# articles

feed_id: https://krebsonsecurity.com/?p=40034
title: After AlphaBay’s Demise, Customers Flocked to Dark Market Run by Dutch Police
uri: After-AlphaBay-s-Demise-Customers-Flocked-to-Dark-Market-Run-by-Dut
url:
https://krebsonsecurity.com/2017/07/after-alphabays-demise-customers-flocked-to-dark-market-run-by-dutch-police/

content:
<p>Earlier this month, news broke that authorities had seized the Dark Web marketplace <strong>AlphaBay</strong>, an online black market that peddled everything from heroin to stolen identity and credit card data. But it wasn&#8217;t until today, when the <strong>U.S. Justice Department</strong> held a press conference to detail the AlphaBay takedown that the other shoe dropped: Police in The Netherlands for the past month have been operating <strong>Hansa Market</strong>, a competing Dark Web bazaar that enjoyed a massive influx of new customers immediately after the AlphaBay takedown.</p>
<div id="attachment_40041" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40041" src="media/457a58b0.alphabayhansamessage-580x546.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/alphabayhansamessage-580x546.png" alt="The normal home page for the dark Web market Hansa has been replaced by this message from U.S. law enforcement authorities." width="580" height="546" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/07/alphabayhansamessage-580x546.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/07/alphabayhansamessage-768x723.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/07/alphabayhansamessage-940x885.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/07/alphabayhansamessage.png 1114w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The normal home page for the dark Web market Hansa has been replaced by this message from U.S. law enforcement authorities.</p></div>
<p><strong>U.S. Attorney General Jeff Sessions</strong> called the AlphaBay closure &#8220;the largest takedown in world history,&#8221; targeting some 40,000 vendors who marketed a quarter-million listings for illegal drugs to more than 200,000 customers.</p>
<p>&#8220;By far, most of this activity was in illegal drugs, pouring fuel on the fire of a national drug epidemic,&#8221; Sessions said. &#8220;As of earlier this year, 122 vendors advertised Fentanyl. 238 advertised heroin. We know of several Americans who were killed by drugs on AlphaBay.&#8221;</p>
<p><strong>Andrew McCabe</strong>, acting director of the FBI, said AlphaBay was roughly 10 times the size of the <strong>Silk Road</strong>, a similar dark market that was <a href="https://krebsonsecurity.com/2013/10/feds-take-down-online-fraud-bazaar-silk-road-arrest-alleged-mastermind/" target="_blank">shuttered in a global law enforcement sting in October 2013</a>.</p>
<p>As impressive as those stats may be, the real coup in this law enforcement operation became evident when <strong>Rob Wainwright</strong>, director of the European law enforcement organization <strong>Europol</strong>, detailed how the closure of AlphaBay caused a virtual stampede of former AlphaBay buyers and sellers taking their business to Hansa Market, which had been quietly and completely taken over by Dutch police one month earlier &#8212; on June 20.</p>
<p>&#8220;What this meant&#8230;was that we could identify and disrupt the regular criminal activity that was happening on Hansa Market but also sweep up all of those new users that were displaced from AlphaBay and looking for a new trading plot form for their criminal activities,&#8221; Wainwright told the media at today&#8217;s press conference, which seemed more interested in asking Attorney General Sessions about <a href="https://www.nytimes.com/2017/07/19/us/politics/trump-interview-sessions-russia.html" target="_blank">a recent verbal thrashing from President Trump</a>.</p>
<p>&#8220;In fact, they flocked to Hansa in droves,&#8221; Wainwright continued. &#8220;We recorded an eight times increase in the number of human users on Hansa immediately following the takedown of AlphaBay. Since the undercover operation to take over Hansa market by the Dutch Police, usernames and passwords of thousands of buyers and sellers of illicit commodities have been identified and are the subject of follow-up investigations by Europol and our partner agencies.&#8221;<span id="more-40034"></span></p>
