimes?</p>
<p><strong>RT:</strong> While a lot of the scammers are typically from Nigeria, the people doing the actual spamming side typically come from a mix of other countries in the region, including Algeria, Morocco and Tunisia. And it’s interesting looking at these scams from a language perspective, because you have them writing in English that’s also influenced by [people who speak] French and Arabic. So that explains why the emails often are written in poor English whereas to them it seems normal.</p>
<p><strong>BK:</strong> Let’s talk about the romance scams. How does online dating fraud fit into the BEC scam?</p>
<p><strong>RT:</strong> [The fraudsters] will impersonate both men and women who are single, divorced or widowed. But their primary target is female widows who are active on social media sites.</p>
<p><strong>BK:</strong> And in most of these cases the object of the phony affection is what? To create a relationship so that the other person feels comfortable accepting money or moving money on behalf of their significant other, right?</p>
<p><strong>RT:</strong> Yes, they end up being recruited as money mules. Or maybe they’re groomed in order to set up a bank account for their lovers. We’ve dealt with multiple cases where we see a money mule account coming through and then look that person up on social media and quickly able to see they were friends with a clearly fake profile or a profile that we&#8217;ve already identified as a BEC scammer. So there is a very strong tie between these BEC scams and romance scams.</p>
<p><strong>BK:</strong> Are all of the romance scam victims truly unwitting, do you think?</p>
<p><strong>RT:</strong> With the mules who don&#8217;t one hundred percent know what they&#8217;re doing, they might be [susceptible to the suggestion] hey, could you open this account for me. The second type of mule can be on the payroll [of the scam organization] and getting a cut of the money for assisting in the wiring of money [to the fraudsters’ accounts.]</p>
<p><strong>BK:</strong> I saw in <a href="https://twitter.com/iheartmalware" target="_blank" rel="noopener">one of your tweets</a> you mentioned personally interacting with some of these BEC scammers.</p>
<p><strong>RT:</strong> Yeah, a few weeks ago I was running a romance scammer who reached out and added me as a friend on Facebook. The story they were telling was that this person was a single mom with a kid aged 43 looking for companionship. By day 4 [of back and forth conversations] they were asking me to send them iTunes gift cards.</p>
<p><strong>BK:</strong> Hah! So what happened then?</p>
<p><strong>RT:</strong> I went to my local grocery store, which was all too willing to help. When you’re trying to catch scammers, it doesn&#8217;t cost the store a dime to give you non-activated iTunes gift cards.</p>
<p><strong>BK:</strong> That sounds like fun. Beyond scamming the scammers to learn more about their operations and who they are, can you talk about what you and other members of the BEC working group have been trying to accomplish to strategically fight this kind of fraud?</p>
<p><strong>RT:</strong> What we found was with BEC fraud it&#8217;s really hard to find ownership, because there’s no one entity that’s responsible for shutting it down. There are a lot of moving parts to the BEC scam, including lots of romance scam social media accounts, multiple email providers, and bank accounts tied to money mules that get pulled into these scams.</p>
<p>The feds get a lot of flack for not making arrests, the private sector gets criticized for not doing more, and a lot of people are placing the blame on social media for not doing more. But the truth is that in order to address BEC as a whole we all have to work together on that. It’s like the old saying: How do you eat an elephant? One bite at a time.</p>
<p><strong>BK:</strong> So the primary goal of the group was to figure out ways to get better and faster at shutting down the resources used by these fraudsters?</p>
<p><strong>RT:</strong> Correct. The main [focus] we set when starting this group was the sheer length of time it takes for law enforcement to put together a subpoena, which can take up to 30 days to process and get the requested information back that allows you to see who was logged into what account, when and from where. At the same time, these bad actors can stand up a bunch of new accounts each day. So the question was how do we figure out a good way to start whacking the email accounts and moving much faster than the subpoena process allows.</p>
<p>The overall goal of the BEC group has been to put everyone in the same room, [including] social media and email providers and security companies, so that we can attack this problem from all sides at once.</p>
<p><strong>BK:</strong> I see. In other words, making it easier for companies that have a role to play to be proactive in shutting down resources that are used by the BEC scammers.</p>
<p><strong>RT:</strong> Exactly. And so far we have helped to close hundreds of accounts, helped contribute directly or indirectly to dozens of arrests, and prevented millions of dollars in fraud.</p>
<p><strong>BK:</strong> At the same time, this work must feel like a somewhat Sisyphean task. I mean, it costs the bad guys almost nothing to set up new accounts, and there seem to be no limit to the number of people participating in various aspects of these scams.</p>
<p><strong>RT:</strong> That’s true, and even with 530 people from dozens of companies and organizations in this BEC working group now it sometimes doesn’t feel like we’re making enough of an impact. But the way I look at it is for each account we get taken down, that&#8217;s someone&#8217;s father or mother who&#8217;s not being scammed and losing their inheritance to a Nigerian scammer.</p>
<p>The one thing I’m proud of is we’ve now operated for three years and have had very few snafus. It’s been very cool to watch the amount of trust that organizations have put into this group and to be along for the ride there in seeing so many competitors actually working together.</p>
<p>&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8211;</p>
<p>Anyone interested in helping in the fight against BEC fraud and related scams should check out the Web site <a href="https://www.419eater.com/" target="_blank" rel="noopener">419eater.com</a>, which includes a ton of helpful resources for learning more. My favorite section of the site is the <a href="https://www.419eater.com/html/letters.htm" target="_blank" rel="noopener">Letters Archive</a>, which features often hilarious email threads between the scammers and &#8220;scam baiters&#8221; &#8212; volunteers dedicated to stringing the scammers along and exposing them publicly.</p>
<p>Related reading:</p>
<p><a href="http://garwarner.blogspot.com/2018/10/business-email-compromise-putting.html" target="_blank" rel="noopener">Business Email Compromise: Putting a Wisconsin Case Under the Microscope</a></p>
<p><a href="https://krebsonsecurity.com/2013/09/spy-service-exposes-nigerian-yahoo-boys/" target="_blank" rel="noopener">Spy Service Exposes Nigerian Yahoo Boys</a></p>
<p><a href="https://krebsonsecurity.com/2013/09/yahoo-boys-have-419-facebook-friends/" target="_blank" rel="noopener">Yahoo Boys Have 419 Facebook Friends</a></p>
<p><a href="https://krebsonsecurity.com/2018/04/deleted-facebook-cybercrime-groups-had-300000-members/" target="_blank" rel="noopener">Deleted Facebook Cybercrime Groups Had 300,000 Members</a></p>
<p><a href="https://krebsonsecurity.com/2011/04/where-did-that-scammer-get-your-email-address/" target="_blank" rel="noopener">Where Did That Scammer Get Your Email Address?</a></p>


feed_id: https://krebsonsecurity.com/?p=45487
title: Equifax Has Chosen Experian. Wait, What?
uri: Equifax-Has-Chosen-Experian-Wait-What
url: https://krebsonsecurity.com/2018/11/equifax-has-chosen-experian-wait-what/
content:
<p>A year after offering free credit monitoring to all Americans on account of <a href="https://krebsonsecurity.com/?s=equifax+breach&amp;x=0&amp;y=0" target="_blank" rel="noopener">its massive data breach</a> that exposed the personal information of nearly 148 million people, <strong>Equifax</strong> now says it has chosen to extend the offer by turning to a credit monitoring service offered by a top competitor &#8212; <strong>Experian</strong>. And to do that, it will soon be sharing with Experian contact information that affected consumers gave to Equifax in order to sign up for the service.</p>
<p><img class="aligncenter size-full wp-image-45491" src="media/2bab76ed.equiferian.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/equiferian.png" alt="" width="479" height="73" /></p>
<p>The news came in an email Equifax is sending to people who took the company up on its offer for one year of free credit monitoring through its <strong>TrustedID Premier</strong> service.</p>
<p>Here&#8217;s the introduction from that message:</p>
<blockquote><p>&#8220;We recently sent you an email advising you that, until further notice, we would be extending the free TrustedID<sup>®</sup> Premier subscription you enrolled in following the September 7, 2017 cybersecurity incident. We are now pleased to let you know that Equifax has chosen Experian<sup>®</sup>, one of the three nationwide credit bureaus, to provide you with an additional year of free credit monitoring service. This extension is at <strong>no cost to you</strong> , and you will not be asked to provide a credit card number or other payment information. You have <a dir="ltr">until January 31, 2019</a> to enroll in this extension of free credit monitoring through IDnotify<img src="media/05dad574.2122.png" data-original-source="https://s.w.org/images/core/emoji/11/72x72/2122.png" alt="™" class="wp-smiley" style="height: 1em; max-height: 1em;" />, a part of Experian.&#8221;</p></blockquote>
<p>Equifax says it will share the name, address, date of birth, Social Security number and self-provided phone number and email address with Experian for anyone who signed up for its original TrustedID Premier offering. That is, unless those folks affirmatively opt-out of having that information transferred from Equifax to Experian.</p>
<p>But not to worry, Equifax says: Experian already has most of this data.</p>
<p>&#8220;Experian currently has and is using this information (except phone number and email address) in the fulfillment of the Experian file monitoring which is part of your current service with TrustedID Premier,&#8221; Equifax wrote in its email. &#8220;Experian will only use the information Equifax is sharing to confirm your identity and securely enroll you in the Experian product, and will not use it for marketing or solicitation.&#8221;</p>
<p>Even though people who don&#8217;t opt-out of the new IDnotify offer will have their contact information automatically shared with Experian, TrustedID Premier users must still affirmatively enroll in the new program before then end of January 2019 &#8212; the date the TrustedID product expires.</p>
<p>Equifax&#8217;s FAQ on the changes is available <a href="https://www.trustedid.com/premier/faqs_notification_experian.php" target="_blank" rel="noopener">here</a>.<span id="more-45487"></span></p>
<h4>EQUIFERIAN<sup>®</sup>?</h4>
<p>Talk about the <a href="https://krebsonsecurity.com/tag/experian-breach/" target="_blank" rel="noopener">blind</a> leading the <a href="https://krebsonsecurity.com/?s=equifax+breach&amp;x=0&amp;y=0" target="_blank" rel="noopener">blind</a>. It appears that in order to opt-out of the information sharing or enroll in the new Experian program, people will need to click a customized link in the email that Equifax is sending to TrustedID enrollees. I&#8217;m not aware of another method for opting our or signing up, but I&#8217;ve asked Equifax for clarification on that point.</p>
<div id="attachment_45489" style="width: 547px" class="wp-caption aligncenter"><img class="size-full wp-image-45489" src="media/93748793.declineoffer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/declineoffer.png" alt="" width="537" height="693" /><p class="wp-caption-text">Consumers who don&#8217;t want Equifax sharing their phone number and email address with Experian need to opt-out by clicking a link in an email.</p></div>
<p>Fundamentally, I see no problem with people using these credit monitoring services as long as they are free. Credit monitoring services can be useful in helping consumers dig themselves out of the mess caused by identity theft.</p>
<p>The chief danger I see in relying on credit monitoring services to stop identity theft, however, is that these services traditionally have been very good at doing that. As I&#8217;ve written ad nauseum, credit monitoring services are more useful at detecting *when* someone opens a new line of credit in your name. What this means is that while they might let you know when someone has stolen your identity, they&#8217;re not likely to prevent that from occurring in the first place.</p>
<p>The best mechanism for preventing identity thieves from creating and abusing new accounts in your name is to <em>freeze your credit file with Experian, Equifax and <strong>TransUnion</strong></em>. This process is now free for all Americans, and simply blocks potential creditors from viewing your credit file.</p>
<p>Since very few creditors are willing to grant new lines of credit without being able to determine how risky it is to do so, freezing your credit file with the Big Three is a great way to stop all sorts of ID theft shenanigans. I explain in much greater detail how to freeze your files and what&#8217;s involved with that <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener">in this post from September</a>.</p>
<p>Please note that if you haven&#8217;t yet frozen your credit and you&#8217;d like to take advantage of this offer from Equifax/Experian, it&#8217;s a good idea to enroll in the IDnotify first, as it&#8217;s often not possible to enroll in credit monitoring services *after* you&#8217;ve frozen your credit. That said, Equifax&#8217;s FAQ suggests this might not be the case, noting that if your Equifax credit report is frozen, the security freeze will stay in place for people who enroll in the new program.</p>
<p>I imagine this arrangement should help the credit bureaus steer more people away away from freezing their and toward their respective &#8220;<strong>credit lock</strong>&#8221; services, which the bureaus have marketed as just as good as a credit freeze but also easier to use.</p>
<p>All three big bureaus tout their credit lock<strong> </strong>services as an easier and faster alternative to freezes — mainly because these alternatives aren’t as disruptive to their bottom lines. According to a recent post by <a href="https://www.creditkarma.com/id-theft/i/lock-freeze-credit-file/" target="_blank" rel="noopener">CreditKarma.com</a>, consumers can use these services to quickly lock or unlock access to credit inquiries, although some bureaus can take up to 48 hours. In contrast, they can take up to five business days to act on a freeze request, although in my experience the automated freeze process via the bureaus’ freeze sites has been more or less instantaneous (assuming the request actually goes through).</p>
<p>TransUnion and Equifax both offer free credit lock services, while Experian’s is free for 30 days and $19.99 for each additional month. However, TransUnion says those who take advantage of their free lock service agree to receive targeted marketing offers. What’s more, TransUnion also pushes consumers who sign up for its free lock service to subscribe to its “premium” lock services for a monthly fee with a perpetual auto-renewal.</p>
<p>Unsurprisingly, the bureaus’ use of the term credit lock has confused many consumers; this was almost certainly by design. But here’s one basic fact consumers should keep in mind about these lock services: Unlike freezes, locks are not governed by any law, meaning that the credit bureaus can change the terms of these arrangements when and if it suits them to do so.</p>
<p>Did you receive this offer from Equifax/Experian? Are you planning to opt out or enroll? Sound off in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=45481
title: SMS Phishing + Cardless ATM = Profit
uri: SMS-Phishing-Cardless-ATM-Profit
url: https://krebsonsecurity.com/2018/11/sms-phishing-cardless-atm-profit/
content:
<p>Thieves are combining SMS-based phishing attacks with new &#8220;cardless&#8221; ATMs to rapidly convert phished bank account credentials into cash. Recent arrests in Ohio shed light on how this scam works.</p>
<p>A number of financial institutions are now offering cardless ATM transactions that allow customers to withdraw cash using nothing more than their mobile phones. But this also creates an avenue of fraud for bad guys, who can leverage phished or stolen account credentials to add a new phone number to the customer&#8217;s account and then use that added device to siphon cash from hijacked accounts at cardless ATMs.</p>
<div id="attachment_45511" style="width: 602px" class="wp-caption aligncenter"><img class=" wp-image-45511" src="media/80da6cfc.cardlessatm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/cardlessatm.png" alt="" width="592" height="226" /><p class="wp-caption-text">Image: Mastercard.us</p></div>
<p>In May 2018, Cincinnati, Ohio-based financial institution <a href="https://www.53.com/content/fifth-third/en.html" target="_blank" rel="noopener">Fifth Third Bank</a> began hearing complaints from customers who were receiving text messages on their phones that claimed to be from the bank, warning recipients that their accounts had been locked.</p>
<p>The text messages contained a link to unlock their accounts and led customers to a Web site that mimicked the legitimate Fifth Third site. That phishing site prompted visitors to enter their account credentials &#8212; including usernames, passwords, one-time passcodes and PIN numbers &#8212; to unlock their accounts.</p>
<p>All told, that scam netted credentials for approximately 125 Fifth Third customers &#8212; most of them in or around the Cincinnati area. The crooks then used the phished data to withdraw $68,000 from 17 ATMs in Illinois, Michigan, and Ohio in less than two weeks using Fifth Third&#8217;s cardless ATM function.</p>
<p>According to court documents, the SMS phishing and fraudulent withdrawals at cardless ATMs continued through October 2018, earning the scammers an additional $40,000. That is, until the bank zeroed in on four individuals suspected of perpetrating the crime spree. Shortly thereafter, four men were arrested in connection with the crimes.<span id="more-45481"></span></p>
<p>One of them, identified as <strong>Ciprian-Raducu Antoche-Grecu</strong>, was apprehended in a Cincinnati suburb <a href="https://www.gannett-cdn.com/presto/2018/11/01/PCIN/ef8cece1-0694-46b0-b571-053c9f537467-atm.png?width=534&amp;height=401&amp;fit=bounds&amp;auto=webp" target="_blank" rel="noopener">while standing at the same Fifth Third ATM where he was previously observed conducting fraudulent activity</a>, investigators allege.</p>
<p>In January 2017, KrebsOnSecurity told the story of a California woman who <a href="https://krebsonsecurity.com/2017/01/stolen-passwords-fuel-cardless-atm-fraud/" target="_blank" rel="noopener">saw nearly $3,000 drained from her account via a cardless ATM</a> operated by Chase Bank. In that incident, the thieves didn&#8217;t even need to know her ATM PIN; the thieves were able to use a phone number and mobile device they controlled and associate it with her Chase account simply by supplying her username and password.</p>
<div id="attachment_45510" style="width: 593px" class="wp-caption aligncenter"><a class="lightbox" href="media/f452f186.cardless-mc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/cardless-mc.png"><img class="wp-image-45510" src="media/f452f186.cardless-mc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/cardless-mc.png" alt="" width="583" height="263" /></a><p class="wp-caption-text">A graphic from Mastercard touting the potential benefits of cardless ATM transactions.</p></div>
<p>As the January 2017 story illustrates, cardless ATM scams aren&#8217;t new, but they are becoming more prevalent as more banks turn to cardless ATM technology as a convenience for customers. This time last year, cardless ATMs were offered mainly by the big banks, and then only at some of their ATMs. Now, many smaller regional and local banks have upgraded their cash machines to enable the new technology.</p>
<p>Card giant <strong>Mastercard</strong> says <a href="media/7cf6b7c2.fsm-debit-atm-cardless-atm-external-summary-global-aug18.pdf" data-original-source="https://www.mastercard.us/content/dam/mccom/en-us/issuers/Documents/fsm-debit-atm-cardless-atm-external-summary-global-aug18.pdf" target="_blank" rel="noopener">its polling</a> (PDF) suggests that 78 percent of consumers would rather use a cardless ATM solution than carry a physical card. I would wager that most U.S. cardholders still haven&#8217;t even heard of cardless ATMs, let alone could say whether or not their bank offers such transactions.  Curious whether your bank supports cardless transactions? A quick online search for your bank&#8217;s name and the term &#8220;cardless ATM&#8221; should provide some clues.</p>
<p>In the meantime, remember never to respond to requests for personal or financial information sent via email, text message or over the phone. Phone-based phishing attacks are getting way more clever and are even snaring technology experts, <a href="https://krebsonsecurity.com/2018/10/voice-phishing-scams-are-getting-more-clever/" target="_blank" rel="noopener">as last month&#8217;s story shows</a>. When in doubt, contact your financial institution directly either in person or by phone using the number on the back of your card.</p>