<p>On July 5, the same day that AlphaBay went offline, authorities in Thailand arrested <strong>Alexandre Cazes </strong>&#8212; a 25-year-old Canadian citizen living in Thailand &#8212; on suspicion of being the creator and administrator of AlphaBay. He was charged with racketeering, conspiracy to distribute narcotics, conspiracy to commit identity theft and money laundering, among other alleged crimes.</p>
<div id="attachment_40042" style="width: 573px" class="wp-caption aligncenter"><img class="size-full wp-image-40042" src="media/fdeecbcb.cazeslambo.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/cazeslambo.png" alt="Alexandre Cazes, standing in front of one of four Lamborghini sports cars he owned. Image: Hanke.io." width="563" height="472" /><p class="wp-caption-text">Alexandre Cazes, standing in front of one of four Lamborghini sports cars he owned. Image: Hanke.io.</p></div>
<p>Law enforcement authorities in the US and abroad also seized millions of dollars worth of Bitcoin and other assets allegedly belonging to Cazes, including four Lamborghini cars and three properties.</p>
<p>However, law enforcement officials never got a chance to extradite Cazes to the United States to face trial. Cazes, who allegedly went by the nicknames &#8220;Alpha02&#8221; and &#8220;Admin,&#8221; <a href="http://www.smh.com.au/world/alphabay-suspected-cofounder-alexandre-cazes-found-dead-in-thai-jail-20170715-gxburv.html" target="_blank">reportedly committed suicide</a> while still in custody in Thailand.</p>
<p>This story will be updated throughout the day. In the meantime, the Justice Department has released a redacted copy of <a href="https://www.justice.gov/opa/press-release/file/982826/download" target="_blank">the indictment against Cazes</a> (PDF), as well as a <a href="https://www.justice.gov/opa/press-release/file/982821/download" target="_blank">forfeiture complaint</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=40087
title: How a Citadel Trojan Developer Got Busted
uri: How-a-Citadel-Trojan-Developer-Got-Busted
url: https://krebsonsecurity.com/2017/07/how-a-citadel-trojan-developer-got-busted/
content:
<p>A U.S. District Court judge in Atlanta last week handed a five year prison sentence to <strong>Mark Vartanyan</strong>, a Russian hacker who helped develop and sell the once infamous and widespread <strong>Citadel</strong> banking trojan. This fact has been reported by countless media outlets, but far less well known is the fascinating backstory about how Vartanyan got caught.</p>
<p>For several years, Citadel ruled the malware scene for criminals engaged in stealing online banking passwords and emptying bank accounts. U.S. prosecutors say Citadel infected more than 11 million computers worldwide, causing financial losses of at least a half billion dollars.</p>
<p>Like most complex banking trojans, Citadel was marketed and sold in secluded, underground cybercrime markets. Often the most time-consuming and costly aspect of malware sales and development is helping customers with any tech support problems they may have in using the crimeware.</p>
<p>In light of that, one innovation that Citadel brought to the table was to crowdsource some of this support work, easing the burden on the malware&#8217;s developers and freeing them up to spend more time improving their creations and adding new features.</p>
<div id="attachment_13790" style="width: 610px" class="wp-caption aligncenter"><img class="size-large wp-image-13790" src="media/53e6054c.citadelav-600x735.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2012/02/citadelav-600x735.png" alt="Citadel users discuss the merits of including a module to remove other parasites from host PCs." width="600" height="735" srcset="http://krebsonsecurity.com/wp-content/uploads/2012/02/citadelav-285x349.png 285w, http://krebsonsecurity.com/wp-content/uploads/2012/02/citadelav-600x735.png 600w, http://krebsonsecurity.com/wp-content/uploads/2012/02/citadelav.png 707w" sizes="(max-width: 600px) 100vw, 600px" /><p class="wp-caption-text">Citadel users discuss the merits of including a module to remove other parasites from host PCs.</p></div>
<p>Citadel boasted <a href="https://krebsonsecurity.com/2012/01/citadel-trojan-touts-trouble-ticket-system/" target="_blank">an online tech support system</a> for customers designed to let them file bug reports, suggest and vote on new features in upcoming malware versions, and track trouble tickets that could be worked on by the malware developers and fellow Citadel users alike. Citadel customers also could use the system to chat and compare notes with fellow users of the malware.</p>