feed_id: https://krebsonsecurity.com/?p=45523
title: Who’s In Your Online Shopping Cart?
uri: Who-s-In-Your-Online-Shopping-Cart
url: https://krebsonsecurity.com/2018/11/whos-in-your-online-shopping-cart/
content:
<p>Crooks who hack online merchants to steal payment card data are constantly coming up with crafty ways to hide their malicious code on Web sites. In Internet ages past, this often meant obfuscating it as giant blobs of gibberish text that was obvious even to the untrained eye. These days, a compromised e-commerce site is more likely to be seeded with a tiny snippet of code that invokes a hostile domain which appears harmless or that is virtually indistinguishable from the hacked site&#8217;s own domain.</p>
<p>Before going further, I should note that this post includes references to domains that are either compromised or actively stealing user data. Although the malcode implanted on these sites is not designed to foist malicious software on visitors, please be aware that this could change at a moment&#8217;s notice. Anyone seeking to view the raw code on sites referenced here should proceed with caution; using an online source code viewer <a href="https://htmlstrip.com/html-source-code-viewer" target="_blank" rel="noopener">like this one</a> can let readers safely view the HTML code on any Web page without actually rendering it in a Web browser.</p>
<p>As its name suggests, <strong>asianfoodgrocer-dot-com</strong> offers a range of comestibles. It also currently includes a spicy bit of card-skimming code that is hosted on the domain <strong>zoobashop-dot-com</strong>. In this case, it is easy to miss the malicious code when reviewing the HTML source, as it fits neatly into a single, brief line of code.</p>
<p><a class="lightbox" href="media/08cca05e.zooba.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/zooba.png"><img class="aligncenter wp-image-45534" src="media/08cca05e.zooba.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/zooba.png" alt="" width="592" height="127" /></a></p>
<p>Zoobashop is also a presently hacked e-commerce site. Based in Accra, Ghana, zoobashop bills itself as Ghana&#8217;s &#8220;largest online store.&#8221; In addition to offering great deals on a range of electronics and home appliances, it is currently serving a tiny obfuscated script called &#8220;js.js&#8221; that snarfs data submitted into online forms.</p>
<p>As sneaky as this attack may be, the hackers in this case did not go out of their way to make the domain hosting the malicious script blend in with the surrounding code. However, increasingly these data-slurping scripts are hidden behind fully fraudulent https:// domains that are custom-made to look like they might be associated with content delivery networks (CDNs) or web-based scripts, and include terms like &#8220;jquery,&#8221; &#8220;bootstrap,&#8221; and &#8220;js.&#8221;</p>
<p><a href="https://www.publicwww.com" target="_blank" rel="noopener">Publicwww.com</a> is a handy online service that lets you search the Web for sites running snippets of specific code. Searching publicwww.com for sites <a href="https://publicwww.com/websites/%22bootstrap-js.com%22/" target="_blank" rel="noopener">pulling code from bootstrap-js-dot-com</a> currently reveals more than 50 e-commerce sites seeded with this malicious script. A search at publicwww for the <a href="https://publicwww.com/websites/%22js-react.com%22/" target="_blank" rel="noopener">malcode hosted at js-react-dot-com</a> indicates the presence of this code on at least a dozen online merchants.</p>
<p>Sometimes, the malicious domain created to host a data-snarfing script mimics the host domain by referencing a doppelganger Web site name. For example, check out the source code for the e-commerce site <strong>bargainjunkie-dot-com</strong> and you&#8217;ll notice at the bottom that it pulls a malicious script from the domain &#8220;<strong>bargalnjunkie-dot-com</strong>,&#8221; where the &#8220;i&#8221; in &#8220;bargain&#8221; is sneakily replaced with a lowercase &#8220;L&#8221;.</p>
<p><img class="aligncenter size-full wp-image-45537" src="media/2583bc87.bargal.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/bargal.png" alt="" width="591" height="114" /></p>
<p>In many cases, running a reverse search for other domain names where the doppelganger domain is hosted reveals additional compromised hosts, or other methods of compromising them. For example, the look-alike domain bargalnjunkie-dot-com is hosted on the address 46.161.40.49, which is the home to several domains, including <strong>payselector-dot-com</strong> and <strong>billgetstatus-dot-com</strong>.</p>
<p>Payselector-dot-com and billgetstatus-dot-com were apparently registered so that they appear related to online payment services. But both of these domains actually host complex malicious scripts that are loaded in an obfuscated way on a number of Web sites &#8212; including the ballet enthusiast store <strong>balletbeautiful-dot-com</strong>. Interestingly, the Internet address hosting the payselector and billgetstatus domains &#8212; the aforementioned 46.161.40.49 &#8212; also hosts the doppelganger domain &#8220;balletbeautlful-dot-com,&#8221; again with the &#8220;i&#8221; replaced by a lowercase &#8220;L&#8221;.<span id="more-45523"></span></p>
<div id="attachment_45540" style="width: 366px" class="wp-caption aligncenter"><img class="size-full wp-image-45540" src="media/92d70fdd.farsight46-161-40-49.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/farsight46-161-40-49.png" alt="" width="356" height="435" /><p class="wp-caption-text">A &#8220;reverse DNS&#8221; lookup of the IP address 46.161.40.49, compliments of Farsight Security.</p></div>
<p>The malicious scripts loaded from payselector-dot-com and billgetstatus-dot.com are obfuscated with a custom HTML function &#8212; <a href="https://developer.mozilla.org/en-US/docs/Web/API/WindowOrWorkerGlobalScope/atob" target="_blank" rel="noopener">window.atob</a> &#8212; which scrambles the code referencing those domains names on hacked sites. While the presence of &#8220;window.atob&#8221; in the source code of a Web site is not itself an indicator of compromise, <a href="https://publicwww.com/websites/%22img.src+%3D+window.atob%22/" target="_blank" rel="noopener">a search for this code via publicwww.com is revealing</a> and further review suggests there are dozens of sites currently compromised in this manner.</p>
<p>For example, that search points to the domain for online clothier <strong>evisu-dot-com</strong>, whose HTML source includes the following code snippet:</p>
<p><a class="lightbox" href="media/c8c863de.evisu.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/evisu.png"><img class="aligncenter wp-image-45533" src="media/c8c863de.evisu.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/evisu.png" alt="" width="591" height="73" /></a></p>
<p>If you cut and paste the gibberish text that&#8217;s between the quotations in the highlighted portion of the screenshot above into the site <a href="https://www.base64decode.net/" target="_blank" rel="noopener">base64decode.net</a>, you&#8217;ll see this jumble of junk text decodes to <strong>apitstatus-dot-com</strong>, yet another dodgy domain custom-made to look like a legitimate function of a regular e-commerce site.</p>
<p>Revisiting the source code for the domain balletbeautiful-dot.com, we can see that it also includes this &#8220;window.atob&#8221; code followed by some obfuscated text. A paste of this gobbledegook in Base64decode.net shows that it decodes to&#8230;you guessed it: balletbeautlful-dot-com.</p>
<p><a class="lightbox" href="media/2c69d780.balletjs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/balletjs.png"><img class="aligncenter wp-image-45539" src="media/2c69d780.balletjs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/balletjs.png" alt="" width="586" height="79" /></a></p>
<p>Sometimes, antivirus products will detect the presence of these malicious scripts and block users from visiting compromised sites, but for better or worse none of the sites I mentioned here currently are flagged as malicious by any of the more than five dozen antivirus tools at the file-scanning service <a href="https://www.virustotal.com" target="_blank" rel="noopener">virustotal.com</a>.</p>
<p>Security firm <strong>Symantec</strong> refers to these attacks as &#8220;formjacking,&#8221; which it describes as the use of malicious Javascript to steal credit card details and other information from payment forms on the checkout pages of e-commerce sites. In September, Symantec <a href="https://www.symantec.com/blogs/threat-intelligence/formjacking-attacks-retailers" target="_blank" rel="noopener">said it blocked almost a quarter of a million instances</a> of attempted formjacking since mid-August 2018.</p>
<p>Another security company &#8212; <strong>RiskIQ</strong> &#8212; has <a href="https://www.riskiq.com/blog/labs/magecart-british-airways-breach/" target="_blank" rel="noopener">written</a> extensively about these attacks and has attributed several recent compromises &#8212; including the hack of Web sites for <strong>British Airways</strong> and geek gear vendor <strong>Newegg</strong> &#8212; to a group it calls &#8220;<strong>Magecart</strong>.&#8221;</p>
<p>It&#8217;s unclear if the compromises detailed in this post are related to the work of that crime gang. In any case, I like RiskIQ&#8217;s comparison of these attacks to ATM skimmers, a type of crime that has <a href="https://krebsonsecurity.com/all-about-skimmers/" target="_blank" rel="noopener">held my fascination for years now</a>.</p>
<p>&#8220;Traditionally, criminals use devices known as card skimmers—devices hidden within credit card readers on ATMs, fuel pumps, and other machines people pay for with credit cards every day—to steal credit card data for the criminal to later collect and either use themselves or sell to other parties,&#8221; RiskIQ&#8217;s <strong>Yonathan Klijnsma</strong> writes. &#8220;Magecart uses a digital variety of these devices.&#8221;</p>
<p>I like the comparison to skimming because online merchants are being targeted in major way right now precisely because of efforts to make it hard for thieves to make money from fraud involving counterfeit debit and credit cards. The United States is the last of the G20 nations to make the transition to more secure chip-based payment cards, and virtually every other country that has already been through that shift has seen a marked increase in online fraud as a result.</p>
<p>Heads up to anyone responsible for administering a Web site: There are options available to help monitor your Web site for unauthorized changes. Tools like <a href="https://www.upguard.com/articles/tripwire-vs-aide" target="_blank" rel="noopener">Tripwire and AIDE</a> can detect new or modified files, but many of these formjacking attacks involve the insertion of code in existing Web pages. Subscription services like <a href="https://www.wewatchyourwebsite.com/pricing-tables.html" target="_blank" rel="noopener">wewatchyourwebsite.com</a> and <a href="https://watchdo.gs/" target="_blank" rel="noopener">watchdo.gs</a> may be more helpful here.</p>
<p>In case anyone&#8217;s wondering, all of the hacked sites mentioned here have been notified. In many cases, the contact details for the owners of these sites is <a href="https://krebsonsecurity.com/?s=gdpr&amp;x=0&amp;y=0" target="_blank" rel="noopener">hidden behind WHOIS privacy protection</a>, and alerting victims via Facebook or filling out contact forms elicits no response. In other instances, the alerted site cleaned up part of the compromise but left key malicious elements intact &#8212; without even acknowledging efforts made to notify them.</p>
<p>I realize this post is quite a bit more technical than most at KrebsOnSecurity. I&#8217;m explaining my process for finding these sites because there appear to be so many compromised by these methods that the only feasible way to get them cleaned up quickly may be to crowdsource the effort, given that more online shops are being newly compromised each day.</p>
<p>I burned through several days this week following the virtual rabbit holes dug by whoever is responsible for this ongoing e-commerce crime spree, and it seems to me finding and alerting all the compromised businesses could keep an entire team of people busy for some time. But I am just one guy, and this is a thankless task.</p>
<p>KrebsOnSecurity would like to thank <a href="https://twitter.com/breachmessenger" target="_blank" rel="noopener">@breachmessenger</a> for their assistance in researching this story.</p>


feed_id: https://krebsonsecurity.com/?p=45521
title: Busting SIM Swappers and SIM Swap Myths
uri: Busting-SIM-Swappers-and-SIM-Swap-Myths
url: https://krebsonsecurity.com/2018/11/busting-sim-swappers-and-sim-swap-myths/
content:
<p>KrebsOnSecurity recently had a chance to interview members of the <strong>REACT Task Force</strong>, a team of law enforcement officers and prosecutors based in Santa Clara, Calif. that has been tracking down individuals engaged in unauthorized &#8220;SIM swaps&#8221; &#8212; a complex form of mobile phone fraud that is often used to steal large amounts of cryptocurrencies and other items of value from victims. Snippets from that fascinating conversation are recounted below, and punctuated by accounts from a recent victim who lost more than $100,000 after his mobile phone number was hijacked.</p>
<p><img class="aligncenter wp-image-44711" src="media/daad1d09.newsnip.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/newsnip.png" alt="" width="358" height="501" /></p>
<p>In late September 2018, the REACT Task Force spearheaded an investigation that led to the <a href="https://kfor.com/2018/09/28/2-men-arrested-in-oklahoma-suspected-in-14-million-cryptocurrency-theft-hacking-of-california-company/amp/?__twitter_impression=true" target="_blank" rel="noopener">arrest of two Missouri men</a> &#8212; both in their early 20s &#8212; who are accused of conducting SIM swaps to steal $14 million from a cryptocurrency company based in San Jose, Calif. Two months earlier, the task force was instrumental in <a href="https://www.mercurynews.com/2018/09/03/sim-swap-cryptocurrency-busts-highlight-new-frontier-for-bay-area-tech-cops/" target="_blank" rel="noopener">apprehending 20-year-old Joel Ortiz</a>, a Boston man suspected of <a href="https://krebsonsecurity.com/2018/08/alleged-sim-swapper-arrested-in-california/" target="_blank" rel="noopener">stealing millions of dollars in cryptocoins</a> with the help of SIM swaps.</p>
<p><strong>Samy Tarazi</strong> is a sergeant with the Santa Clara County Sheriff&#8217;s office and a REACT supervisor. The force was originally created to tackle a range of cybercrimes, but Tarazi says SIM swappers are a primary target now for two reasons. First, many of the individuals targeted by SIM swappers live in or run businesses based in northern California.</p>
<p>More importantly, he says, the frequency of SIM swapping attacks is&#8230;well, off the hook right now.</p>
<p>&#8220;It&#8217;s probably REACT&#8217;s highest priority at the moment, given that SIM swapping is actively happening to someone probably even as we speak right now,&#8221; Tarazi said. &#8220;It&#8217;s also because there are a lot of victims in our immediate jurisdiction.&#8221;</p>
<p>As common as SIM swapping has become, Tarazi said he and other members of REACT suspect that there are only a few dozen individuals responsible for perpetrating most of these heists.</p>
<p>&#8220;For the amounts being stolen and the number of people being successful at taking it, the numbers are probably historic,&#8221; Terazi said. &#8220;We&#8217;re talking about kids aged mainly between 19 and 22 being able to steal millions of dollars in cryptocurrencies. I mean, if someone gets robbed of $100,000 that&#8217;s a huge case, but <span class="pullquote pqleft">we&#8217;re now dealing with someone who buys a 99 cent SIM card off eBay, plugs it into a cheap burner phone, makes a call and steals millions of dollars. That&#8217;s pretty remarkable.</span>&#8221;</p>
<p>Indeed, the theft of $100,000 worth of cryptocurrency in July 2018 was the impetus for my interview with REACT. I reached out to the task force after hearing about their role in assisting SIM swapping victim <strong>Christian Ferri</strong>, who is president and CEO of San Francisco-based cryptocurrency firm <a href="https://www.block-star.com" target="_blank" rel="noopener">BlockStar</a>.</p>
<p>In early July 2018, Ferri was traveling in Europe when he discovered his <strong>T-Mobile</strong> phone no longer had service. He&#8217;d later learn that thieves had abused access to T-Mobile&#8217;s customer database to deactivate the SIM card in his phone and to activate a new one that they had in their own mobile device.</p>
<p>Soon after, the attackers were able to use their control over his mobile number to reset his <strong>Gmail</strong> account password. From there, the perpetrators accessed a <strong>Google Drive</strong> document that Ferri had used to record credentials to other sites, including a cryptocurrency exchange. Although that level of access could have let the crooks steal a great deal more from Ferri, they were simply after his cryptocoins, and in short order he was relieved of approximately $100,000 worth of coinage.</p>
<p>We&#8217;ll hear more about Ferri&#8217;s case in a moment. But first I should clarify that the REACT task force members did not discuss with me the details of Mr. Ferri&#8217;s case &#8212; even though according to Ferri a key member of the task force we&#8217;ll meet later has been actively investigating on his behalf. The remainder of this interview with REACT pivots off of Ferri&#8217;s incident mainly because the details surrounding his case help clarify some of the most confusing and murky aspects of how these crimes are perpetrated &#8212; and, more importantly, what we can do about them.</p>
<h4>WHO&#8217;S THE TARGET?</h4>
<p>SIM swapping attacks primarily target individuals who are visibly active in the cryptocurrency space. This includes people who run or work at cryptocurrency-focused companies; those who participate as speakers at public conferences centered around Blockchain and cryptocurrency technologies; and those who like to talk openly on social media about their crypto investments.</p>
<p>REACT Lieutenant <strong>John Rose</strong> said in addition to or in lieu of stealing cryptocurrency, some SIM swappers will relieve victims of highly prized social media account names (also known as &#8220;<a href="https://krebsonsecurity.com/2015/11/talktalk-script-kids-the-quest-for-og/" target="_blank" rel="noopener">OG accounts</a>&#8220;) &#8212; usually short usernames that can convey an aura of prestige or the illusion of an early adopter on a given social network. OG accounts typically can be resold for thousands of dollars.</p>
<p>Rose said even though a successful SIM swap often gives the perpetrator access to traditional bank accounts, the attackers seem to be mainly interested in stealing cryptocurrencies.</p>
<p>&#8220;Many SIM swap victims are understandably very scared at how much of their personal information has been exposed when these attacks occur,&#8221; Rose said. &#8220;But [the attackers] are predominantly interested in targeting cryptocurrencies for the ease with which these funds can be laundered through online exchanges, and because the transactions can&#8217;t be reversed.&#8221;</p>
<p><img class="aligncenter wp-image-45224" src="media/57d2a628.phonescam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/phonescam.png" alt="" width="593" height="374" /></p>
<h4>FAKE IDs AND PHONY NOTES</h4>
<p>The &#8220;how&#8221; of these SIM swaps is often the most interesting because it&#8217;s the one aspect of this crime that&#8217;s probably the least well-understood. Ferri said when he initially contacted T-Mobile about his incident, the company told him that the perpetrator had entered a T-Mobile store and presented a fake ID in Ferri&#8217;s name.</p>
<p>But Ferri said once the REACT Task Force got involved in his case, it became clear that video surveillance footage from the date and time of his SIM swap showed no such evidence of anyone entering the store to present a fake ID. Rather, he said, this explanation of events was a misunderstanding at best, and more likely a cover-up at some level.</p>
<p><strong>Caleb Tuttle</strong>, a detective with the Santa Clara County District Attorney&#8217;s office, said he has yet to encounter a single SIM swapping incident in which the perpetrator actually presented ID in person at a mobile phone store. That&#8217;s just too risky for the attackers, he said.</p>
<p>&#8220;I&#8217;ve talked to hundreds of victims, and I haven&#8217;t seen <em>any cases</em> where the suspect is going into a store to do this,&#8221; Tuttle said.</p>
<p>Tuttle said SIM swapping happens in one of three ways. The first is when the attacker bribes or blackmails a mobile store employee into assisting in the crime. The second involves current and/or former mobile store employees who knowingly abuse their access to customer data and the mobile company&#8217;s network. Finally, crooked store employees may trick unwitting associates at other stores into swapping a target&#8217;s existing SIM card with a new one.</p>
<p>&#8220;Most of these SIM swaps are being done over the phone, and the notes we&#8217;re seeing about the change in the [victim&#8217;s] account usually are left either by [a complicit] employee trying to cover their tracks, or because the employee who typed in that note actually believed what they were typing.&#8221; In the latter case, the employee who left a note in the customer&#8217;s account saying ID had been presented in-store was tricked by a complicit co-worker at another store who falsely claimed that a customer there had already presented ID.</p>
<h4>DARK WEB SOFTWARE?</h4>
<p>Ferri said the detectives investigating his SIM swap attack let on that the crooks responsible had at some point in the attack used &#8220;specialized software to get into T-Mobile&#8217;s customer database.&#8221;</p>
<p>&#8220;The investigator said there were employees of the company who had built a special software tool that they could use to connect to T-Mobile&#8217;s customer database, and that they could use this software from their home or couch to log in and see all the customer information there,&#8221; Ferri recalled. &#8220;The investigator didn&#8217;t explain exactly how it worked, but it was basically a backdoor entrance that they were reselling on the Dark Web, and it bypassed whatever security there was and let them go straight into the customer database.&#8221;</p>
<p>Asked directly about this mysterious product supposedly being offered on the Dark Web, the REACT task force members put our phone interview on hold for several minutes while they privately huddled to discuss the question. When they finally took me off mute, a member of the task force instead answered a different question that I&#8217;d asked much earlier in the interview.</p>
<p>When pressed about the software again, there was a long, uncomfortable silence. Then Detective Tuttle spoke up.</p>
<p><span class="pullquote pqright">&#8220;We&#8217;re not going to talk about that,&#8221; he said curtly. &#8220;Deal with it.&#8221;</span></p>
<p>T-Mobile likewise declined to comment on the allegation that thieves had somehow built software which gave them direct access to T-Mobile customer data. However, in at least three separate instances over the past six months, T-Mobile has been forced to acknowledge incidents of unauthorized access to customer records.</p>
<p>In August 2018, T-Mobile <a href="https://www.t-mobile.com/customers/6305378821" target="_blank" rel="noopener">published a notice</a> saying its security team discovered and shut down unauthorized access to certain information, including customer name, billing zip code, phone number, email address, account number, account type (prepaid or postpaid) and/or date of birth. A T-Mobile spokesperson said at the time that this incident impacted roughly two percent of its subscriber base, or approximately 2.5 million customers.</p>
<p>In May 2018, T-Mobile <a href="https://www.zdnet.com/article/tmobile-bug-let-anyone-see-any-customers-account-details/" target="_blank" rel="noopener">fixed a bug in its Web site</a> that let anyone view the personal account details of any customer. The bug could be exploited simply by adding the phone number of a target to the end of a Web address used by one of the company&#8217;s internal tools that was nevertheless accessible via the open Internet. The data provided by that tool reportedly also included references to account PINs used by customers as a security question when contacting T-Mobile customer support.</p>
<p>In April 2018, T-Mobile <a href="https://motherboard.vice.com/en_us/article/wjx3e4/t-mobile-website-allowed-hackers-to-access-your-account-data-with-just-your-phone-number" target="_blank" rel="noopener">fixed a related bug</a> in its public Web site that allowed anyone to pull data tied to customer accounts, including the user&#8217;s account number and the target phone&#8217;s IMSI &#8212; a unique number that ties subscribers to their specific mobile device.<span id="more-45521"></span></p>
<h4>A DISCONNECT AT THE CARRIER LEVEL</h4>
<p>I wanted to hear from the REACT team what they thought the mobile carriers could be doing to better detect and prevent SIM swaps. I received a range of responses.</p>
<p>&#8220;This is a really serious problem among the carriers, the ease with which SIM swaps can occur,&#8221; Lt. Rose said. &#8220;If you&#8217;re working at a mobile phone store and making $12 an hour and suddenly someone offers you $400 to do a single SIM swap, that can seem like a pretty sweet deal if you don&#8217;t also have any morals or sense of conscience. &#8221;</p>
<p>Rose said mobile phone stores could cut down on these crimes in much the same way that potential victims can combat SIM swapping: By relying on dual authentication.</p>
<p>&#8220;Having one employee who can conduct these SIM swaps without any kind of oversight seems to be the real problem,&#8221; Rose said. &#8220;And it seems like [the carriers] could really put a stop to it if there were more checks and balances to prevent that. <span class="pullquote pqleft">It&#8217;s still very, very easy to SIM swap, and something has to be done because it&#8217;s just too simple. Someone needs to light a fire under some folks to get these protections put in place.&#8221;</span></p>
<p>Sgt. Samy said a big challenge for mobile stores is balancing customer service with account security. After all, he said, customers legitimately request SIM swaps all the time &#8212; such as when a phone is lost or stolen, or when the customer upgrades to a phone that requires a SIM card of a different size.</p>
<p>&#8220;There are probably tens of thousands of legitimate SIM swaps a day or week, versus a couple of fake ones,&#8221; Samy said. &#8220;Ultimately, these attacks rely on the human element and the ability of an employee to override whatever security is in place.&#8221;</p>
<p>Samy added that in many cases there&#8217;s a vast disconnect between a mobile company&#8217;s corporate offices and security policies at the local store level.</p>
<p>&#8220;These are multi-billion companies, and in any big company it&#8217;s fairly common that the left hand doesn&#8217;t know what the right hand is doing,&#8221; he said. &#8220;Without knowing the ins and outs of how these companies work, it&#8217;s very easy for us to say they should have two people authorizing each SIM swap. But I agree anything that makes [the criminal SIM swappers] have to show up in person to do this would ideally be the best scenario.&#8221;</p>
<h4>TWO-FACTOR BREAKDOWN</h4>
<p>Asked what he would have done differently about his attack, Ferri said he&#8217;d have set up his Google accounts to use app-based two-factor authentication, instead of relying merely on his mobile phone to receive that second factor via text message.</p>
<p>&#8220;I had app-based two factor set up on my [cryptocurrency] exchange accounts, but not Gmail,&#8221; he said. &#8220;Also, I&#8217;d probably use something like Google Voice for anything that requires a phone number for a second factor.&#8221;</p>
<p>In fact, this is the precise advice offered by Joel Ortiz, the alleged SIM swapper mentioned earlier who was arrested this year by the REACT Task Force. According to published reports, Ortiz taught many other SIM swappers how to perfect their techniques &#8212; and how to avoid being victimized themselves by rival SIM swappers. I included the specifics from Ortiz&#8217;s advice in my Aug. 16 column, <a href="https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/" target="_blank" rel="noopener">Hanging Up On Mobile in the Name of Security</a>.</p>
<p><img class="aligncenter wp-image-45226" src="media/c61b924f.cell8.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/cell8.png" alt="" width="595" height="685" /></p>
<p>Det. Tuttle said in a typical SIM swap attack the perpetrators have studied their target in advance, much the same way bank robbers might spend a few days observing the comings and goings at a specific bank branch before making their move.</p>
<p>&#8220;Usually, once a SIM swap is done they&#8217;ve already done enough research and social engineering on victims to know what accounts the victim has &#8212; whether it&#8217;s Gmail or Dropbox or whatever,&#8221; Tuttle said. &#8220;The next thing they do is go to these accounts and use the &#8216;forgot password&#8217; function and request a password reset link via SMS to gain access to those accounts. From there, they start looking for cryptocurrency exchange passwords, private keys, and reseed codes to steal cryptocurrencies.</p>
<p>Tuttle said it&#8217;s important for people to use something other than text messages for two-factor authentication on their email accounts when stronger authentication options are available. He advises people instead use a mobile app like <strong>Authy</strong> or <strong>Google Authenticator</strong> to generate the one-time code. Or better yet, <a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/" target="_blank" rel="noopener">a physical security key</a> if that&#8217;s an option.</p>
<p>&#8220;Let&#8217;s say I have a Coinbase account and I have it set up to require a password and a one-time code generated by Authy, but my Gmail account tied to that Coinbase account doesn&#8217;t use Authy and just uses SMS for two-factor,&#8221; Tuttle explained. &#8220;Once I SIM swap that person, I can often also use that access to [request a link via SMS] to reset his Gmail password, and then set up Authy on the Gmail account using my device. Now I have access to your Coinbase account and can effectively lock you out of both.&#8221;</p>
<p><strong>Dave Berry</strong>, a task force member and investigator with the Santa Clara County District Attorney&#8217;s office, said cryptocurrency enthusiasts should be storing most of their crypto funds in hardware wallets, and storing private keys needed to spend or transfer those funds on a device that doesn&#8217;t touch the Internet. Printing out and properly securing a set of one-time codes that can be used if a mobile device is lost or stolen is a good idea as well.</p>
<p>But most of all, Berry said, people should stop using SMS when more robust two-factor options are available.</p>
<p>&#8220;There may be some inconvenience factor there, but if you don&#8217;t have any two-factor going over text message, you really do limit the potential damage that way,&#8221; Berry said.</p>
<h4>ROBBING HOODS</h4>
<p>Sgt. Samy says one big problem is that it&#8217;s still not common knowledge that SMS-based two-factor can leave users with a false sense of security.</p>
<p>&#8220;Text-based two-factor is still the industry standard way of doing it, because it&#8217;s super convenient and you don&#8217;t need to be computer savvy to figure it out,&#8221; Samy said. &#8220;I would say most people who aren&#8217;t following the SIM swapping problem have no idea their phone and associated accounts can be taken over so easily. It&#8217;s not like the person who leaves a laptop in plain view in the car, and when the laptop gets stolen you say well someone just encouraged the thief in that case. In this case, the victim didn&#8217;t download malware or fall for some stupid phishing email. They just end up getting compromised because they followed the industry standard.&#8221;</p>
<p>Lt. Rose notes that this dynamic helps some SIM swapping thieves justify their crimes.</p>
<p>&#8220;We see this a lot, where by their own words they&#8217;ll blame victims for not protecting themselves properly, saying it&#8217;s the victim&#8217;s fault he got robbed,&#8221; Rose said.</p>
<p>On top of that, Rose said many crooks involved in SIM swapping tend to adopt the view that they are stealing from fabulously wealthy individuals who will still be well off after they&#8217;re relieved of some of their crypto assets &#8212; as with the case of bitcoin entrepreneur <strong>Michael Terpin</strong>, <a href="https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/" target="_blank" rel="noopener">who lost $24 million in cryptocurrencies after getting hit by an unauthorized SIM swap earlier this year</a> (allegedly at the hands of a crooked AT&amp;T retail store employee).</p>
<p>But Detective Tuttle said Terpin&#8217;s example is an outlier.</p>
<p>&#8220;It&#8217;s not just stealing millions from millionaires,&#8221; Tuttle said. &#8220;Most of the victims are not in that category. Most are people who are having their life&#8217;s savings or their child&#8217;s college savings stolen. They&#8217;re victims who have families and 9-5 jobs, and who got into the crypto space because they were investing and trying to make ends meet. We only tend to hear or read about these attacks when they result in millions of dollars in losses. But the reality is there&#8217;s a lot of other thefts involving much more diminished amounts that are really negatively impacting peoples&#8217; lives.&#8221;</p>
<p>For <strong>Erin West</strong>, deputy district attorney with the Santa Clara DA&#8217;s office, this dynamic is a major factor driving the work of the REACT task force. West says she believes her group is a having a strong deterrent effect, and that the individuals who persist in carrying out these crimes are all keenly aware of the group&#8217;s work.</p>
<p>&#8220;We&#8217;re out there arresting these people and finding new leads every day,&#8221; West said. &#8220;We&#8217;re zealously prosecuting them, and we expect this will have a deterrent effect because we&#8217;re fortunate enough to have federal partners that we can now do this on a national level and make arrests out of state. Rest assured that if a victim in touched in Santa Clara county, we will find you and prosecute you no matter where you are.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=45519
title: U.S. Secret Service Warns ID Thieves are Abusing USPS’s Mail Scanning Service
uri: U-S-Secret-Service-Warns-ID-Thieves-are-Abusing-USPS-s-Mail-Scannin
url:
https://krebsonsecurity.com/2018/11/u-s-secret-service-warns-id-thieves-are-abusing-uspss-mail-scanning-service/

content:
<p>A year ago, KrebsOnSecurity warned that &#8220;Informed Delivery,&#8221; a new offering from the <strong>U.S. Postal Service</strong> (USPS) that lets residents view scanned images of all incoming mail, <a href="https://krebsonsecurity.com/2017/10/usps-informed-delivery-is-stalkers-dream/" target="_blank" rel="noopener">was likely to be abused by identity thieves and other fraudsters</a> unless the USPS beefed up security around the program and made it easier for people to opt out. This week, the <strong>U.S. Secret Service</strong> issued an internal alert warning that many of its field offices have reported crooks are indeed using Informed Delivery to commit various identity theft and credit card fraud schemes.</p>
<div id="attachment_45608" style="width: 605px" class="wp-caption aligncenter"><img class=" wp-image-45608" src="media/bcca40f1.idusps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/idusps.png" alt="" width="595" height="228" /><p class="wp-caption-text">Image: USPS</p></div>
<p>The internal alert &#8212; sent by the Secret Service on Nov. 6 to its law enforcement partners nationwide &#8212; references a recent case in Michigan in which seven people were arrested for allegedly stealing credit cards from resident mailboxes after signing up as those victims at the USPS&#8217;s Web site.</p>
<p>According to the Secret Service alert, the accused used the Informed Delivery feature &#8220;to identify and intercept mail, and to further their identity theft fraud schemes.&#8221;</p>
<p>&#8220;Fraudsters were also observed on criminal forums discussing using the Informed Delivery service to surveil potential identity theft victims,&#8221; the Secret Service memo reads.</p>
<p>The USPS did not respond to repeated requests for comment over the past six days.</p>
<p>The Michigan incident in the Secret Service alert refers to <a href="https://www.mlive.com/news/grand-rapids/index.ssf/2018/09/mail_theft_leads_to_400k_in_cr.html" target="_blank" rel="noopener">the September 2018 arrest of seven people</a> accused of running up nearly $400,000 in unauthorized charges on credit cards they ordered in the names of residents. According to <a href="media/35a8095c.rolle.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/rolle.pdf" target="_blank" rel="noopener">a copy of the complaint in that case</a> (PDF), the defendants allegedly stole the new cards out of resident mailboxes, and then used them to fraudulently purchase gift cards and merchandise from department stores.</p>
<p>KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method &#8212; the U.S. Mail &#8212; to validate and notify residents when someone at their address signs up for Informed Delivery. The USPS <a href="https://krebsonsecurity.com/2018/02/usps-finally-starts-notifying-you-by-mail-if-someone-is-scanning-your-snail-mail-online/" target="_blank" rel="noopener">addressed that shortcoming earlier this year</a>, announcing it had started alerting all households by mail whenever anyone signs up to receive scanned notifications of mail delivered to their address.</p>
<p>However, it appears that ID thieves have figured out ways to hijack identities and order new credit cards in victims&#8217; names before the USPS can send their notification &#8212; possibly by waiting until the cards are already approved and ordered before signing up for Informed Delivery in the victim&#8217;s name.</p>
<p>Last month, WKMG&#8217;s <a href="https://www.mlive.com/news/grand-rapids/index.ssf/2018/09/mail_theft_leads_to_400k_in_cr.html" target="_blank" rel="noopener">Clickorlando.com wrote</a> that a number of Belle Isle, Fla. residents reported receiving hefty bills for credit cards they never knew they had. One resident was quoted as saying she received a bill for $2,000 in charges on a card she&#8217;d never seen before, and only after that did she get a notice from the USPS saying someone at her address had signed up for Informed Delivery. The only problem was she&#8217;d never signed up for the USPS program.</p>
<p>&#8220;According to a police report, someone opened fraudulent credit card accounts and charged more than $14,000 and signed her neighbors up for Informed Delivery, too,&#8221; Clickorlando&#8217;s <strong>Louis Bolden</strong> explained. &#8220;Photos of what would be in their mail were going to someone else.&#8221;</p>
<p>Residents in Texas have reported similar experiences. <strong>Dave Lieber</strong>, author of <a href="https://www.dallasnews.com/news/watchdog/2018/11/02/identity-thieves-can-use-post-office-service-hijack-mail-steal-identity-can" target="_blank" rel="noopener">The Watchdog column</a> for <em>The Dallas Morning News</em>, said he heard from victim <strong>Chris Torraca</strong>, 58, a retired federal bank regulator from Grapevine, a town between Dallas and Ft. Worth.</p>
<p>&#8220;Chris discovered it after someone created an account in his name at usps.com,&#8221; Lieber wrote in a post published Nov. 2. &#8220;The thief began receiving photos of Chris&#8217; mail and also opened a bank credit card in Chris&#8217; wife&#8217;s name. Postal officials promote the program as a great way to prevent ID theft, but for Chris, that&#8217;s what led to it.&#8221;<span id="more-45519"></span></p>
<p>As noted in last year&#8217;s story, the major weakness with Informed Delivery lies in the method the USPS uses to validate new accounts. Signing up requires an eligible resident <a href="https://reg.usps.com/entreg/RegistrationPortalAction_input" target="_blank" rel="noopener">to create a free user account</a> at USPS.com, which asks for the resident’s name, address and an email address. The final step in validating residents involves answering four so-called “knowledge-based authentication” or KBA questions.</p>
<p>KrebsOnSecurity has <a href="https://krebsonsecurity.com/?s=kba&amp;x=0&amp;y=0" target="_blank" rel="noopener">relentlessly assailed KBA</a> as an unreliable authentication method because so many answers to the multiple-guess questions are available on sites like <strong>Spokeo</strong> and <strong>Zillow</strong>, or via social networking profiles.</p>
<p>I&#8217;ve previously advised that having a security freeze on your credit file should be enough to prevent someone from registering an Informed Delivery account in your name. That&#8217;s because the USPS validates new users by asking them a series of multiple-guess questions chosen by big-three credit bureau <strong>Equifax</strong>.</p>
<p>But numerous readers <a href="https://krebsonsecurity.com/2017/10/usps-informed-delivery-is-stalkers-dream/" target="_blank" rel="noopener">have responded</a> that they were still able to sign up for the service even though they had security freezes in place with Equfiax and the two other major consumer credit bureaus (Experian and TransUnion).</p>
<p>Normally in these cases, I&#8217;d urge readers to simply plant their flag by registering an account to claim their address. However, the USPS allows new account creations for anyone currently able to receive mail at your address, which means that claiming your address may involve registering an account with every adult present at your address.</p>
<p><em>The Dallas Morning News</em> piece referenced earlier says Americans can opt-out of Informed Delivery by emailing the &#8220;eSafe Team&#8221; at USPS at <strong>eSafe@usps.gov</strong>. However, emails sent to this address by KrebsOnSecurity elicited no response over the past four days.</p>
<p>Yet, one reader received a curious response by emailing the customer service address advertised by USPS&#8217;s Informed Delivery service &#8212; <strong>informeddelivery@custhelp.com</strong>. That reader requested that USPS remove her address from eligibility for Informed Delivery, and asked the Postal Service to let her know if anyone had previously signed up for the service at her address.</p>
<p>According to an email shared with this author, the USPS&#8217;s customer help team responded by asking the resident to answer some of her KBA questions in plain text via email.</p>
<div id="attachment_45621" style="width: 598px" class="wp-caption aligncenter"><img class=" wp-image-45621" src="media/f63c0332.uspsbs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/uspsbs.png" alt="" width="588" height="668" /><p class="wp-caption-text">A response from the Informed Delivery division of the USPS&#8217;s customer service department.</p></div>
<p>Sources tell KrebsOnSecurity that the USPS <em>is now processing some 20,000 new Informed Delivery account registrations each day</em>, and that the USPS is continuously deleting new account registrations that it believes may be fraudulent.</p>
<p>There is also a potentially new security wrinkle in the USPS&#8217;s Informed Delivery service. The USPS is now generating revenue by allowing third-party companies <a href="media/18978e32.informed-delivery-interactive-campaign-guide.pdf" data-original-source="https://www.usps.com/business/pdf/informed-delivery-interactive-campaign-guide.pdf" target="_blank" rel="noopener">to advertise interactive content in Informed Delivery communications</a> (PDF) sent to email subscribers.</p>
<p>The program allows the USPS to automatically match scanned mail images to specific advertising campaigns. According to a review of its <a href="media/8031a8bd.informed-delivery-mailer-campaign-portal-user-guide.pdf" data-original-source="https://www.usps.com/business/pdf/informed-delivery-mailer-campaign-portal-user-guide.pdf" target="_blank" rel="noopener">mailer delivery user guide</a> (PDF), this initiative allows advertisers to publicize content that contains interactive links, which could be abused by malefactors posing as legitimate advertisers.</p>
<div id="attachment_45606" style="width: 600px" class="wp-caption aligncenter"><a class="lightbox" href="media/fd9b8a4c.USPS-ID.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/USPS-ID.png"><img class="wp-image-45606" src="media/fd9b8a4c.USPS-ID.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/USPS-ID.png" alt="" width="590" height="254" /></a><p class="wp-caption-text">This graphic, taken from the Secret Service alert, describes how the USPS Informed Delivery system works.</p></div>