<p>It was this very interactive nature of Citadel&#8217;s support infrastructure that FBI agents would ultimately use to locate and identify Vartanyan, who went by the nickname &#8220;<strong>Kolypto</strong>.&#8221; The nickname of the core seller of Citadel was &#8220;<strong>Aquabox</strong>,&#8221; and the FBI was keen to identify Aquabox and any programmers he&#8217;d hired to help develop Citadel.</p>
<p>In June 2012, FBI agents bought several licenses of Citadel from Aquabox, and soon the agents were suggesting tweaks to the malware that they could use to their advantage. Posing as an active user of the malware, FBI agents informed the Citadel developers that that they&#8217;d discovered a security vulnerability in the Web-based interface that Citadel customers used to keep track of and collect passwords from infected systems (see screenshot below).</p>
<p><div id="attachment_13489" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-13489" src="media/d1253d45.citadelpanel-600x478.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2012/01/citadelpanel-600x478.png" alt="A screenshot of the Citadel botnet panel." width="580" height="462" srcset="http://krebsonsecurity.com/wp-content/uploads/2012/01/citadelpanel-600x478.png 600w, http://krebsonsecurity.com/wp-content/uploads/2012/01/citadelpanel.png 679w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A screenshot of the Web-based Citadel botnet control panel.</p></div> <span id="more-40087"></span></p>
<p>Aquabox took the bait, and asked the FBI agents to upload a screen shot of the bug they&#8217;d found. As noted in <a href="https://krebsonsecurity.com/2015/09/arrests-tied-to-citadel-dridex-malware/" target="_blank">this September 2015 story</a>, the FBI agents uploaded the image to file-sharing giant <strong>Sendspace.com </strong>and then subpoenaed the logs from Sendspace to learn the Internet address of the user that later viewed and downloaded the file.</p>
<p>The IP address came back as the same one they had previously tied to Aquabox. The other address that accessed the file was in Ukraine and tied to Vartanyan. Prosecutors said Vartanyan&#8217;s address soon after was seen uploading to Sendspace a patched version of Citadel that supposedly fixed the vulnerability identified by the agents posing as Citadel users.</p>
<div id="attachment_40102" style="width: 219px" class="wp-caption alignright"><img class="size-full wp-image-40102" src="media/abc2f9c3.vt-thumbs.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/vt-thumbs.png" alt="Mark Vartanyan. Source: Twitter." width="209" height="259" /><p class="wp-caption-text">Mark Vartanyan. Source: Twitter.</p></div>
<p>&#8220;In the period August 2012 to January 2013, there were in total 48 files uploaded from Marks IP to Sendspace,&#8221; reads a story in the Norwegian daily VG that KrebsOnSecurity had translated into English <a href="media/2e32a4d8.Mark-Citadel-VG.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/09/Mark-Citadel-VG.pdf" target="_blank">here</a> (PDF). &#8220;Those files were downloaded by &#8216;Aquabox&#8217; with 2 IPs (193.105.134.50 and 149.154.155.81).&#8221;</p>
<p>Investigators would learn that Vartanyan was a Russian citizen who&#8217;d grown up in Ukraine. At the time of his arrest, Mark was living in Norway, which later extradited him to the United States for prosecution. In March 2017, Vartanyan pleaded guilty to one count of computer fraud, and <a href="https://www.justice.gov/usao-ndga/pr/russian-citizen-who-helped-develop-citadel-malware-toolkit-sentenced-0" target="_blank">was sentenced on July 19</a> to five years in federal prison.</p>
<p>Another Citadel developer, <a href="https://www.justice.gov/usao-ndga/victim-witness-assistance/information-victims-large-cases/united-states-v-dimitry-belorossov-aka-rainerfox" target="_blank">Dimitry Belorossov (a.k.a. &#8220;Rainerfox&#8221;)</a>, was arrested and <a href="https://www.justice.gov/usao-ndga/pr/russian-developer-notorious-citadel-malware-sentenced-prison" target="_blank">sentenced</a> in 2015 to four years and six months in prison after pleading guilty to distributing Citadel. </p>
<p>Early in its heydey, some text strings were added to the Citadel Trojan which named Yours Truly as the real author of Citadel (see screenshot below). While I obviously had no involvement in writing the trojan, I <em>have</em> written a great deal about its core victims &#8212; mainly <a href="https://krebsonsecurity.com/category/smallbizvictims/" target="_blank">dozens of small businesses here in the United States</a> who saw their bank accounts drained of hundreds of thousands or <a href="https://krebsonsecurity.com/2015/03/hospital-sues-bank-of-america-over-million-dollar-cyberheist/" target="_blank">millions of dollars</a> after a Citadel infection.</p>
<div id="attachment_20619" style="width: 610px" class="wp-caption aligncenter"><img class="size-large wp-image-20619" src="media/1bd79708.citadelkrebs2-copy-600x35.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/05/citadelkrebs2-copy-600x35.png" alt="A text string inside of the Citadel trojan. Source: AhnLab" width="600" height="35" srcset="http://krebsonsecurity.com/wp-content/uploads/2013/05/citadelkrebs2-copy-600x35.png 600w, http://krebsonsecurity.com/wp-content/uploads/2013/05/citadelkrebs2-copy.png 725w" sizes="(max-width: 600px) 100vw, 600px" /><p class="wp-caption-text">A text string inside of the Citadel trojan. Source: AhnLab</p></div>


feed_id: https://krebsonsecurity.com/?p=39897
title: Gas Pump Skimmer Sends Card Data Via Text
uri: Gas-Pump-Skimmer-Sends-Card-Data-Via-Text
url: https://krebsonsecurity.com/2017/07/gas-pump-skimmer-sends-card-data-via-text/
content:
<p>Skimming devices that crooks install inside fuel station gas pumps frequently rely on an embedded Bluetooth component allowing thieves to collect stolen credit card data from the pumps wirelessly with any mobile device. The downside of this approach is that Bluetooth-based skimmers can be detected by anyone else with a mobile device. Now, investigators in the New York say they are starting to see pump skimmers that use cannibalized cell phone components to send stolen card data via text message.</p>
<p>Skimmers that transmit stolen card data wirelessly via GSM text messages and other mobile-based communications methods are not new; they have been present &#8212; if not prevalent &#8212; in ATM skimming devices for ages.</p>
<p>But this is the first instance KrebsOnSecurity is aware of in which such SMS skimmers have been found inside gas pumps, and that matches the experience of several states hardest hit by pump skimming activity.</p>
<p>The beauty of the GSM-based skimmer is that it can transmit stolen card data wirelessly via text message, meaning thieves can receive real-time transmissions of the card data anywhere in the world &#8212; never needing to return to the scene of the crime. That data can then be turned into counterfeit physical copies of the cards.</p>
<p>Here&#8217;s a look at a new skimmer pulled from compromised gas pumps at three different filling stations in New York this month. Like other pump skimmers, this device was hooked up to the pump&#8217;s internal power, allowing it to operate indefinitely without relying on batteries.</p>
<div id="attachment_39893" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39893" src="media/40c325d2.GSMpumpskim2-580x502.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/GSMpumpskim2-580x502.png" alt="A GSM-based card skimmer found embedded in a gas pump in the northeastern United States." width="580" height="502" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/07/GSMpumpskim2-580x502.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/07/GSMpumpskim2-768x665.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/07/GSMpumpskim2-940x814.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/07/GSMpumpskim2.png 983w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A GSM-based card skimmer found embedded in a gas pump in the northeastern United States.</p></div>
<p>It may be difficult to see from the picture above, but the skimmer includes a GSM-based device with a SIM card produced by cellular operator <strong>T-Mobile</strong>. The image below shows the other side of the pump skimmer, with the SIM card visible in the upper right corner of the circuitboard:</p>
<div id="attachment_39894" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39894" src="media/9818c122.GSMpumpskim1-580x607.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/GSMpumpskim1-580x607.png" alt="The reverse side of this GSM-based pump skimmer shows a SIM card from T-Mobile." width="580" height="607" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/07/GSMpumpskim1-580x607.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/07/GSMpumpskim1-768x803.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/07/GSMpumpskim1.png 917w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The reverse side of this GSM-based pump skimmer shows a SIM card from T-Mobile.</p></div>