feed_id: https://krebsonsecurity.com/?p=45569
title: Bug Bounty Hunter Ran ISP Doxing Service
uri: Bug-Bounty-Hunter-Ran-ISP-Doxing-Service
url: https://krebsonsecurity.com/2018/11/bug-bounty-hunter-ran-isp-doxing-service/
content:
<p>A Connecticut man who&#8217;s earned <a href="https://en.wikipedia.org/wiki/Bug_bounty_program" target="_blank" rel="noopener">bug bounty</a> rewards and public recognition from top telecom companies for finding and reporting security holes in their Web sites secretly operated a service that leveraged these same flaws to sell their customers&#8217; personal data, KrebsOnSecurity has learned.</p>
<p>In May 2018, <em>ZDNet</em> ran <a href="https://www.zdnet.com/article/tmobile-bug-let-anyone-see-any-customers-account-details/" target="_blank" rel="noopener">a story</a> about the discovery of a glaring vulnerability in the Web site for wireless provider <strong>T-Mobile</strong> that let anyone look up customer home addresses and account PINs. The story noted that T-Mobile disabled the feature in early April after being alerted by a 22-year-old &#8220;security researcher&#8221; named <strong>Ryan Stevenson</strong>, and that the mobile giant had awarded Stevenson $1,000 for reporting the discovery under its bug bounty program.</p>
<div id="attachment_45654" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/9393ff68.phobiatwitter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/phobiatwitter.png"><img class="wp-image-45654" src="media/9393ff68.phobiatwitter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/phobiatwitter.png" alt="" width="594" height="254" /></a><p class="wp-caption-text">The Twitter account @phobia, a.k.a. Ryan Stevenson. The term &#8220;plug&#8221; referenced next to his Twitch profile name is hacker slang for employees at mobile phone stores who can be tricked or bribed into helping with SIM swap attacks.</p></div>
<p>Likewise, AT&amp;T has <a href="https://bugbounty.att.com/hof.php" target="_blank" rel="noopener">recognized</a> Stevenson for reporting security holes in its services. AT&amp;T&#8217;s bug bounty site lets contributors share a social media account or Web address where they can be contacted, and in Stevenson&#8217;s case he gave the now-defunct Twitter handle &#8220;@Phoobia.&#8221;</p>
<p>Stevenson&#8217;s <a href="media/3beedde3.ryan-phobias-li.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/ryan-phobias-li.png" target="_blank" rel="noopener">Linkedin profile</a> &#8212; named &#8220;Phobias&#8221; &#8212; says he specializes in finding exploits in numerous Web sites, including hotmail.com, yahoo.com, aol.com, paypal.com and ebay.com. Under the <a href="media/2e304680.ryan-LI-contacts.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/ryan-LI-contacts.png" target="_blank" rel="noopener">&#8220;contact info&#8221; tab</a> of Stevenson&#8217;s profile it lists the youtube.com account of &#8220;<a href="https://www.youtube.com/ryan" target="_blank" rel="noopener">Ryan</a>&#8221; and the Facebook account &#8220;Phobia&#8221; (also now deleted).</p>
<p>Coincidentally, I came across multiple variations on this Phobia nickname as I was researching <a href="https://krebsonsecurity.com/2018/11/busting-sim-swappers-and-sim-swap-myths/" target="_blank" rel="noopener">a story published this week</a> on the <a href="https://twitter.com/CoolItsConvict/status/1046210233390039040" target="_blank" rel="noopener">epidemic of fraudulent SIM swaps</a>, a complex form of mobile phone fraud that is being used to steal millions of dollars in cryptocurrencies.</p>
<p>Unauthorized SIM swaps also are often used to hijack so-called <a href="https://krebsonsecurity.com/2015/11/talktalk-script-kids-the-quest-for-og/" target="_blank" rel="noopener">&#8220;OG&#8221; user accounts</a> &#8212; usually short usernames on top social network and gaming Web sites that are highly prized by many hackers because they can make the account holder appear to have been a savvy, early adopter of the service before it became popular and before all of the short usernames were taken. Some OG usernames can be sold for thousands of dollars in underground markets.</p>
<p>This week&#8217;s <a href="https://krebsonsecurity.com/2018/11/busting-sim-swappers-and-sim-swap-myths/" target="_blank" rel="noopener">SIM swapping story</a> quoted one recent victim who lost $100,000 after his mobile phone number was briefly stolen in a fraudulent SIM swap. The victim said he was told by investigators in Santa Clara, Calif. that the perpetrators of his attack were able to access his T-Mobile account information using a specialized piece of software that gave them backdoor access to T-Mobile&#8217;s customer database.</p>
<p>Both the Santa Clara investigators and T-Mobile declined to confirm or deny the existence of this software. But their non-denials prompted me to start looking for it on my own. So naturally I began searching at <strong>ogusers-dot-com</strong>, a forum dedicated to the hacking, trading and sale of OG accounts. Unsurprisingly, ogusers-dot-net also has traditionally been the main stomping grounds for many individuals involved in SIM swapping attacks.</p>
<p>It didn&#8217;t take long to discover an account on ogusers-dot-com named &#8220;Ryan,&#8221; who for much of 2018 has advertised a number of different &#8220;doxing&#8221; services &#8212; specifically those aimed at finding the personal information of customers at major broadband and telecom companies.<span id="more-45569"></span></p>
<p>In some of Ryan&#8217;s sales threads, fellow forum members refer to him as &#8220;Phob&#8221; or &#8220;Phobs.&#8221; In a post on May 27, Ryan says he&#8217;s willing to pay or trade for OG accounts under the name &#8220;Ryan,&#8221; &#8220;Ryans&#8221;, &#8220;RS,&#8221; &#8220;RMS&#8221; or &#8220;Stevenson&#8221; on any decent sized popular Web site. &#8220;hmu [hit me up] in a pm [private message] to talk,&#8221; Ryan urged fellow forum members.</p>
<div id="attachment_45645" style="width: 600px" class="wp-caption aligncenter"><a class="lightbox" href="media/560740c7.ryan-lookingformyname.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/ryan-lookingformyname.png"><img class="wp-image-45645" src="media/560740c7.ryan-lookingformyname.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/ryan-lookingformyname.png" alt="" width="590" height="430" /></a><p class="wp-caption-text">The OG User forum account &#8220;Ryan&#8221; asking fellow members to sell or trade him any major Web site account name that includes the OG username &#8220;Ryan&#8221; or &#8220;Stevenson.&#8221;</p></div>
<p>I found that as late as June 2018 Ryan was offering a service that he claimed was capable of &#8220;doxing any usa carrier,&#8221; including Verizon, AT&amp;T, Sprint, T-Mobile, MetroPCS and Boost Mobile.</p>
<p>&#8220;All I need is the number,&#8221; Ryan said of his customer data lookup service, which he sold for $25 per record. &#8220;Payment BTC [bitcoin] only.&#8221;</p>
<div id="attachment_45650" style="width: 506px" class="wp-caption aligncenter"><a class="lightbox" href="media/9bb3eb45.doxinganycarrier.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/doxinganycarrier.png"><img class="wp-image-45650 size-full" src="media/9bb3eb45.doxinganycarrier.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/doxinganycarrier.png" alt="" width="496" height="664" /></a><p class="wp-caption-text">For $25 per record, Ryan offered fellow ogusers members the ability to look up customer records tied to any customer of the major U.S. mobile providers.</p></div>
<p><a href="media/c9c5fa72.aoler-hf.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/aoler-hf.png" target="_blank" rel="noopener">Very similar offerings</a> were made by Phobia&#8217;s alter ego &#8220;AOLer&#8221; on the sprawling English language online hacking community <a href="https://krebsonsecurity.com/?s=hackforums&amp;x=0&amp;y=0" target="_blank" rel="noopener">Hackforums</a>.</p>
<p>I first encountered Stevenson several years back while trying to work out who was responsible for calling in a phony hostage situation and <a href="https://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank" rel="noopener">sending a heavily armed police force to our Northern Virginia home in 2013</a>. In <a href="https://krebsonsecurity.com/2013/03/the-obscurest-epoch-is-today/" target="_blank" rel="noopener">a follow-up to that story</a>, Stevenson admitted that he was responsible for the high-profile hack against <em>Wired</em> reporter <strong>Mat Honan</strong>, who <a href="https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/" target="_blank" rel="noopener">documented</a> how a hacker named Phobia had deleted his Google account and remotely erased all data from his iPhone, iPad and MacBook.</p>
<p>Going by the nickname &#8220;Phobiathegod&#8221; at the time, Stevenson was then part of a group of young men who routinely hijacked OG account names on <strong>Microsoft&#8217;s Xbox</strong> gaming platform, often using methods that involved tricking customer service people at the target&#8217;s mobile provider into transferring the victim&#8217;s calls to a number they controlled.</p>
<p>Fast forward to today, and Phobia&#8217;s main Twitter account (pictured at the top of this post) includes the phrase &#8220;the plug&#8221; next to his profile. In SIM swapping circles, a &#8220;plug&#8221; is hacker slang for an employee at a mobile phone store who can be bribed, tricked or blackmailed into assisting with an unauthorized SIM swap.</p>
<p>Reached via instant message on LinkedIn, Stevenson acknowledged running the ISP doxing services, but said his account on the OGusers forum was since banned and that hardly anyone took him up on his offer anyway.</p>
<p>&#8220;I shouldn&#8217;t have made the threads even though no one really asked for anything,&#8221; he said. &#8220;I&#8217;m on the good side. But its almost 2019 and I need to find a new hobby I can&#8217;t be bothered to look for breaches/vulns, haven&#8217;t got 1 job offer or recommendation yet.&#8221;</p>
<p>Asked about &#8220;the plug&#8221; reference in his Twitter profile, Stevenson suddenly stopped replying. Not long after that, the @Phobia Twitter account was deactivated.</p>
<p>Stevenson denied being involved in SIM swapping attacks, but it is clear Phobia was fairly tight with many people who are or until recently were at the center of this scene. In July 2018, authorities in California arrested 20-year-old Boston resident <strong>Joel Ortiz</strong> for allegedly conducting dozens of fraudulent SIM swaps and <a href="https://motherboard.vice.com/en_us/article/a3q7mz/hacker-allegedly-stole-millions-bitcoin-sim-swapping" target="_blank" rel="noopener">stealing at least $5 million worth of cryptocurrency from victims</a>.</p>
<p>Like Phobia, Ortiz had a presence on OGusers and had acquired some of the most OG social media accounts available, including the Twitter and Instagram account names with the number zero (@0), and the OG Youtube accounts &#8220;Joel&#8221; and &#8220;X&#8221;.</p>
<p>On Oct 27, 2017, the Youtube account &#8220;Joel&#8221; published <a href="https://www.youtube.com/watch?v=If6Qs4WV7zg" target="_blank" rel="noopener">a 4-minute video</a> of Stevenson dancing to a popular rap song in front of the camera. On July 5, 2018, just days before Ortiz was arrested, the Twitter account &#8220;0&#8221; <a href="https://twitter.com/0/with_replies" target="_blank" rel="noopener">gave a shout out to @Phobia on Twitter</a> suggesting Phobia was actually tweeting using Ortiz&#8217;s &#8220;0&#8221; account.</p>


feed_id: https://krebsonsecurity.com/?p=45642
title: That Domain You Forgot to Renew? Yeah, it’s Now Stealing Credit Cards
uri: That-Domain-You-Forgot-to-Renew-Yeah-it-s-Now-Stealing-Credit-Card
url:
https://krebsonsecurity.com/2018/11/that-domain-you-forgot-to-renew-yeah-its-now-stealing-credit-cards/

content:
<p>If you own a domain name that gets decent traffic and you fail to pay its annual renewal fee, chances are this mistake will be costly for you and for others. Lately, neglected domains have been getting scooped up by crooks who use them to set up fake e-commerce sites that steal credit card details from unwary shoppers.</p>
<p>For nearly 10 years, Portland, Ore. resident <strong>Julie Randall</strong> posted pictures for her photography business at <strong>julierandallphotos-dot-com</strong>, and used an email address at that domain to communicate with clients. The domain was on auto-renew for most of that time, but a change in her credit card details required her to update her records at the domain registrar &#8212; a task Randall says she now regrets putting off.</p>
<div id="attachment_45678" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/49039fe1.jrp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/jrp.png"><img class="wp-image-45678" src="media/49039fe1.jrp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/jrp.png" alt="" width="597" height="276" /></a><p class="wp-caption-text">Julierandallphoto-dot-com is now one of hundreds of fake ecommerce sites set up to steal credit card details.</p></div>
<p>That&#8217;s because in June of this year the domain expired, and control over her site went to someone who purchased it soon after. Randall said she didn&#8217;t notice at the time because she was in the middle of switching careers, didn&#8217;t have any active photography clients, and had gotten out of the habit of checking that email account.</p>
<p>Randall said she only realized she&#8217;d lost her domain after failing repeatedly to log in to her <strong>Instagram</strong> account, which was registered to an email address at julierandallphoto-dot-com.</p>
<p>&#8220;When I tried to reset the account password through Instagram&#8217;s procedure, I could see that the email address on the account had been changed to a .ru email,&#8221; Randall told KrebsOnSecurity. &#8220;I still don&#8217;t have access to it because I don&#8217;t have access to the email account tied to my old domain. It feels a little bit like the last ten years of my life have kind of been taken away.&#8221;</p>
<p>Visit julierandallphoto.com today and you&#8217;ll see a Spanish language site selling <strong>Reebok</strong> shoes (screenshot above). The site certainly looks like a real e-commerce shop; it has plenty of product pages and images, and of course a shopping cart. But the site is noticeably devoid of any SSL certificate (the entire site is http://, not https://), and the products for sale are all advertised for roughly half their normal cost.</p>
<p>A review of the neighboring domains that reside at Internet addresses adjacent to julierandallphoto-dot-com (<strong>196.196.152/153.x</strong>, etc.) shows hundreds of other domains that were apparently registered upon expiration over the past few months and which now feature similar http-only online shops in various languages pimping low-priced, name brand shoes and other clothing.</p>
<p>Until earlier this year, <strong>wildcatgroomers-dot-com</strong> belonged to a company in Wisconsin that sold equipment for grooming snowmobile trails. It&#8217;s now advertising running shoes. Likewise, <strong>kavanaghsirishpub-dot-com</strong> corresponded to a pub and restaurant in Tennessee until mid-2018; now it&#8217;s pretending to sell cheap <strong>Nike</strong> shoes.</p>
<p>So what&#8217;s going here?</p>
<p>According to <a href="https://www.flashpoint-intel.com/blog/inside-magecart-exposes-operation-behind-webs-biggest-ecommerce-scourge/" target="_blank" rel="noopener">an in-depth report</a> jointly released today by security firms <strong>Flashpoint</strong> and <strong>RiskIQ</strong>, the sites are almost certainly set up simply to siphon payment card data from unwary shoppers looking for specific designer footwear and other clothing at bargain basement prices.</p>
<p>&#8220;We have observed more than 800 sites hosting these brand impersonation/skimming stores since June 2018,&#8221; the report notes.</p>
<p><span id="more-45642"></span></p>
<p>&#8220;This group’s strategy appears rather simple: the perpetrators set up a large number of stores impersonating as many popular brands as possible and drive traffic to these fake stores with a variety of methods,&#8221; the report continues. &#8220;Some visitors will attempt to make purchases, entering their payment information into the payment form where the skimmer copies it and sends it to a drop server. The payment page even displays badges from various security companies in order to appear more legitimate.&#8221;</p>
<p>The report tracks the work of <strong>Magecart</strong> &#8212; the name given to a collective of at least seven cybercrime groups involved in hacking Web sites to steal payment card data. On Nov. 4, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2018/11/whos-in-your-online-shopping-cart/" target="_blank" rel="noopener">Who&#8217;s in Your Online Shopping Cart?</a>, which looked at a network of hacked sites that fit the Magecart profile.</p>
<p>Credit card data stolen by these various Magecart groups invariably gets put up for sale at online cybercrime shops, the security firms found. In addition, some Magecart actors will sell access to hacked online stores, allowing crooks who buy this access to receive a live feed of freshly-stolen payment card details for as long as the site remains compromised.</p>
<p>Flashpoint and RiskIQ say they have been working with two other non-commercial anti-abuse organizations, <a href="https://krebsonsecurity.com/?s=abuse.ch&amp;x=0&amp;y=0" target="_blank" rel="noopener">Abuse.ch</a> and <a href="https://krebsonsecurity.com/?s=shadowserver&amp;x=0&amp;y=0" target="_blank" rel="noopener">Shadowserver</a> to &#8220;sinkhole&#8221; or quietly assume control over hacked domains that are used for Magecart activities. These latter two organizations provide automated reporting to affected organizations. Anyone responsible for managing a range of Internet addresses can <a href="https://www.shadowserver.org/wiki/pmwiki.php/Involve/GetReportsOnYourNetwork" target="_blank" rel="noopener">sign up at Shadowserver.org</a> to have those ranges monitored for domains compromised by Magecart tools.</p>
<p>Meanwhile, as Julie Randall&#8217;s experience shows, it pays to stay on top of any domain registrations you may have. Giving up on a long-held domain name &#8212; particularly one tied to your name &#8212; is always a tough call, because you simply never know what it will be used for when it falls into someone else&#8217;s hands.</p>
<p>If you&#8217;re on the fence about whether to renew a domain and it&#8217;s one of several you own, it may make sense to hold onto it and simply forward any incoming traffic to a domain you do want people to visit. In the event you decide to relinquish a domain, make sure you take stock of any online accounts you created with email addresses tied to that domain and move those to another email address, as those accounts will likely come under someone else&#8217;s control when the domain expires.</p>