<p>It&#8217;s not clear what type of mobile device was used in this skimmer, and the police officer who shared these images with KrebsOnSecurity said the forensic analysis of the device was ongoing.<span id="more-39897"></span></p>
<p>Here&#8217;s a close-up of the area around the SIM card:</p>
<p><img class="aligncenter size-medium wp-image-39891" src="media/8c769a9c.GSMpumpskimcloseup2-580x348.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/GSMpumpskimcloseup2-580x348.png" alt="GSMpumpskimcloseup2" width="580" height="348" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/07/GSMpumpskimcloseup2-580x348.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/07/GSMpumpskimcloseup2-768x461.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/07/GSMpumpskimcloseup2-940x565.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>The officer, who shared these photos on condition of anonymity, said this was thought to be the first time fraud investigators in New York had ever encountered a GSM-based pump skimmer.</p>
<p>Skimmers used at all three New York filling stations impacted by the scheme included T-Mobile SIM cards, but the investigator said analysis so far showed the cards held no other data other than the SIM&#8217;s card&#8217;s unique serial number (<a href="https://en.wikipedia.org/wiki/Subscriber_identity_module" target="_blank">ICCID</a>).</p>
<p>KrebsOnSecurity reached out to weights and measures officials in several states most heavily hit by pump skimming activity, including Arizona, California and Florida.</p>
<p>Officials in all three states said they&#8217;ve yet to find a GSM-based skimmer attached to any of their pumps.</p>
<p>Skimmers at the pump are most often the work of organized crime rings that traffic in everything from stolen credit and debit cards to the wholesale theft and commercial resale of fuel &#8212; in some cases from (and back to) the very fuel stations that have been compromised with the gang&#8217;s skimming devices.</p>
<p>Investigators say skimming gangs typically gain access to station pumps by using a handful of master keys that still open a great many pumps in use today. In a common scenario, one person will distract the station attendant as fuel thieves pull up alongside the pump in a van with doors that obscure the machine on both sides. For an in-depth look at the work on one fuel-theft gang working out of San Diego, check out <a href="https://krebsonsecurity.com/2015/11/gas-theft-gangs-fuel-pump-skimming-scams/" target="_blank">this piece</a>.</p>
<p>There are generally no outward signs when a pump has been compromised by a skimmer, but <a href="https://krebsonsecurity.com/2016/09/inside-arizonas-pump-skimmer-scourge/" target="_blank">a study KrebsOnSecurity published last year</a> about a surge in pump skimming activity in Arizona suggests that skimmer gangs can spot the signs of a good mark.</p>
<p>Fraud patterns show fuel theft gangs tend to target stations that are close to major highway arteries; those with older pumps; and those without security cameras, and/or a regular schedule for inspecting security tape placed on the pumps.</p>
<p>Many filling stations are upgrading their pumps to include more physical security &#8212; such as custom locks and security cameras. In addition, newer pumps can accommodate more secure chip-based payment cards that are already in use by all other G20 nations.</p>
<p>But these upgrades are disruptive and expensive, and some stations are taking advantage of recent moves by <strong>Visa</strong> to delay adding much-needed security improvements, such as chip-capable readers.</p>
<p>Until late 2016, fuel station owners in the United States had until October 1, 2017 to install chip-capable readers at their pumps. Under previous Visa rules, station owners that didn’t have chip-ready readers in place by then would have been on the hook to absorb 100 percent of the costs of fraud associated with transactions in which the customer presented a chip-based card yet was not asked or able to dip the chip (currently, card-issuing banks and consumers eat most of the fraud costs from fuel skimming).</p>
<p>But in December 2016, Visa <a href="https://krebsonsecurity.com/2016/12/visa-delays-chip-deadline-for-pumps-to-2020/" target="_blank">delayed the requirements</a>, saying fuel station owners would now have until October 1, 2020 to meet the liability shift deadline.</p>
<p>The best advice one can give to avoid pump skimmers is to frequent stations that appear to place an emphasis on physical security. More importantly, some pump skimming devices are <a href="https://krebsonsecurity.com/2013/07/dont-get-sucker-pumped/" target="_blank">capable of stealing debit card PINs as well</a>, <em>so it’s good idea to avoid paying with a debit card at the pump</em>.</p>
<p>Armed with your PIN and debit card data, thieves can clone the card and pull money out of your account at an ATM. Having your checking account emptied of cash while your bank sorts out the situation can be a huge hassle and create secondary problems (bounced checks, for instance).</p>


feed_id: https://krebsonsecurity.com/?p=40122
title: Suspended Sentence for Mirai Botmaster Daniel Kaye
uri: Suspended-Sentence-for-Mirai-Botmaster-Daniel-Kaye
url: https://krebsonsecurity.com/2017/07/suspended-sentence-for-mirai-botmaster-daniel-kaye/
content:
<p>Last month, KrebsOnSecurity identified U.K. citizen <strong>Daniel Kaye</strong> as the likely real-life identity behind a hacker responsible for clumsily wielding a powerful botnet built on <strong>Mirai</strong>, a malware strain that enslaves poorly secured Internet of Things (IoT) devices for use in large-scale online attacks. Today, a German court issued a suspended sentence for Kaye, who now faces cybercrime charges in the United Kingdom.</p>
<div id="attachment_40131" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40131" src="media/eef4d048.dkayflat-1-580x187.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/dkayflat-1-580x187.png" alt="Daniel Kaye's Facebook profile page." width="580" height="187" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/07/dkayflat-1-580x187.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/07/dkayflat-1-768x248.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/07/dkayflat-1-940x303.png 940w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Daniel Kaye&#8217;s Facebook profile page.</p></div>
<p>In February 2017, authorities in the United Kingdom arrested a 29-year-old U.K. man on suspicion of knocking more than 900,000 Germans offline in a Mirai attack in November 2016. Shortly after that 2016 attack, a hacker using the nickname &#8220;Bestbuy&#8221; told reporters he was responsible for the outage, apologizing for the incident.</p>
<p>Prosecutors in Europe had withheld Kaye&#8217;s name from the media throughout the trial. But a court in Germany today confirmed Kaye&#8217;s identity as it handed down a suspended sentence on charges stemming from several failed attacks from his Mirai botnet &#8212; which nevertheless caused extensive internet outages for ISPs in the U.K., Germany and <a href="https://krebsonsecurity.com/2016/11/did-the-mirai-botnet-really-take-liberia-offline/" target="_blank">Liberia</a> last year.</p>
<p>On July 5, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2017/07/who-is-the-govrat-author-and-mirai-botmaster-bestbuy/" target="_blank">Who is the GovRAT Author and Mirai Botmaster BestBuy</a>. The story followed clues from reports produced by a half-dozen security firms that traced common clues between this BestBuy nickname and an alter-ego, &#8220;Spiderman.&#8221;</p>
<p>Both identities were connected to the sale of an espionage tool called GovRAT, which is documented to have been used in numerous cyber espionage campaigns against governments, financial institutions, defense contractors and more than 100 corporations.</p>
<p>That July 5 story traced a trail of digital clues left over 10 years back to Daniel Kaye, a 29-year-old man who had dual U.K. and Israeli citizenship and who was engaged to be married to a U.K. woman.</p>
<div id="attachment_39807" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/6baed4d9.govratmindmap.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/govratmindmap.png"> <img class="wp-image-39807 size-medium" src="media/e2a83406.govratmindmap-580x283.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/govratmindmap-580x283.png" alt=" " width="580" height="300" /></a><p class="wp-caption-text">A &#8220;mind map&#8221; tracing some of the research mentioned in this post.</p></div>
<p>Last week, a 29-year-old identified by media only as &#8220;Daniel K&#8221; pleaded guilty in a German court for launching the attacks that knocked 900,000 Deutsche Telekom customers offline. Prosecutors said Daniel K sold access to his Mirai botnet as an attack-for-hire service.</p>
<p>The defendant reportedly told the court that the incident was the biggest mistake of his life, and that he took money in exchange for launching attacks in order to help start a new life with his fiancee.<span id="more-40122"></span></p>