feed_id: https://krebsonsecurity.com/?p=45693
title: Patch Tuesday, November 2018 Edition
uri: Patch-Tuesday-November-2018-Edition
url: https://krebsonsecurity.com/2018/11/patch-tuesday-november-2018-edition/
content:
<p><strong>Microsoft</strong> on Tuesday released 16 software updates to fix more than 60 security holes in various flavors of <strong>Windows</strong> and other Microsoft products. <strong>Adobe</strong> also has security patches available for <strong>Flash Player</strong>, <strong>Acrobat</strong> and <strong>Reader</strong> users.</p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />As per usual, most of the critical flaws &#8212; those that can be exploited by malware or miscreants without any help from users &#8212; reside in Microsoft&#8217;s Web browsers <strong>Edge</strong> and <strong>Internet Explorer</strong>.</p>
<p>This week&#8217;s patch batch addresses two flaws of particular urgency: One is a zero-day vulnerability (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8589" target="_blank" rel="noopener">CVE-2018-8589</a>) that is already being exploited to compromise <strong>Windows 7</strong> and <strong>Server 2008</strong> systems.</p>
<p>The other is a publicly disclosed bug in Microsoft&#8217;s <strong>Bitlocker</strong> encryption technology (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8566" target="_blank" rel="noopener">CVE-2018-8566</a>) that could allow an attacker to get access to encrypted data. One mitigating factor with both security holes is that the attacker would need to be already logged in to the targeted system to exploit them.</p>
<p>Of course, if the target has Adobe Reader or Acrobat installed, it might be easier for attackers to achieve that log in. According to <a href="https://blog.qualys.com/laws-of-vulnerabilities/2018/11/13/november-2018-patch-tuesday-62-vulns-tftp-server-rce-adobe-poc" target="_blank" rel="noopener">analysis</a> from security vendor <strong>Qualys</strong>, there is now code publicly available that could force these two products to leak a hash of the user&#8217;s Windows password (which could then be cracked with open-source tools). A <a href="https://helpx.adobe.com/security/products/acrobat/apsb18-40.html" target="_blank" rel="noopener">new update</a> for Acrobat/Reader fixes this bug, and Adobe has published some <a href="https://helpx.adobe.com/acrobat/kb/mitigation-NTLM-dictionary-attacks.html" target="_blank" rel="noopener">mitigation suggestions</a> as well.<span id="more-45693"></span></p>
<p>In addition, Adobe pushed out <a href="https://helpx.adobe.com/security/products/flash-player/apsb18-39.html" target="_blank" rel="noopener">a security update</a> for Windows, Mac, Linux and Chrome versions of <strong>Flash Player</strong>. The update fixes just one vulnerability in Flash, but I&#8217;m sure most of us would rather Flash died off completely already. Adobe said it plans to end support for the plugin in 2020. <strong>Google Chrome</strong> is now making users explicitly enable Flash every time they want to use it, and by the summer of 2019 it will <a href="https://nakedsecurity.sophos.com/2018/09/03/chrome-flash-is-almost-almost-almost-dead/" target="_blank" rel="noopener">make users go into their settings to enable it</a> every time they want to run it.</p>
<p>KrebsOnSecurity has frequently suggested that Windows users wait a day or two after Microsoft releases monthly security updates before installing the fixes, with the rationale that occasionally buggy patches can cause serious headaches for users who install them before all the kinks are worked out.</p>
<p><strong>Windows 10</strong> likes to install patches all in one go and reboot your computer on its own schedule. Microsoft doesn’t make it easy for Windows 10 users to change this setting, <a href="https://www.howtogeek.com/224471/how-to-prevent-windows-10-from-automatically-downloading-updates/" target="_blank" rel="noopener">but it is possible</a>. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in <strong>Windows Update</strong>.</p>
<p>In either case, it&#8217;s a good idea to get in the habit of backing up your data before installing Windows updates. Unlike last month, when many Windows users saw the contents of their &#8220;My Documents&#8221; folder erased by a buggy update, I&#8217;m not aware of any major issues this time around.</p>
<p>If you experience any problems installing any of these patches this month, please feel free to leave a comment about it below; there’s a good chance other readers have experienced the same and may even chime in here with some helpful tips.</p>


feed_id: https://krebsonsecurity.com/?p=45700
title: Calif. Man Pleads Guilty in Fatal Swatting Case, Faces 20+ Years in Prison
uri: Calif-Man-Pleads-Guilty-in-Fatal-Swatting-Case-Faces-20-Years-in-Pr
url:
https://krebsonsecurity.com/2018/11/calif-man-pleads-guilty-in-fatal-swatting-case-faces-20-years-in-prison/

content:
<p>A California man who pleaded guilty Tuesday to causing dozens of swatting attacks &#8212; including a deadly incident in Kansas last year &#8212; now faces 20 or more years in prison.</p>
<div id="attachment_42104" style="width: 268px" class="wp-caption alignright"><img class=" wp-image-42104" src="media/e6e75b15.tylerrajbarriss.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/tylerrajbarriss.png" alt="" width="258" height="344" /><p class="wp-caption-text">Tyler Raj Barriss, in an undated selfie.</p></div>
<p><strong>Tyler Barriss</strong>, 25, went by the nickname <strong>SWAuTistic</strong> on Twitter, and <a href="https://krebsonsecurity.com/2018/01/serial-swatter-swautistic-bragged-he-hit-100-schools-10-homes/" target="_blank" rel="noopener">reveled in perpetrating &#8220;swatting&#8221; attacks</a>. These dangerous hoaxes involve making false claims to emergency responders about phony hostage situations or bomb threats, with the intention of prompting a heavily-armed police response to the location of the claimed incident.</p>
<p>On Dec. 28, 2017, Barriss placed a call from California to police in Wichita, Kansas, claiming that he was a local resident who&#8217;d just shot his father and was holding other family members hostage.</p>
<p>When Wichita officers responded to the address given by the caller &#8212; 1033 W. McCormick &#8212; they <a href="https://krebsonsecurity.com/2017/12/kansas-man-killed-in-swatting-attack/" target="_blank" rel="noopener">shot and killed</a> 28-year-old <strong>Andrew Finch</strong>, a father of two who had done nothing wrong.</p>
<p>Barriss admitted setting that fatal swatting attack in motion after getting in the middle of a dispute between two Call of Duty gamers, 18-year-old <strong>Casey Viner</strong> from Ohio and <strong>Shane Gaskill</strong>, 20, from Wichita.</p>
<p>Viner allegedly asked Barriss to swat Gaskill. But when Gaskill noticed Barriss&#8217; Twitter account (@swattingaccount) suddenly following him online, he tried to deflect the attack. Barriss says Gaskill allegedly dared him to go ahead with the swat, but then gave Barriss an old home address &#8212; 1033 W. McCormick &#8212; which was then being occupied by Finch&#8217;s family.</p>
<p>Viner and Gaskill are awaiting trial. A more detailed account of their alleged dispute <a href="https://krebsonsecurity.com/2018/05/3-charged-in-fatal-kansas-swatting-attack/" target="_blank" rel="noopener">is told here</a>.</p>
<p>According to the <strong>Justice Department</strong>, Barriss pleaded guilty to making hoax bomb threats in phone calls to the headquarters of the <strong>FBI</strong> and the <strong>Federal Communications Commission</strong> in Washington, D.C. He also made bomb threat and swatting calls from Los Angeles to emergency numbers in Ohio, New Hampshire, Nevada, Massachusetts, Illinois, Utah, Virginia, Texas, Arizona, Missouri, Maine, Pennsylvania, New Mexico, New York, Michigan, Florida and Canada.</p>
<p>U.S. Attorney <strong>Stephen McAllister</strong> said Barriss faces 20 years or more in prison. Barriss is due to be sentenced Jan. 30, 2019.</p>
<p>Many readers following this story over the past year have commented here that the officer who fired the shot which killed Andrew Finch should also face prosecution. However, the district attorney for the county that encompasses Wichita decided in April that the officer <a href="https://www.kansas.com/news/local/crime/article208738719.html" target="_blank" rel="noopener">will not face charges</a>, and will not be named because he isn&#8217;t being charged with a crime.<span id="more-45700"></span></p>
<p>As the victim of <a href="https://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank" rel="noopener">a swatting attack in 2013</a> and two other attempted swattings, I&#8217;m glad to finally see a swatting prosecution that <a href="https://krebsonsecurity.com/2017/02/men-who-sent-swat-team-heroin-to-my-home-sentenced/" target="_blank" rel="noopener">may actually serve as a deterrent</a> to this idiotic and extremely dangerous crime going forward.</p>
<p>It&#8217;s also great to see police departments like Seattle&#8217;s <a href="https://www.king5.com/article/news/local/seattle-police-create-registry-to-combat-swatting/281-599806618" target="_blank" rel="noopener">taking steps to help head off swatting incidents</a> before they happen. Last month, the Seattle Police 911 Center launched a new program that lets residents <a href="https://www.youtube.com/watch?v=q04L4crzL_U&amp;feature=youtu.be" target="_blank" rel="noopener">register their address and corresponding concerns</a> if they feel they may be the target of swatting.</p>
<p>But it would also be nice if more police forces around the country received additional training on exercising restraint in the use of deadly force, particularly in responding to hostage or bomb threat scenarios that have hallmarks of a swatting hoax.</p>
<p>For example, perpetrators of swatting often call non-emergency numbers at state and local police departments to carry out their crimes precisely because they are not local to the region and cannot reach the target&#8217;s police department by calling 911. This is exactly what Tyler Barriss did in the Wichita case and others. Swatters also often use <a href="http://www.abouttty.com/" target="_blank" rel="noopener">text-to-speech (TTY) services</a> for the hearing impaired to relay hoax swat calls, as was the case with my 2013 swatting.</p>


feed_id: https://krebsonsecurity.com/?p=45718
title: USPS Site Exposed Data on 60 Million Users
uri: USPS-Site-Exposed-Data-on-60-Million-Users
url: https://krebsonsecurity.com/2018/11/usps-site-exposed-data-on-60-million-users/
content:
<p><strong>U.S. Postal Service</strong> just fixed a security weakness that allowed anyone who has an account at <strong>usps.com</strong> to view account details for some 60 million other users, and in some cases to modify account details on their behalf.</p>
<div id="attachment_45608" style="width: 600px" class="wp-caption aligncenter"><img class=" wp-image-45608" src="media/bcca40f1.idusps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/idusps.png" alt="" width="590" height="226" /><p class="wp-caption-text">Image: USPS.com</p></div>
<p>KrebsOnSecurity was contacted last week by a researcher who discovered the problem, but who asked to remain anonymous. The researcher said he informed the USPS about his finding more than a year ago yet never received a response. After confirming his findings, this author contacted the USPS, which promptly addressed the issue.</p>
<p>The problem stemmed from an authentication weakness in a USPS Web component known as an &#8220;application program interface,&#8221; or API &#8212; basically, a set of tools defining how various parts of an online application such as databases and Web pages should interact with one another.</p>
<p>The API in question was tied to a Postal Service initiative called &#8220;<a href="https://iv.usps.com/#!/landing" target="_blank" rel="noopener"><strong>Informed Visibility</strong></a>,&#8221; which according to the USPS is designed to let businesses, advertisers and other bulk mail senders &#8220;make better business decisions by providing them with access to near real-time tracking data&#8221; about mail campaigns and packages.</p>
<p>In addition to exposing <a href="media/1d3e1363.usps-nrtd.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/usps-nrtd.jpg" target="_blank" rel="noopener">near real-time data</a> about packages and mail being sent by USPS commercial customers, the flaw let <em>any logged-in usps.com user</em> query the system for account details belonging to any other users, such as email address, username, user ID, account number, street address, phone number, authorized users, mailing campaign data and other information.</p>
<p>Many of the API&#8217;s features accepted &#8220;wildcard&#8221; search parameters, meaning <em>they could be made to return all records for a given data set without the need to search for specific terms.</em> No special hacking tools were needed to pull this data, other than knowledge of how to view and modify data elements processed by a regular Web browser like Chrome or Firefox.</p>
<div id="attachment_45726" style="width: 467px" class="wp-caption aligncenter"><img class="size-full wp-image-45726" src="media/276826fe.usps-iv.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/usps-iv.png" alt="" width="457" height="596" /><p class="wp-caption-text">A USPS brochure advertising the features and benefits of Informed Visibility.</p></div>
<p>In cases where multiple accounts shared a common data element &#8212; such as a street address &#8212; using the API to search for one specific data element often brought up multiple records. For example, a search on the email addresses for readers who volunteered to help with this research turned up multiple accounts when those users had more than one user signed up at the same physical address.</p>
<p>&#8220;This is not good,&#8221; said one anonymous reader who volunteered to help with this research, after viewing a cut-and-paste of his USPS account details looked up via his email address. &#8220;Especially since we moved due to being threatened by a neighbor.&#8221;</p>
<p><strong>Nicholas Weaver</strong>, a researcher at the <a href="https://www.icsi.berkeley.edu/icsi/" target="_blank" rel="noopener">International Computer Science Institute</a> and lecturer at <strong>UC Berkeley</strong>, said the API should have validated that the account making the request had permission to read the data requested.</p>
<p><span class="pullquote pqleft">&#8220;This is not even Information Security 101, this is Information Security 1, which is to implement access control,&#8221; Weaver said.</span> &#8220;It seems like the only access control they had in place was that you were logged in at all. And if you can access other peoples&#8217; data because they aren&#8217;t enforcing access controls on reading that data, it&#8217;s catastrophically bad and I&#8217;m willing to bet they&#8217;re not enforcing controls on writing to that data as well.&#8221;</p>
<p>A cursory review by KrebsOnSecurity indicates the promiscuous API let any user request account changes for any other user, such as email address, phone number or other key details.</p>
<p>Fortunately, the USPS appears to have included a validation step to prevent unauthorized changes &#8212; at least with some data fields. Attempts to modify the email address associated with my USPS account via the API prompted a confirmation message sent to the email address tied to that account (which required clicking a link in the email to complete the change).</p>
<p>It does not appear USPS account passwords were exposed via this API, although KrebsOnSecurity conducted only a very brief and limited review of the API&#8217;s rather broad functionality before reporting the issue to the USPS. The API at issue resides <a href="https://iv.usps.com/dist/services/ivui_mt.app.services.js" target="_blank" rel="noopener">here</a>; a copy of the API prior to its modification on Nov. 20 by the USPS is <a href="https://krebsonsecurity.com/wp-content/uploads/2018/11/USPS-ID-API.txt" target="_blank" rel="noopener">available here as a text file</a>.<span id="more-45718"></span></p>
<p>The ability to modify database entries related to Informed Visibility user accounts could create problems for the <a href="https://krebsonsecurity.com/wp-content/uploads/2018/11/uspsquery.txt" target="_blank" rel="noopener">USPS&#8217;s largest customers</a> &#8212; think companies like <strong>Netflix</strong> and others that get discounted rates for high volumes. For instance, the API allowed any user to convert regular usps.com accounts to Informed Visibility business accounts, and vice versa.</p>
<p>Spammers and email scam artists also could have a field day with this USPS vulnerability, said <strong>Robert Hansen</strong>, chief technology officer at <a href="https://bitdiscovery.com/" target="_blank" rel="noopener">Bit Discovery</a>, a security firm in Austin, Texas.</p>
<p>&#8220;This could easily be leveraged to build up mass targeted spam or spear phishing,&#8221; Hansen said. &#8220;It should have been protected via authentication and validated against the logged in user in question.&#8221;</p>
<p>According to a somewhat redacted <a href="media/bed957a0.IT-AR-19-001.pdf" data-original-source="https://www.uspsoig.gov/sites/default/files/document-library-files/2018/IT-AR-19-001.pdf" target="_blank" rel="noopener">vulnerability assessment of Informed Visibility</a> (PDF) published in October 2018 by the USPS&#8217;s <strong>Office of Inspector General</strong> (OIG), auditors found a number of authentication and encryption weaknesses in the service. But they seemed to have overlooked this rather glaring security problem. The USPS told the OIG it had addressed the authentication problems raised in the audit report, which appear to have been related to how data was encrypted in transit.</p>
<p>The API vulnerability is the latest security stumble for the Postal Service&#8217;s efforts to modernize operations. The Informed Visibility program is the sister initiative to the USPS&#8217;s <strong>Informed Delivery</strong> service, which lets residents view scanned images of all incoming mail. The API vulnerability affected all usps.com users, including some 13 million Informed Delivery users.</p>
<p>As detailed <a href="https://krebsonsecurity.com/?s=informed+delivery&amp;x=0&amp;y=0" target="_blank" rel="noopener">in numerous stories here</a>, Informed Delivery has struggled to implement security features that might prevent abuse of the system by identity thieves and other ne&#8217;er-do-wells.</p>
<p>Earlier this month, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/11/u-s-secret-service-warns-id-thieves-are-abusing-uspss-mail-scanning-service/" target="_blank" rel="noopener">broke the news</a> that the <strong>U.S. Secret Service</strong> issued an internal memo about identity thieves abusing Informed Delivery to aid in mail theft. The story cited cases in multiple states involving scammers who ordered new credit cards in the names of victims, and then signed up as those victims at Informed Delivery once the cards were sent &#8212; thereby allowing the thieves to tell exactly when the new credit cards would be arriving in the mail.</p>
<p>Although fixing information disclosure and authentication weaknesses is often quite simple, it’s remarkable how many organizations that should know better don’t invest the resources needed to find and address them. In September, this author detailed how a company used by thousands of state and local governments to accept online payments was <a href="https://krebsonsecurity.com/2018/09/govpaynow-com-leaks-14m-records/" target="_blank" rel="noopener">leaking more than 14 million records</a>.</p>
<p>In August, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/08/fiserv-flaw-exposed-customer-data-at-hundreds-of-banks/" target="_blank" rel="noopener">disclosed a similar flaw</a> at work across hundreds of small bank Web sites run by <strong>Fiserv</strong>, a major provider of technology services to financial institutions.</p>
<p>In July, identity theft protection service <strong>LifeLock</strong> corrected an information disclosure flaw that <a href="https://krebsonsecurity.com/2018/07/lifelock-bug-exposed-millions-of-customer-email-addresses/" target="_blank" rel="noopener">exposed the email address of millions of subscribers</a>. And in April 2018, PaneraBread.com <a href="https://krebsonsecurity.com/2018/04/panerabread-com-leaks-millions-of-customer-records/" target="_blank" rel="noopener">remedied a weakness</a> exposing millions of customer names, email and physical addresses, birthdays and partial credit card numbers.</p>
<p>Got a tip about a security vulnerability similar to those detailed above, or perhaps something more serious? Please drop me a note at krebsonsecurity @ gmail.com.</p>


feed_id: https://krebsonsecurity.com/?p=45766
title: How to Shop Online Like a Security Pro
uri: How-to-Shop-Online-Like-a-Security-Pro
url: https://krebsonsecurity.com/2018/11/how-to-shop-online-like-a-security-pro/
content:
<p>&#8216;Tis the season when even those who know a thing or two about Internet scams tend to let down their guard in the face of an eye-popping discount or the stress of last-minute holiday shopping. So here&#8217;s a quick refresher course on how to make it through the next few weeks without getting snookered online.</p>
<p><img class="aligncenter size-full wp-image-45775" src="media/fa5c608b.shoppingonline.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/shoppingonline.jpg" alt="" width="500" height="334" /></p>
<p>Adopting a shopping strategy of simply buying from the online merchant with the lowest advertised prices can be a bit like playing Russian Roulette with your wallet, for the simple reason that there are <a href="https://krebsonsecurity.com/2018/11/that-domain-you-forgot-to-renew-yeah-its-now-stealing-credit-cards/" target="_blank" rel="noopener">tons of completely fake e-commerce sites out there</a> looking to separate the unwary from their credit card details.</p>
<p>Even people who shop mainly at big-name online stores can get scammed if they&#8217;re not wary of too-good-to-be-true offers. For example, <a href="https://krebsonsecurity.com/2017/04/how-cybercrooks-put-the-beatdown-on-my-beats/" target="_blank" rel="noopener">KrebsOnSecurity got taken for hundreds of dollars just last year</a> after trying to buy a pricey Sonos speaker from an established Amazon merchant who was selling it new and unboxed at huge discount.</p>
<p>I later received an email from the seller, who said his Amazon account had been hacked and abused by scammers to create fake sales. Amazon ultimately refunded the money, but if this happens to you around the holidays it could derail plans to get all your shopping done before the expected gift-giving day arrives.</p>
<p>Here are some other safety and security tips to keep in mind when shopping online:</p>
<p><strong>-WHEN IN DOUBT, CHECK &#8216;EM OUT:</strong> If you don’t know much about the online merchant that has the item you wish to buy, take a few minutes to investigate its reputation. After all, it’s not uncommon for bargain basement phantom Web sites to materialize during the holiday season, and then vanish forever not long afterward.</p>
<p>If you’re buying from an online store that is brand new, the risk that you will get scammed increases significantly.  How do you know the lifespan of a site selling that must-have gadget at the lowest price? One easy way to get a quick idea is to run <a title="http://whois.domaintools.com/krebsonsecurity.com" href="http://whois.domaintools.com/krebsonsecurity.com">a basic WHOIS search</a> on the site’s domain name. The more recent the site’s “created&#8221; date, the more likely it is a phantom store.</p>
<p><strong>-USE A CREDIT CARD:</strong> It’s nearly impossible for consumers to tell how secure a main street or online merchant is, and safety seals or attestations that something is &#8220;hacker safe&#8221; are a guarantee of nothing. In my experience, such sites are <a href="https://krebsonsecurity.com/2018/11/whos-in-your-online-shopping-cart/" target="_blank" rel="noopener">just as likely to be compromised</a> as e-commerce sites without these dubious security seals.</p>
<p>No, it’s best just to shop as if they’re all compromised. With that in mind, if you have the choice between using a credit or debit card, shop with your credit card.<span id="more-28841"></span></p>
<p>Sure, the card associations and your bank are quick to point out that you’re not liable for fraudulent charges that you report in a timely manner, whether it&#8217;s debit or a credit card. But this assurance may ring hollow if you wake up one morning to find your checking accounts emptied by card thieves after shopping at a breached merchant with a debit card.</p>
<p>Who pays for the fees levied against you by different merchants when your checks bounce? You do. Does the bank reimburse you when your credit score takes a ding because your mortgage or car payment was late? Don’t hold your breath.</p>
<p><strong>-PADLOCK, SCHMADLOCK:</strong> For years, consumers have been told to look for the padlock when shopping online. Maybe this was once sound advice. But to my mind, the &#8220;look for the lock&#8221; mantra has created a false sense of security for many Internet users, and has contributed to a dangerous and widespread misunderstanding about what the lock icon is really meant to convey.</p>
<p>To be clear, you absolutely should run away from any e-commerce site that does not include the padlock (i.e., its Web address does not begin with &#8220;https://&#8221;).  But the presence of a padlock icon next to the Web site name in your browser&#8217;s address bar does not mean the site is legitimate. Nor is it any sort of testimonial that the site has been security-hardened against intrusion from hackers.</p>
<p>The https:// part of the address merely signifies that the data being transmitted back and forth between your browser and the site is encrypted and can&#8217;t be read by third parties. Even so, anti-phishing company <strong>PhishLabs</strong> found in a survey last year that <em>more than 80% of respondents believed the green lock indicated that a website was either legitimate and/or safe</em>.</p>
<p>Now that anyone <a href="https://letsencrypt.org/" target="_blank" rel="noopener">can get SSL certificates for free</a>, phishers and other scammers that ply their trade via fake Web sites are starting to up their game. In December 2017, PhishLabs estimated that <a href="https://krebsonsecurity.com/2017/12/phishers-are-upping-their-game-so-should-you/" target="_blank" rel="noopener">a quarter of all phishing Web sites were outfitting their scam pages with SSL certificates</a> to make them appear more trustworthy. That percentage has almost certainly increased a year later.<span id="more-45766"></span></p>
<p><strong>-CHECK THE SHIPPING</strong></p>
<p>Often times, items that are advertised at steeper discounts than other online stores make up for it by charging way more than normal for shipping and handling.</p>
<p>Be careful what you agree to: Check to make sure you know how long the item will take to be shipped, and that you understand the store’s return policies. Also, keep an eye out for hidden surcharges, and be wary of blithely clicking “ok” during the checkout process.</p>
<p><strong>-DON&#8217;T TAKE THE BAIT</strong></p>
<p>Be on guard against phishing and malware schemes that take advantage of shopper distraction and frenzy during the holidays. In years past we&#8217;ve seen both leverage emails crafted to look like they were sent from a name-brand store claiming that there was a problem with your order or some component of the shipping process.</p>
<p>One perennial phishing and malware scam that seems to kick into high gear around the holidays is spam that purports to have been sent by the U.S. Postal Service, FedEx, UPS or some other shipping service, warning of a wayward package.</p>
<p>When in doubt about such a message, visit the e-commerce or shipping site directly, and avoid clicking on links or attachments in email &#8212; particularly missives that warn of some dire consequences unless you act quickly. Phishers and malware purveyors typically seize upon some kind of emergency to create a false alarm that often causes recipients to temporarily let their guard down.</p>
<p><strong>-SCOUR YOUR STATEMENTS</strong></p>
<p>Some credit card companies offer cardholders that ability to use &#8220;virtual credit cards&#8221; &#8212; apps that generate a unique, ephemeral credit card number that is good for just one purchase or for a short period of time. The idea being that if fraudsters compromise the virtual card number, your bank doesn&#8217;t have to issue you a new card and you won&#8217;t have the headache that comes with entering new card details at all of the sites where you&#8217;ve set up automatic monthly payments.</p>
<p>These virtual cards are nice in theory, but I&#8217;ve never been a big fan. Probably because in many cases they require users to have risky add-ons installed and enabled &#8212; like Java or Flash Player. But, hey, if this works for you, great.</p>
<p>Most importantly, keep a close eye on your monthly statements. If I were a fraudster, I&#8217;d most definitely wait until the holidays to cram through a bunch of unauthorized charges on stolen cards, so that the bogus purchases would get buried amid a flurry of other legitimate transactions. That&#8217;s why it&#8217;s key to closely review your credit card bill and to quickly dispute any charges you didn&#8217;t authorize.</p>
<p><strong>-BUDDY UP</strong></p>
<p>If you&#8217;re planning to spend time with friends and family this holiday season, consider giving the gift of your time and helping out with a security checkup. This might involve making sure that new or old PC has up-to-date security software and the requisite software patches, or locking down their wireless router by enabling security features and disabling risky ones.</p>
<p>If you&#8217;re visiting parents or older relatives, consider helping them <a href="https://krebsonsecurity.com/2018/06/plant-your-flag-mark-your-territory/" target="_blank" rel="noopener">plant their flags at various online sites and services</a> if they haven&#8217;t already done so, such as at the <a href="https://krebsonsecurity.com/2013/09/crooks-hijack-retirement-funds-via-ssa-portal/" target="_blank" rel="noopener">Social Security Administration</a>, the <a href="https://krebsonsecurity.com/2018/11/u-s-secret-service-warns-id-thieves-are-abusing-uspss-mail-scanning-service/" target="_blank" rel="noopener">U.S. Postal Service</a>, or their <a href="https://krebsonsecurity.com/2018/06/plant-your-flag-mark-your-territory/" target="_blank" rel="noopener">wireless phone provider and/or Internet Service Provider</a> (ISP).</p>
<p>You&#8217;d definitely make it off of Santa&#8217;s naughty list if you helped your loved ones take stock of which online accounts could benefit from <a href="https://www.twofactorauth.org" target="_blank" rel="noopener">more robust multi-factor authentication</a> &#8212; and perhaps even guiding them <a href="https://krebsonsecurity.com/2018/08/reddit-breach-highlights-limits-of-sms-based-authentication/" target="_blank" rel="noopener">away from SMS/text messages</a> for multifactor toward more secure app- or <a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/" target="_blank" rel="noopener">key-based options</a>, where available. You might even take a minute to explain the perils of re-using passwords across multiple sites, and see if they&#8217;re interested in using a password manager.</p>
<p>While you&#8217;re at it, ask your friends and family if they&#8217;ve <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener">frozen their credit files</a> at the major consumer credit bureaus. If not, talk with them about what this entails and how it can help ward off identity theft. If they&#8217;re game, you might even consider helping them set it up and ensuring that freeze PINs are securely stored so the information is easily available when and if their credit files ever need to be thawed.</p>


feed_id: https://krebsonsecurity.com/?p=45784
title: Half of all Phishing Sites Now Have the Padlock
uri: Half-of-all-Phishing-Sites-Now-Have-the-Padlock
url: https://krebsonsecurity.com/2018/11/half-of-all-phishing-sites-now-have-the-padlock/
content:
<p>Maybe you were once advised to &#8220;look for the padlock&#8221; as a means of telling legitimate e-commerce sites from phishing or malware traps. Unfortunately, this has never been more useless advice. New research indicates that half of all phishing scams are now hosted on Web sites whose Internet address includes the padlock and begins with &#8220;https://&#8221;.</p>
<div id="attachment_45793" style="width: 600px" class="wp-caption aligncenter"><a class="lightbox" href="media/b77fcb5a.payphish.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/payphish.jpg"><img class="wp-image-45793" src="media/b77fcb5a.payphish.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/payphish.jpg" alt="" width="590" height="398" /></a><p class="wp-caption-text">A live Paypal phishing site that uses https:// (has the green padlock).</p></div>
<p>Recent data from anti-phishing company <a href="https://www.phishlabs.com/" rel="noopener" target="_blank">PhishLabs</a> shows that 49 percent of all phishing sites in the third quarter of 2018 bore the padlock security icon next to the phishing site domain name as displayed in a browser address bar. That&#8217;s up from 25 percent just one year ago, and from 35 percent in the second quarter of 2018.</p>
<p>This alarming shift is notable because a majority of Internet users have taken the age-old &#8220;look for the lock&#8221; advice to heart, and still associate the lock icon with legitimate sites. A PhishLabs survey conducted last year found more than 80% of respondents believed the green lock indicated a website was either legitimate and/or safe.</p>
<p>In reality, the https:// part of the address (also called &#8220;<strong>Secure Sockets Layer</strong>&#8221; or <strong>SSL</strong>) merely signifies the data being transmitted back and forth between your browser and the site is encrypted and can’t be read by third parties. <em>The presence of the padlock does not mean the site is legitimate, nor is it any proof the site has been security-hardened against intrusion from hackers</em>.</p>
<div id="attachment_45794" style="width: 603px" class="wp-caption aligncenter"><a class="lightbox" href="media/b189cec2.fakebook.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/fakebook.jpg"><img class="wp-image-45794" src="media/b189cec2.fakebook.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/fakebook.jpg" alt="" width="593" height="402" /></a><p class="wp-caption-text">A live Facebook phish that uses SSL (has the green padlock).</p></div>
<p>Most of the battle to combat cybercrime involves defenders responding to offensive moves made by attackers. But the rapidly increasing adoption of SSL by phishers is a good example in which fraudsters are taking their cue from legitimate sites.</p>
<p>&#8220;PhishLabs believes that this can be attributed to both the continued use of SSL certificates by phishers who register their own domain names and create certificates for them, as well as a general increase in SSL due to the Google Chrome browser now displaying &#8216;Not secure&#8217; for web sites that do not use SSL,&#8221; said <strong>John LaCour</strong>, chief technology officer for the company. &#8220;The bottom line is that the presence or lack of SSL doesn’t tell you anything about a site’s legitimacy.&#8221;</p>
<p>The major Web browser makers work with a number of security organizations to index and block new phishing sites, often serving bright red warning pages that flag the page of a phishing scam and seek to discourage people from visiting the sites. But not all phishing scams get flagged so quickly.</p>
<p>I spent a few minutes browsing <a href="https://www.phishtank.com" target="_blank" rel="noopener">phishtank.com</a> for phishing sites that use SSL, and found this cleverly crafted page that attempts to phish credentials from users of <a href="https://www.bibox.com/" target="_blank" rel="noopener">Bibox</a>, a cryptocurrency exchange. Click the image below and see if you can spot what&#8217;s going on with this Web address:</p>
<p><div id="attachment_45795" style="width: 602px" class="wp-caption aligncenter"><a class="lightbox" href="media/3317fdb9.bibox.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/bibox.jpg"><img class="wp-image-45795" src="media/3317fdb9.bibox.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/bibox.jpg" alt="" width="592" height="418" /></a><p class="wp-caption-text">This live phish targets users of cryptocurrency exchange Bibox. Look carefully at the URL in the address bar, and you&#8217;ll notice a squiggly mark over the &#8220;i&#8221; in Bibox. This is an internationalized domain name, and the real address is https://www.xn--bbox-vw5a[.]com/login</p></div><span id="more-45784"></span></p>
<p>Load the live phishing page at https://www.xn--bbox-vw5a[.]com/login (that link has been hobbled on purpose) in <strong>Google Chrome</strong> and you&#8217;ll get a red &#8220;Deceptive Site Ahead&#8221; warning. Load the address above &#8212; known as &#8220;punycode&#8221; &#8212; in <strong>Mozilla Firefox</strong> and the page renders just fine, at least as of this writing.</p>
<p>This phishing site takes advantage of <strong>internationalized domain names</strong> (IDNs) to introduce visual confusion. In this case, the &#8220;i&#8221; in Bibox.com is rendered as the Vietnamese character &#8220;ỉ,&#8221; which is extremely difficult to distinguish in a URL address bar.</p>
<p>As KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/03/look-alike-domains-and-visual-confusion/" target="_blank" rel="noopener">noted in March</a>, while Chrome, <strong>Safari</strong> and recent versions of Microsoft&#8217;s <strong>Internet Explorer</strong> and <strong>Edge</strong> browsers all render IDNs in their clunky punycode state, Firefox will happily convert the code to the look-alike domain as displayed in the address bar.</p>
<p>If you’re a Firefox (or <a href="https://www.torproject.org/" rel="noopener" target="_blank">Tor</a>) user and would like Firefox to always render IDNs as their punycode equivalent when displayed in the browser address bar, type “about:config” without the quotes into a Firefox address bar. </p>
<p><img class="aligncenter wp-image-42886" src="media/bb2c0dfe.aboutpunycode.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/aboutpunycode.png" alt="" width="598" height="144" /></p>
<p>Then in the “search:” box type “punycode,” and you should see one or two options there. The one you want is called “network.IDN_show_punycode.” By default, it is set to “false”; double-clicking that entry should change that setting to “true.”</p>


feed_id: https://krebsonsecurity.com/?p=45814
title: Marriott: Data on 500 Million Guests Stolen in 4-Year Breach
uri: Marriott-Data-on-500-Million-Guests-Stolen-in-4-Year-Breach
url: https://krebsonsecurity.com/2018/11/marriott-data-on-500-million-guests-stolen-in-4-year-breach/
content:
<p>Hospitality giant <strong>Marriott</strong> today disclosed a massive data breach exposing the personal and financial information on as many as a half billion customers who made reservations at any of its <strong>Starwood</strong> properties over the past four years.</p>
<p><img class="aligncenter wp-image-45818" src="media/f8425868.spg-marriott.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/11/spg-marriott.jpg" alt="" width="592" height="363" /></p>
<p>Marriott said the breach involved unauthorized access to a database containing guest information tied to reservations made at Starwood properties on or before Sept. 10, 2018, and that its ongoing investigation suggests the perpetrators had been inside the company&#8217;s networks since 2014.</p>
<p>Marriott said the intruders encrypted information from the hacked database (likely to avoid detection by any data-loss prevention tools when removing the stolen information from the company&#8217;s network), and that its efforts to decrypt that data set was not yet complete. But so far the hotel network believes that the encrypted data cache includes information on up to approximately 500 million guests who made a reservation at a Starwood property.</p>
<p>&#8220;For approximately 327 million of these guests, the information includes some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest account information, date of birth, gender, arrival and departure information, reservation date and communication preferences,&#8221; Marriott said in <a href="http://news.marriott.com/2018/11/marriott-announces-starwood-guest-reservation-database-security-incident/" target="_blank" rel="noopener">a statement released early Friday morning</a>.</p>
<p>Marriott added that customer payment card data was protected by encryption technology, but that the company couldn&#8217;t rule out the possibility the attackers had also made off with the encryption keys needed to decrypt the data.</p>
<p>The hotel chain did not say precisely when in 2014 the breach was thought to have begun, but it&#8217;s worth noting that <a href="https://krebsonsecurity.com/2015/11/starwood-hotels-warns-of-credit-card-breach/" target="_blank" rel="noopener">Starwood disclosed its own breach involving more than 50 properties in November 2015</a>, just days after being acquired by Marriott. According to Starwood&#8217;s disclosure at the time, that earlier breach stretched back at least one year &#8212; to November 2014.<span id="more-45814"></span></p>
<p>Back in 2015, Starwood said the intrusion involved malicious software installed on cash registers at some of its resort restaurants, gift shops and other payment systems that <em>were not</em> part of the its guest reservations or membership systems.</p>
<p>However, this would hardly be the first time a breach at a major hotel chain ballooned from one limited to restaurants and gift shops into a full-blown intrusion involving guest reservation data. In Dec. 2016, KrebsOnSecurity <a href="https://krebsonsecurity.com/2016/12/holiday-inn-parent-ihg-probes-breach-claims/" target="_blank" rel="noopener">broke the news</a> that banks were detecting a pattern of fraudulent transactions on credit cards that had one thing in common: They&#8217;d all been used during a short window of time at <strong>InterContinental Hotels Group</strong> (IHG) properties, including <strong>Holiday Inns</strong> and other popular chains across the United States.</p>
<p>It took IHG <a href="https://krebsonsecurity.com/2017/02/intercontinental-confirms-breach-at-12-hotels/" target="_blank" rel="noopener">more than a month to confirm that finding</a>, but the company said in a statement at the time it believed the intrusion was limited to malware installed at point of sale systems at restaurants and bars of 12 IHG-managed properties between August and December 2016.</p>
<p>In April 2017, IHG <a href="https://krebsonsecurity.com/2017/04/intercontinental-hotel-chain-breach-expands/" target="_blank" rel="noopener">acknowledged</a> that its investigation showed cash registers at more than 1,000 of its properties were compromised with malicious software designed to siphon customer debit and credit card data &#8212; including those used at front desks in certain IHG properties.</p>
<p>Marriott says its own network does not appear to have been affected by this four-year data breach, and that the investigation only identified unauthorized access to the separate Starwood network.</p>
<p>Starwood hotel brands include W Hotels, St. Regis, Sheraton Hotels &amp; Resorts, Westin Hotels &amp; Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le Méridien Hotels &amp; Resorts, Four Points by Sheraton and Design Hotels that participate in the Starwood Preferred Guest (SPG) program.</p>
<p>Marriott is offering affected guests in the United States, Canada and the United Kingdom a <a href="https://answers.kroll.com/#collapse-Seven" target="_blank" rel="noopener">free year&#8217;s worth of service from WebWatcher</a>, one of several companies that advertise the ability to monitor the cybercrime underground for signs that the customer&#8217;s personal information is being traded or sold.</p>
<p>The breach announced today is just the latest in a long string of intrusions involving credit card data stolen from major hotel chains over the past four years &#8212; with many chains experiencing multiple breaches. In October 2017, <strong>Hyatt Hotels</strong> <a href="https://krebsonsecurity.com/2017/10/hyatt-hotels-suffers-2nd-card-breach-in-2-years/" target="_blank" rel="noopener">suffered its second card breach in as many years</a>. In July 2017, <strong>the Trump Hotel Collection</strong> was hit by <a href="https://krebsonsecurity.com/2017/07/trump-hotels-hit-by-3rd-card-breach-in-2-years/" target="_blank" rel="noopener">its third card breach in two years</a>.</p>
<p>In Sept. 2016, <strong>Kimpton Hotels</strong> <a href="https://krebsonsecurity.com/2016/09/kimpton-hotels-acknowledges-data-breach/" target="_blank" rel="noopener">acknowledged</a> a breach first disclosed by KrebsOnSecurity. Other breaches first disclosed by KrebsOnSecurity include <a href="https://krebsonsecurity.com/2015/04/white-lodging-confirms-second-breach/" target="_blank" rel="noopener">two separate incidents at White Lodging hotels</a>; <a href="https://krebsonsecurity.com/2015/03/credit-card-breach-at-mandarian-oriental/" target="_blank" rel="noopener">a 2015 incident</a> involving card-stealing malware at <strong>Mandarin Oriental</strong> properites; and a 2015 breach <a href="https://krebsonsecurity.com/2015/11/hilton-acknowledges-credit-card-breach/" target="_blank" rel="noopener">affecting Hilton Hotel properties</a> across the United States.</p>
<p>This is a developing story, and will be updated with analysis soon.</p>