<p>Today, the regional court in the western city of Cologne said it would suspend the sentence of one year and eight months against Kaye, according to <a href="https://www.capitalfm.co.ke/news/2017/07/british-hacker-convicted-germany-major-cyber-attack/" target="_blank">a report from Agence France Presse</a>.</p>
<p>While it may seem that Kaye was given a pass by the German court, he is still facing criminal charges in Britain, where authorities have already requested his extradition.</p>
<p>As loyal readers here no doubt know, KrebsOnSecurity last year was <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">massively attacked</a> by the first-ever Mirai botnet &#8212; an attack which knocked this site offline for almost four days before it <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank">came back online</a> under the protection of Google&#8217;s Project Shield service.</p>
<p>In January 2017, this blog <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank">published the results of a four-month investigation</a> into who was likely responsible for not only for writing Mirai, but for <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank">leaking the source code for the malware</a> &#8212; spawning dozens of competing Mirai botnets like the one that Kaye built. To my knowledge, no charges have yet been filed against any of the individuals named in that story.</p>


feed_id: https://krebsonsecurity.com/?p=40164
title: New Bill Seeks Basic IoT Security Standards
uri: New-Bill-Seeks-Basic-IoT-Security-Standards
url: https://krebsonsecurity.com/2017/08/new-bill-seeks-basic-iot-security-standards/
content:
<p>Lawmakers in the U.S. Senate today introduced a bill that would set baseline security standards for the government&#8217;s purchase and use of a broad range of Internet-connected devices, including computers, routers and security cameras. The legislation, which also seeks to remedy some widely-perceived shortcomings in existing cybercrime law, was developed <a href="https://krebsonsecurity.com/2016/10/senator-prods-federal-agencies-on-iot-mess/" target="_blank">in direct response</a> to <a href="https://krebsonsecurity.com/?s=ddos+2016+mirai&amp;x=0&amp;y=0" target="_blank">a series of massive cyber attacks in 2016</a> that were fueled for the most part by poorly-secured &#8220;Internet of Things&#8221; (IoT) devices.</p>
<p><img class="aligncenter size-full wp-image-40170" src="media/573f22f7.iotc.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/iotc.png" alt="iotc" width="569" height="395" /></p>
<p>The <strong>IoT Cybersecurity Improvement Act of 2017</strong> seeks to use the government&#8217;s buying power to signal the basic level of security that IoT devices sold to Uncle Sam will need to have. For example, the bill would require vendors of Internet-connected devices purchased by the federal government make sure the devices can be patched when security updates are available; that the devices do not use hard-coded (unchangeable) passwords; and that vendors ensure the devices are free from known vulnerabilities when sold.</p>
<p>The bill, introduced by <strong>Sens. Steve Daines</strong> (R-Mont.), <strong>Cory Gardner</strong> (R-Colo.),<strong> Mark Warner</strong> (D-Va.) and <strong>Ron Wyden</strong> (D-Ore.), directs the <strong>White House Office of Management and Budget</strong> (OMB) to develop alternative network-level security requirements for devices with limited data processing and software functionality. In addition, it requires each executive agency to inventory all Internet-connected devices in use by the agency.</p>
<p>The bill&#8217;s provisions would seem to apply to virtually any device that has an Internet connection and can transmit data. Under the proposal, an IoT device has a fairly broad definition, being described as &#8220;a physical object that is capable of connecting to and is in regular connection with the Internet;&#8221; and one that &#8220;has computer processing capabilities that can collect, send or receive data.&#8221;<span id="more-40164"></span></p>
<p>According to the bill&#8217;s core sponsors, the measure already has the support of several key legislative technology groups, including the <a href="https://www.cdt.org" target="_blank">Center for Democracy &amp; Technology</a> (CDT), <strong>Mozilla</strong>, and the <a href="https://cyber.harvard.edu/research/cybersecurity" target="_blank">Berklett Cybersecurity Project</a> at Harvard University&#8217;s <a href="https://cyber.harvard.edu/research/cybersecurityBerkman%20Klein%20Center%20for%20Internet%20&amp;%20Society" target="_blank">Berkman Klein Center for Internet &amp; Society</a>.</p>