feed_id: https://krebsonsecurity.com/?p=45825
title: What the Marriott Breach Says About Security
uri: What-the-Marriott-Breach-Says-About-Security
url: https://krebsonsecurity.com/2018/12/what-the-marriott-breach-says-about-security/
content:
<p>We don&#8217;t yet know the root cause(s) that forced <strong>Marriott</strong> this week to <a href="https://krebsonsecurity.com/2018/11/marriott-data-on-500-million-guests-stolen-in-4-year-breach/" target="_blank" rel="noopener">disclose a four-year-long breach</a> involving the personal and financial information of 500 million guests of its <strong>Starwood</strong> hotel properties. But anytime we see such a colossal intrusion go undetected for so long, the ultimate cause is usually a failure to adopt the most important principle in cybersecurity defense that applies to both corporations and consumers: Assume you are compromised.</p>
<h4>TO COMPANIES</h4>
<p>For companies, this principle means accepting the notion that it is no longer possible to keep the bad guys out of your networks entirely. This doesn&#8217;t mean abandoning all tenets of traditional defense, such as quickly applying software patches and using technologies to block or at least detect malware infections.</p>
<p>It means accepting that despite how many resources you expend trying to keep malware and miscreants out, all of this can be undone in a flash when users click on malicious links or fall for phishing attacks. Or a previously unknown security flaw gets exploited before it can be patched. Or any one of a myriad other ways attackers can win just by being right once, when defenders need to be right 100 percent of the time.</p>
<p>The companies run by leaders and corporate board members with advanced <a href="https://krebsonsecurity.com/2015/04/whats-your-security-maturity-level/" target="_blank" rel="noopener">security maturity</a> are investing in ways to attract and retain more cybersecurity talent, and arranging those defenders in a posture that assumes the bad guys <em>will</em> get in.</p>
<p>This involves not only focusing on breach prevention, but at least equally on intrusion detection and response. It starts with the assumption that failing to respond quickly when an adversary gains an initial foothold is like allowing a tiny cancer cell to metastasize into a much bigger illness that &#8212; left undetected for days, months or years &#8212; can cost the entire organism dearly.</p>
<p>The companies with the most clueful leaders are paying threat hunters to look for signs of new intrusions. They&#8217;re reshuffling the organizational chart so that people in charge of security report to the board, the CEO, and/or chief risk officer &#8212; anyone but the Chief Technology Officer.</p>
<p>They&#8217;re constantly testing their own networks and employees for weaknesses, and regularly drilling their breach response preparedness (much like a fire drill). And, apropos of the Marriott breach, they are finding creative ways to cut down on the volume of sensitive data that they need to store and protect.</p>
<p><a class="lightbox" href="media/5b3d8118.SecurityMaturity.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity.png"><img class="aligncenter wp-image-29580" src="media/5b3d8118.SecurityMaturity.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity.png" alt="" width="592" height="410" srcset="https://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity.png 1071w, https://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity-285x198.png 285w, https://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity-600x416.png 600w" sizes="(max-width: 592px) 100vw, 592px" /></a></p>
<h4>TO INDIVIDUALS</h4>
<p>Likewise for individuals, it pays to accept two unfortunate and harsh realities:</p>
<blockquote><p><strong>Reality #1:</strong> Bad guys already have access to personal data points that you may believe should be secret but which nevertheless aren&#8217;t, including your credit card information, Social Security number, mother&#8217;s maiden name, date of birth, address, previous addresses, phone number, and yes &#8212; even your credit file.</p>
<p><strong>Reality #2:</strong> Any data point you share with a company will in all likelihood eventually be hacked, lost, leaked, stolen or sold &#8212; usually through no fault of your own. And if you&#8217;re an American, it means (at least for the time being) your recourse to do anything about that when it does happen is limited or nil.</p></blockquote>
<p>Marriott is offering affected consumers <a href="https://answers.kroll.com/us/index.html" target="_blank" rel="noopener">a year&#8217;s worth of service</a> from a company owned by security firm <strong>Kroll</strong> that advertises the ability to scour cybercrime underground markets for your data. Should you take them up on this offer? It probably can&#8217;t hurt as long as you&#8217;re not expecting it to prevent some kind of bad outcome. But once you&#8217;ve accepted Realities #1 and #2 above it becomes clear there is nothing such services could tell you that you don&#8217;t already know.</p>
<p>Once you&#8217;ve owned both of these realities, you realize that expecting another company to safeguard your security is a fool&#8217;s errand, and that it makes far more sense to focus instead on doing everything you can to proactively prevent identity thieves, malicious hackers or other ne&#8217;er-do-wells from abusing access to said data.</p>
<p>This includes assuming that any passwords you use at one site will eventually get hacked and leaked or sold online (see Reality #2), and that as a result it is an extremely bad idea to re-use passwords across multiple Web sites. For example, <a href="https://krebsonsecurity.com/2015/01/password-re-use-fuels-starwood-fraud-spike/" target="_blank" rel="noopener">if you used your Starwood password anywhere else</a>, that other account you used it at is now at a much higher risk of getting compromised. <span id="more-45825"></span></p>
<p>By the way, if you are the type of person who likes to re-use passwords, then you definitely need to be using <a href="https://thewirecutter.com/reviews/best-password-managers/" target="_blank" rel="noopener">a password manager,</a> which helps you pick and remember strong passwords/passphrases and essentially lets you use the same strong master password/passphrase across all Web sites.</p>
<p>The<em> &#8220;</em>assume you&#8217;re compromised&#8221; philosophy involves <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener">freezing your credit files with the major credit bureaus</a>, and regularly ordering free copies of your credit file from <a href="https://www.annualcreditreport.com/index.action" target="_blank" rel="noopener">annualcreditreport.com</a> to make sure nobody is monkeying with your credit (except you).</p>
<p>It means <a href="https://krebsonsecurity.com/2018/06/plant-your-flag-mark-your-territory/" target="_blank" rel="noopener">planting your flag</a> at various online services before fraudsters do it for you, such as at the <a href="https://krebsonsecurity.com/2013/09/crooks-hijack-retirement-funds-via-ssa-portal/" target="_blank" rel="noopener">Social Security Administration</a>, <a href="https://krebsonsecurity.com/2018/11/u-s-secret-service-warns-id-thieves-are-abusing-uspss-mail-scanning-service/" target="_blank" rel="noopener">U.S. Postal Service</a>, <a href="https://krebsonsecurity.com/?s=irs+get+transcript&amp;x=0&amp;y=0" target="_blank" rel="noopener">Internal Revenue Service</a>, <a href="https://krebsonsecurity.com/2018/06/plant-your-flag-mark-your-territory/" target="_blank" rel="noopener">your mobile provider, and your Internet service provider</a> (ISP).</p>
<p>Assuming compromise means <a href="https://krebsonsecurity.com/2018/11/half-of-all-phishing-sites-now-have-the-padlock/" target="_blank" rel="noopener">placing very little trust or confidence in anything that comes to you via email</a>. In the context of this Marriott/Starwood breach, for example, consider all the data points that attackers may now have to make a phishing or malware attack more likely to be successful: Your Starwood account number, your address, phone number, email address, passport number, dates and times of your reservations, and credit card information.</p>
<p>How hard would it be for someone to craft an email that warns of a problem with a recent reservation or with your Starwood account, urging you to click a booby trapped link or attachment to learn more? Now imagine that such targeted emails can come from any brand with whom you&#8217;ve done business (for a refresher, see <strong>Reality #2</strong> above).</p>
<p>Assuming you&#8217;re compromised means beefing up your passwords by adopting <a href="https://www.twofactorauth.org/" target="_blank" rel="noopener">more robust multi-factor authentication</a> — and perhaps even transitioning <a href="https://krebsonsecurity.com/2018/08/reddit-breach-highlights-limits-of-sms-based-authentication/" target="_blank" rel="noopener">away from SMS/text messages</a> for multifactor toward more secure app- or <a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/" target="_blank" rel="noopener">key-based options</a>.</p>
<h4>TOUGH TRADE-OFFS</h4>
<p>If the advice above sounds inconvenient, unfair and expensive for all involved, congratulations: You are well on your way to internalizing Realities #1 and #2. For better or worse, being a savvy consumer means constantly having to make difficult trade-offs between security, privacy, and convenience.</p>
<p>Oh, and you generally only get to pick two out of three of these qualities. Same goes for the trio of high-speed, high-quality, and low-cost. Or good, fast, and cheap. Again, pick two. You get the idea.</p>
<p>Unfortunately, these transactions become even more lopsided and difficult to weigh when one party to them always selects the same trade-off (e.g., fast, low-cost, and convenient). Right now, it sure seems like there aren&#8217;t a lot of consequences when huge companies that ought to know better screw up massively on security, leaving consumers and their paying customers to clean up the mess.</p>
<p>I don&#8217;t know how many more big-time privacy and security debacles we need to convince our nation&#8217;s leaders that perhaps we should enshrine in law some basic standards of care for how companies handle and secure consumer data, and what rights and expectations consumers should have when companies fail to meet those standards. Because it&#8217;s clear that unless and until this happens, some subset of businesses out there will continue to make the most expedient and short-sighted trade-offs available to them, regardless of the impact to their customers and the public at large.</p>
<p>On this point, as with many others related to Internet security and privacy, I found it hard to argue with the opinion of my home state <strong>Senator Mark Warner</strong> (D-Va.), who observed:</p>
<p>“It seems like every other day we learn about a new mega-breach affecting the personal data of millions of Americans. Rather than accepting this trend as the new normal, this latest incident should strengthen Congress’ resolve. We must pass laws that require data minimization, ensuring companies do not keep sensitive data that they no longer need. And it is past time we enact data security laws that ensure companies account for security costs rather than making their consumers shoulder the burden and harms resulting from these lapses.”</p>


feed_id: https://krebsonsecurity.com/?p=45499
title: Jared, Kay Jewelers Parent Fixes Data Leak
uri: Jared-Kay-Jewelers-Parent-Fixes-Data-Leak
url: https://krebsonsecurity.com/2018/12/jared-kay-jewelers-parent-fixes-data-leak/
content:
<p>The parent firm of bling retailers <strong>Jared</strong> and <strong>Kay Jewelers</strong> has fixed a bug in the Web sites of both companies that exposed the order information for all of their online customers.</p>
<p><img class="aligncenter wp-image-45854" src="media/0f80e08a.signet.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/signet.jpg" alt="" width="592" height="395" /></p>
<p>In mid-November 2018, KrebsOnSecurity heard from a Jared customer who found something curious after receiving a receipt via email for a pair of earrings he&#8217;d just purchased as a surprise gift for his girlfriend.</p>
<p>Dallas-based Web designer <strong>Brandon Sheehy</strong> discovered that slightly modifying the link in the confirmation email he received and pasting that into a Web browser revealed another customer&#8217;s order, including their name, billing address, shipping address, phone number, email address, items and total amount purchased, delivery date, tracking link, and the last four digits of the customer&#8217;s credit card number.</p>
<p>Sheehy said after discovering the weakness, his mind quickly turned to the various ways that crooks might exploit it.</p>
<p>&#8220;My first thought was they could track a package of jewelry to someone&#8217;s door and swipe it off their doorstep,&#8221; he said. &#8220;My second thought was that someone could call Jared&#8217;s customers and pretend to be Jared, reading the last four digits of the customer&#8217;s card and saying there&#8217;d been a problem with the order, and if they could get a different card for the customer they could run it right away and get the order out quickly. That would be a pretty convincing scam. Or just targeted phishing attacks.&#8221;</p>
<p>Concerned that his own information was similarly exposed, Sheehy contacted Jared parent company <strong>Signet Jewelers</strong> and asked them to fix the data exposure. When several weeks passed and Sheehy could still view his information and that of other Jared customers, he reached out to KrebsOnSecurity.</p>
<p><a href="https://www.linkedin.com/in/scott-lancaster-cism-6788461/" target="_blank" rel="noopener"><strong>Scott Lancaster</strong></a>, chief information security officer at Signet, said the company did fix the problem for all future orders shortly after receiving a customer&#8217;s complaint. But Lancaster said Signet neglected to remedy the data exposure <em>for all past orders</em> until contacted by KrebsOnSecurity.</p>
<p>&#8220;When a customer first brought this matter to our attention in early November, we fixed it for all new orders going forward,&#8221; Lancaster said. &#8220;But we didn&#8217;t notice at the time that this applied to all past orders as well as future orders.&#8221;<span id="more-45499"></span></p>
<p>Lancaster said the problem affected only orders made online through jared.com and kay.com, and that the weakness was not present on the sites of the company&#8217;s other jewelry brands, such as <strong>Zales</strong> and <strong>Piercing Pagoda</strong>.</p>
<p>Data exposures like these are some of the most common yet preventable for online retailers. In July, identity theft protection service <strong>LifeLock</strong> corrected an information disclosure flaw that <a href="https://krebsonsecurity.com/2018/07/lifelock-bug-exposed-millions-of-customer-email-addresses/" target="_blank" rel="noopener">exposed the email address of millions of subscribers</a>. And in April 2018, PaneraBread.com <a href="https://krebsonsecurity.com/2018/04/panerabread-com-leaks-millions-of-customer-records/" target="_blank" rel="noopener">remedied a weakness</a> exposing millions of customer names, email and physical addresses, birthdays and partial credit card numbers.</p>
<p>Sheehy said he&#8217;s glad Signet has fully fixed the bug, but said he was annoyed that it seems like many companies fail to address or even acknowledge such failures unless and until they&#8217;re confronted by the news media.</p>
<p>&#8220;Being a Web developer, the only thing I can chalk this up to is complete incompetence, and being very lazy and indifferent to your customers&#8217; data,&#8221; he said. &#8220;This isn&#8217;t novel stuff, it&#8217;s basic Web site security.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=45880
title: A Breach, or Just a Forced Password Reset?
uri: A-Breach-or-Just-a-Forced-Password-Reset
url: https://krebsonsecurity.com/2018/12/a-breach-or-just-a-forced-password-reset/
content:
<p>Software giant <strong>Citrix Systems</strong> recently forced a password reset for many users of its <a href="https://en.wikipedia.org/wiki/ShareFile" target="_blank" rel="noopener">Sharefile</a> content collaboration service, warning it would be doing this on a regular basis in response to password-guessing attacks that target people who re-use passwords across multiple Web sites. Many Sharefile users interpreted this as a breach at Citrix and/or Sharefile, but the company maintains that&#8217;s not the case. Here&#8217;s a closer look at what happened, and some ideas about how to avoid a repeat of this scenario going forward.</p>
<p>The notice sent to ShareFile users looked like this:</p>
<p><img class="aligncenter wp-image-45893" src="media/02cc2d8b.sharefile.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/sharefile.jpg" alt="" width="588" height="352" /></p>
<p>Dozens of readers forwarded the above message to KrebsOnSecurity, saying they didn&#8217;t understand the reasoning for the mass password reset and that they suspected a breach at ShareFile.</p>
<p>I reached out to ShareFile and asked them point blank whether this reset effort was in response to any sort of intrusion at Citrix or ShareFile; they said no. I asked if this notice had been sent to everyone, and inquired whether ShareFile offers any form(s) of multi-factor authentication options that customers could use to supplement the security of passwords.</p>
<p>A Citrix spokesperson referred me to <a href="https://support.citrix.com/article/CTX208336" target="_blank" rel="noopener">this page</a>, which says ShareFile users have a number of options when it comes to locking down their accounts with multi-factor authentication, including a one-time code sent via SMS/text message, as well as one-time passwords generated by support authenticator mobile apps from Google and Microsoft (app-based multi-factor is the more secure option, <a href="https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/" target="_blank" rel="noopener">as discussed here</a>).</p>
<p>More importantly, the Citrix spokesperson said the company did not enforce a password reset on accounts that were using multi-factor authentication. To wit:</p>
<p>&#8220;This is not in response to a breach of Citrix products or services,&#8221; wrote spokesperson <strong>Jamie Buranich</strong>. &#8220;Citrix forced password resets with the knowledge that attacks of this nature historically come in waves. Attacker’s additional efforts adapt to the results, often tuning the volume and approach of their methods. Our objective was to minimize the risk to our customers. <em>We did not enforce a password reset on accounts that are using more stringent authentication controls </em>[emphasis added]. Citrix also directly integrates with common SSO solutions, which significantly reduces risk.&#8221;<span id="more-45880"></span></p>
<p>The company did not respond to questions about why it decided to adopt regular password resets as a policy when doing so flies in the face of password and <a href="https://pages.nist.gov/800-63-FAQ/#q-b5" target="_blank" rel="noopener">authentication best practices</a> recommended the <strong>National Institute of Standards and Technology</strong> (NIST), which <a href="https://pages.nist.gov/800-63-FAQ/#q-b5" target="_blank" rel="noopener">warns</a>:</p>
<blockquote><p>“Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.”</p></blockquote>
<p>NIST explains its rationale for steering organizations away from regular forced password resets thusly:</p>
<blockquote><p>&#8220;Users tend to choose weaker memorized secrets when they know that they will have to change them in the near future. When those changes do occur, they often select a secret that is similar to their old memorized secret by applying a set of common transformations such as increasing a number in the password. This practice provides a false sense of security if any of the previous secrets has been compromised since attackers can apply these same common transformations.&#8221;</p>
<p>&#8220;But if there is evidence that the memorized secret has been compromised, such as by a breach of the verifier’s hashed password database or observed fraudulent activity, subscribers should be required to change their memorized secrets. However, this event-based change should occur rarely, so that they are less motivated to choose a weak secret with the knowledge that it will only be used for a limited period of time.&#8221;</p></blockquote>
<p>In short, NIST says it makes sense to force an across-the-board password reset following a breach &#8212; either of a specific user&#8217;s account or the entire password database. But doing so at regular intervals absent such evidence of compromise is likely to result in less complex and secure passwords.</p>
<p>Ideally, ShareFile users who received a password reset notice can avoid the next round of password resets by adopting one of the two-step authentication options mentioned above. And I hope it goes without saying, but please don&#8217;t re-use a password you used anywhere else.</p>
<p>However, if you are the type of person who likes to re-use passwords, then you definitely need to be using <a href="https://thewirecutter.com/reviews/best-password-managers/" target="_blank" rel="noopener">a password manager,</a> which helps you pick and remember strong passwords/passphrases and essentially lets you use the same strong master password/passphrase across all Web sites.</p>
<p>Incidentally, there are several companies &#8212; such as <a href="https://auth0.com/blog/breached-password-detection-anniversary/" target="_blank" rel="noopener">auth0</a> and <a href="https://developer.okta.com/blog/2018/06/11/how-to-prevent-your-users-from-using-breached-passwords" target="_blank" rel="noopener">Okta</a> &#8212; that make it easy to <a href="https://haveibeenpwned.com/API/Consumers" target="_blank" rel="noopener">integrate</a> with breached password databases like Troy Hunt&#8217;s <a href="https://haveibeenpwned.com/" target="_blank" rel="noopener">HaveIBeenPwned.com</a> to help proactively prevent users from picking passwords they have used at other sites (or at least at other sites that have been breached publicly).</p>
<p>Whether online merchants are willing to adopt such preemptive approaches is another matter, said <strong>Julie Conroy</strong>, research director with the <a href="https://www.aitegroup.com" target="_blank" rel="noopener">Aite Group</a>, a market analyst firm.</p>
<p>&#8220;With the reality that such a vast swath of username/password combinations have been compromised, this creates the potential for a ton of inline friction, something that is an anathema to merchants, and which banks work hard to stay away from as well,&#8221; Conroy said.</p>
<p><strong>Update: 4:53 p.m. ET:</strong> Citrix just published its own blog post about this <a href="https://www.citrix.com/blogs/2018/12/04/citrix-forces-password-reset-to-protect-against-credential-stuffing/" target="_blank" rel="noopener">here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=45917
title: Bomb Threat Hoaxer, DDos Boss Gets 3 Years
uri: Bomb-Threat-Hoaxer-DDos-Boss-Gets-3-Years
url: https://krebsonsecurity.com/2018/12/bomb-threat-hoaxer-ddos-boss-gets-3-years/
content:
<p>The ringleader of a gang of cyber hooligans that made bomb threats against hundreds of schools and launched distributed denial-of-service (DDoS) attacks against Web sites &#8212; including KrebsOnSecurity on multiple occasions &#8212; has been sentenced to three years in a U.K. prison, and faces the possibility of additional charges from U.S.-based law enforcement officials.</p>
<p><strong>George Duke-Cohan</strong>, 19, caused a massive uproar earlier this year after communicating a series of bomb threats against 1,700 schools, colleges and universities across the United Kingdom. But shortly after being arrested on suspicion of the threats and released, Duke-Cohan was back at it again &#8212; this time expanding his threats to include schools in the United States.</p>
<div id="attachment_45027" style="width: 558px" class="wp-caption aligncenter"><img class="size-full wp-image-45027" src="media/267d1780.apophis-tweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/apophis-tweet.png" alt="" width="548" height="442" /><p class="wp-caption-text">One of many tweets from the attention-starved Apophis Squad, which launched multiple DDoS attacks against KrebsOnsecurity over the past few months.</p></div>
<p>At the same time, authorities in the U.K. and U.S. discovered that Duke-Cohan was responsible for falsely reporting the hijack of a plane bound for the United States. That flight, which had almost 300 passengers on board, was later quarantined in San Francisco pending a full security check.</p>
<p>Duke-Cohan was part of an attention-seeking group of ne&#8217;er-do-wells who called themselves the <strong>Apophis Squad</strong>. Duke-Cohan and his crew modeled themselves after the actions of the <a href="https://krebsonsecurity.com/?s=lizard+squad&amp;x=0&amp;y=0" target="_blank" rel="noopener">Lizard Squad</a>, another group of e-fame seeking online hoodlums who also ran a DDoS-for-hire service, called in bomb threats to airlines, DDoSed this Web site repeatedly and whose members were nearly all subsequently arrested and charged with various cybercrimes.</p>
<p>Indeed, until recently the Apophis Squad’s Web site and DDoS-for-hire service was hosted on the same Internet server used by a handful of other domains that were tied to the Lizard Squad.<span id="more-45917"></span></p>
<p>Earlier this year, KrebsOnSecurity.com came under sustained attack from the Apophis Squad, who took to Twitter to taunt this author while the attacks were underway. Duke-Cohan and other Apophis Squad members also attacked the free email service <strong>Protonmail</strong>, even as all of them continued to use their Protonmail accounts to communicate about the attacks.</p>
<p>KrebsOnSecurity assisted Protonmail in its investigation into the attacks, and the company <a href="https://krebsonsecurity.com/2018/09/leader-of-ddos-for-hire-gang-pleads-guilty-to-bomb-threats/" target="_blank" rel="noopener">later credited this author</a> with helping to identify Duke-Cohan as the driving force behind the DDoS attacks.</p>
<p>Sources close to the investigation say Duke-Cohan may yet see additional charges from U.S.-based authorities. Also, several other members identified by this author as alleged co-conspirators along with Duke-Cohan have not yet been charged with a crime either in the U.K. or in the United States.</p>
<p>It&#8217;s not always fun when your site isn&#8217;t responsive because of determined attacks from groups like the Apophis Squad, but I try not to get too bent out of shape when these attacks do occur &#8212; mainly for two reasons: Firstly, those responsible typically end up getting busted and going to jail. Also, I usually get at least one good story out of it. In this case, make that <a href="https://krebsonsecurity.com/2018/09/leader-of-ddos-for-hire-gang-pleads-guilty-to-bomb-threats/" target="_blank" rel="noopener">two good stories</a>.</p>
<p>Further reading:</p>
<p><a href="https://www.bbc.com/news/uk-england-beds-bucks-herts-46482790" target="_blank" rel="noopener">Schools Bomb Hoaxes: Teenager Jailed for Nationwide Threats</a></p>


feed_id: https://krebsonsecurity.com/?p=45931
title: How Internet Savvy are Your Leaders?
uri: How-Internet-Savvy-are-Your-Leaders
url: https://krebsonsecurity.com/2018/12/how-internet-savvy-are-your-leaders/
content:
<p>Back in April 2015, <a href="https://twitter.com/briankrebs/status/593144405386731522" target="_blank" rel="noopener">I tweeted</a> about receiving a letter via snail mail suggesting the search engine rankings for a domain registered in my name would suffer if I didn&#8217;t pay a bill for some kind of dubious-looking service I&#8217;d never heard of. But it wasn&#8217;t until the past week that it become clear how many organizations &#8212; including towns, cities and political campaigns &#8212; actually have fallen for this brazen scam.</p>
<div id="attachment_45949" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/576e455e.wkbw.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/wkbw.png"><img class="wp-image-45949" src="media/576e455e.wkbw.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/wkbw.png" alt="" width="597" height="674" /></a><p class="wp-caption-text">Image: Better Business Bureau.</p></div>
<p>The letter I tweeted about was from a company called <strong>Web Listings Inc.</strong>, and it said I should pay a $85 charge for an &#8220;annual web site search engine&#8221; service.</p>
<p>The first clue that this was probably a scam was the letter said halfway down in capital letters &#8220;THIS IS NOT A BILL,&#8221; although it sure was made to look like one. Also, the domain it referenced was &#8220;<a href="https://web.archive.org/web/20150606220940/http://blog.fortinet.com/post/pushdo-revolutions-communication-encryption-and-decoy-traffic" target="_blank" rel="noopener">fuckbriankrebs.com</a>,&#8221; which was indeed registered using my street address but certainly not by me.</p>
<p>The sad truth is plenty of organizations *are* paying the people behind this charade, which is probably why Web Listings has been running it continuously for more than a decade. Most likely that&#8217;s because some percentage of recipients confuse this notice with a warning about a domain name they own that is about to expire and needs to be renewed.</p>
<p>We know plenty of people are getting snookered thanks to searchable online records filed by a range of political campaigns, towns, cities and municipalities &#8212; all of which are required to publicly report how they spend their money (or at least that of their constituents).</p>
<p>According to a statement filed with the <strong>Federal Election Commission</strong>, <span class="pullquote pqleft">one of the earliest public records involving a payment to Web Listings dates back to 2008 and comes from none other than the <a href="http://docquery.fec.gov/pres/2008/M4/C00431569/B_PAYEE_C00431569.html" target="_blank" rel="noopener">the 2008 Hillary Clinton for President fund</a>.</span></p>
<p>The documents unearthed in this story all came compliments of <a href="https://krebsonsecurity.com/?s=guilmette&amp;x=0&amp;y=0" target="_blank" rel="noopener">Ron Guilmette</a>, a most dogged and intrepid researcher who usually spends his time tracking down and suing spammers. Guilmette said most of the public references he found regarding payments to Web Services Inc. are from political campaigns and small towns.</p>
<p>&#8220;Which naturally raises the question: Should we really be trusting these people with our money?&#8221; Guilmette said. &#8220;What kind of people or organizations are most likely to pay a bill that is utterly phony baloney, and that actually isn&#8217;t due and payable? The answer is people and organizations that are not spending their own money.&#8221;</p>
<p>Also <a href="media/c4b36f3c.2002306-2015-3-242.pdf" data-original-source="https://www.phila.gov/records/CampaignFinance/pdfs/2015cycle3/2002306-2015-3-242.pdf" target="_blank" rel="noopener">paying $85</a> (PDF) to Web Listings was the 2015 campaign for Democrat <a href="https://en.wikipedia.org/wiki/Jim_Kenney" target="_blank" rel="noopener">Jim Kenney</a>, the current mayor of Philadelphia.</p>
<p>A fund for the New York City Council campaign of <a href="https://www.politico.com/states/new-york/city-hall/story/2013/01/zead-ramadan-president-of-cair-ny-braces-for-a-city-council-run-000000" target="_blank" rel="noopener">Zead Ramadan</a> (D) <a href="http://www.elections.ny.gov:8080/reports/rwservlet?cmdkey=efs_sch_report+p_filer_id=C88281+p_e_year=2013+p_freport_id=K+p_transaction_code=F" target="_blank" rel="noopener">forked over $85</a> to Web Listings in 2013.</p>
<p class="p1"><span class="s1">Also in 2013, the Committee to Elect Judge <strong>Victor Heutsche </strong>(D) <a href="https://www.campaignfinanceonline.pa.gov/Pages/ShowReport.aspx?ReportID=123636&amp;isStatement=0&amp;is24Hour=0" target="_blank" rel="noopener">paid $85</a> to keep his Web site in good standing with Web Listings. </span><span class="s1"><a href="https://en.wikipedia.org/wiki/Paul_Davis_(Kansas_politician)" target="_blank" rel="noopener">Paul T. Davis</a>, a former Democratic state representative from Kansas <a href="media/4df86a8a.H046PD_201210.pdf" data-original-source="http://ethics.ks.gov/CFAScanned/House/2012ElecCycle/201210/H046PD_201210.pdf" target="_blank" rel="noopener">handed $85</a> (PDF) to Web Listings in 2012.<br />
</span><span id="more-45931"></span></p>
<div id="attachment_45949" style="width: 599px" class="wp-caption aligncenter"><img class=" wp-image-45949" src="media/576e455e.wkbw.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/wkbw.png" alt="" width="589" height="666" /><p class="wp-caption-text">Image: Better Business Bureau.</p></div>
<p class="p1">Lest anyone think that somehow Democratic candidates for office are more susceptible to these types of schemes, a review of the publicly-searchable campaign payments to Web Listings Inc. uncovered by Guilmette shows a majority of them were for Web sites supporting Republican candidates.</p>
<p>The Friends of <a href="https://www.legis.state.pa.us/cfdocs/legis/home/member_information/house_bio.cfm?id=289" target="_blank" rel="noopener">Mike Turzai</a> committee <a href="https://www.campaignfinanceonline.pa.gov/Pages/ShowReport.aspx?ReportID=104179&amp;isStatement=0&amp;is24Hour=0" target="_blank" rel="noopener">spent $65</a> in 2010 on the GOP Representative from Pennsylvania.</p>
<p class="p1"><span class="s1">The fundraising committee for Republican <a href="https://en.wikipedia.org/wiki/Dick_Black_(politician)" target="_blank" rel="noopener">Dick Black</a>&#8216;s 2012 campaign for the Virginia Senate also paid Web Listings Inc. $85. The campaign to elect </span><span class="s1"><a href="https://en.wikipedia.org/wiki/Ben_Chafin" target="_blank" rel="noopener">Ben Chafin</a> as a Republican delegate in Virginia in 2013 <a href="http://cfreports.sbe.virginia.gov/Report/ScheduleD/24930?page=2" target="_blank" rel="noopener">also paid out</a>. </span></p>
<p class="p1"><a href="https://en.wikipedia.org/wiki/Robert_Montgomery_(politician)" target="_blank" rel="noopener">Robert Montgomery</a>, a former GOP state representative in Kansas, <a href="media/ec2bab4b.H015RM_201301.pdf" data-original-source="http://ethics.ks.gov/CFAScanned/House/2012ElecCycle/201301/H015RM_201301.pdf" target="_blank" rel="noopener">paid $85</a> (PDF) to Web Listings in 2012.</p>
<p class="p1"><span class="s1">Those in charge of the purse strings for the &#8220;Friends of GOP New York State Senator <a href="https://www.nysenate.gov/senators/thomas-d-croci" target="_blank" rel="noopener">Tom Croci&#8221;</a> fund <a href="http://www.elections.ny.gov:8080/reports/rwservlet?cmdkey=efs_sch_report+p_filer_id=C84384+p_e_year=2011+p_freport_id=D+p_transaction_code=F" target="_blank" rel="noopener">paid $65 in 2011</a> to keep his political Web site full of search engine goodness.<br />
</span></p>
<p class="p1"><span class="s1">Paying $85 each to Web Listings in 2012 were the judicial campaigns for Louisiana GOP <a href="https://ballotpedia.org/John_B._Slattery,_Jr." target="_blank" rel="noopener">Judge John Slattery</a>, and <a href="https://en.wikipedia.org/wiki/Lynn_D._Stewart_(politician)" target="_blank" rel="noopener">Lynn Donald Stewart</a>, who successfully got re-elected to the Nevada state assembly that year.</span></p>
<p>Perhaps the most reliable customers of Web Listings&#8217; dubious services have been cities, towns and municipalities across the United States. Somehow, the people in charge of the purse strings for <a href="https://en.wikipedia.org/wiki/Simpson_County,_Kentucky" target="_blank" rel="noopener">Simpson County, Kentucky</a> paid $85 notices from Web Listings Inc. <em>three years in a row</em> (<a href="media/5dcf5891.minutes20160607.pdf" data-original-source="http://www.simpsoncounty.us/minutes/minutes20160607.pdf" target="_blank" rel="noopener">2016</a>, <a href="media/18f81370.minutes20170516.pdf" data-original-source="http://www.simpsoncounty.us/minutes/minutes20170516.pdf" target="_blank" rel="noopener">2017</a> and <a href="media/18ba2818.minutes20180515.pdf" data-original-source="http://www.simpsoncounty.us/minutes/minutes20180515.pdf" target="_blank" rel="noopener">2018)</a>.</p>
<p>Other state and local governments that paid Web Listings for their imaginary services include <a href="http://www.epcounty.com/meetings/commcourt/2013-08-26/5/claims0822.txt" target="_blank" rel="noopener">El Paso County</a> in Texas; the <a href="https://www.watertownsd.us/AgendaCenter/ViewFile/Agenda/_08192013-135?MOBILE=ON" target="_blank" rel="noopener">city council of Watertown, S.D</a>.; the <a href="media/af9e7c03.June_2015_claim_report.pdf" data-original-source="http://www.cudahy-wi.gov/June_2015_claim_report.pdf" target="_blank" rel="noopener">City of Cudahy, Wisconsin</a>; the <span class="s1"><a href="media/b768810b.010611.pdf" data-original-source="http://villageofbedfordpark.com/wp-content/uploads/2016/03/010611.pdf" target="_blank" rel="noopener">Village of Bedford Park in Cook County, Illinois</a>; the <a href="http://www.osawatomieks.org/DocumentCenter/Home/View/197" target="_blank" rel="noopener">city council in </a></span><span class="s1">Osawatomie, Kansas; the <a href="https://webcache.googleusercontent.com/search?q=cache:APUtBJLcZqkJ:https://issuu.com/shawmedia/docs/ost-11-7-2013+&amp;cd=12&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank" rel="noopener">board of supervisors</a> in Clarke County, Iowa; <a href="http://www.leadvilleherald.com/legals/article_08e16f56-bdb8-11e7-8b5e-971efd290a81.html" target="_blank" rel="noopener">Lake County, Colorado</a>; the <a href="media/b4901087.2017-2018-Check-Register.pdf" data-original-source="http://morencibulldogs.org/wp-content/uploads/2018/07/2017-2018-Check-Register.pdf" target="_blank" rel="noopener">Morenci Areas Schools</a> in Morenci, Michigan.</span><span class="s1"> </span></p>
<p>Guilmette even found a number of bankruptcy cases where a creditor named &#8220;Web Listings, Inc.&#8221; was listed, with an amount owed being either the old price of $65.00 or else the new price of $85.00, including a c<span class="s1">reditor in the <a href="media/1ba66099.a0d127f4-4e2b-4c7f-be3f-008d0c9ac619.pdf" data-original-source="http://upshotservices.s3.amazonaws.com/files/042af18c-cee3-4947-86ba-d8fe3267c12c/a0d127f4-4e2b-4c7f-be3f-008d0c9ac619.pdf" target="_blank" rel="noopener">University General Health System, Inc. et. al. bankruptcy</a> (PDF); <a href="media/0cdac6df.ncwb08-40429.pdf" data-original-source="http://bankrupt.com/misc/ncwb08-40429.pdf" target="_blank" rel="noopener">Blue Ridge Wood Products Inc.</a>; and an organization called <a href="media/fa2c6474.Advanced_Solids_15_Sales.pdf" data-original-source="http://bankrupt.com/misc/Advanced_Solids_15_Sales.pdf" target="_blank" rel="noopener">Advanced Solids Control LLC</a> (PDF). </span></p>
<p>A review of the complaints about Web Listings Inc. left over the past few years at the <a href="https://www.bbb.org/us/ny/niagara-falls/profile/web-hosting/web-listings-inc-0041-171945887/customer-reviews" target="_blank" rel="noopener">Better Business Bureau</a> suggests that many recipients of this scam are confusing the mailer with a late payment notice from their domain registrar. As such, it&#8217;s likely this phony company has scammed a ridiculous number of consumers over the years, Guilmette observed.</p>
<p>&#8220;I&#8217;m sure they&#8217;ve conned a zillion other people who were spending their own money,&#8221; he said. &#8220;These are only the ones for which public records are available online.&#8221;</p>
<p>Stay tuned for Part Two of this story, which will look at some clues about who may be responsible for this long-running racket.</p>