<p>Those advocates were no doubt involved in shaping other aspects of this legislation, including one that exempts cybersecurity researchers engaging in good-faith research from liability under the <a href="https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act" target="_blank">Computer Fraud and Abuse Act</a> (CFAA), a dated anti-cybercrime law that many critics say has been abused by government prosecutors and companies <a href="https://en.wikipedia.org/wiki/Aaron_Swartz" target="_blank">to intimidate and silence security researchers</a>.</p>
<p>Perhaps the most infamous example of prosecutorial overreach under the CFAA comes in <a href="https://en.wikipedia.org/wiki/Aaron_Swartz" target="_blank">Aaron Swartz</a>, a Harvard research fellow who committed suicide after being hounded by multiple CFAA fraud charges by state and federal prosecutors for downloading a large number of academic journals.</p>
<p>Specifically, the bill would &#8220;exempt cybersecurity researchers engaging in good-faith research from liability under the Computer Fraud and Abuse Act and the <a href="https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_Act" target="_blank">Digital Millennium Copyright Act</a> when in engaged in research pursuant to adopted coordinated vulnerability disclosure guidelines,&#8221; according to a statement released by Sen. Warner (link added).</p>
<p>The measure also directs the <strong>Department of Homeland Security</strong> to issue guidelines regarding cybersecurity coordinated vulnerability disclosure policies to be required by contractors providing connected devices to the U.S. government.</p>
<p>Last fall, Sens. Warner and others <a href="https://krebsonsecurity.com/2016/10/senator-prods-federal-agencies-on-iot-mess/" target="_blank">pinged federal regulators</a> at the <strong>U.S. Federal Trade Commission</strong> (FTC) and the <strong>U.S. Federal Communications Commission</strong> (FCC) to see if something more could be done about the proliferating threat from poorly-secured IoT devices.</p>
<p>At the time, the world had just witnessed two of the largest cyberattacks the Internet had ever seen (including <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">one against this Web site</a>). Those attacks were launched with the help of IoT devices &#8212; mostly cheap security cameras and Internet routers &#8212; that were hacked thanks largely to <a href="https://krebsonsecurity.com/2016/10/iot-device-maker-vows-product-recall-legal-action-against-western-accusers/" target="_blank">user accounts which could not be removed</a> and which were configured to be remotely accessible over the Internet.</p>
<p>A full text of the Senate proposal is <a href="https://www.scribd.com/document/355269230/Internet-of-Things-Cybersecurity-Improvement-Act-of-2017" target="_blank">available here</a>.</p>
<p><strong>Update, 3:49 p.m. ET:</strong> Corrected abbreviation for Sen. Wyden&#8217;s home state.</p>


feed_id: https://krebsonsecurity.com/?p=40140
title: Flash Player is Dead, Long Live Flash Player!
uri: Flash-Player-is-Dead-Long-Live-Flash-Player
url: https://krebsonsecurity.com/2017/08/flash-player-is-dead-long-live-flash-player/
content:
<p><strong>Adobe</strong> last week detailed plans to retire its <strong>Flash Player</strong> software, a cross-platform browser plugin so powerful and so packed with security holes that it has become the favorite target of malware developers. To help eradicate this ubiquitous liability, Adobe is enlisting the help of <strong>Apple</strong>, <strong>Facebook</strong>, <strong>Google</strong>, <strong>Microsoft</strong> and <strong>Mozilla</strong>. But don&#8217;t break out the bubbly just yet: Adobe says Flash won&#8217;t be put down officially until 2020.</p>
<p><img class="alignright size-full wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="211" height="180" />In <a href="https://blogs.adobe.com/conversations/2017/07/adobe-flash-update.html" target="_blank">a blog post</a> about the move, Adobe said more sites are turning away from proprietary code like Flash toward open standards like <a href="https://en.wikipedia.org/wiki/HTML5" target="_blank">HTML5</a>, <a href="https://en.wikipedia.org/wiki/WebGL" target="_blank">WebGL</a> and <a href="https://en.wikipedia.org/wiki/WebAssembly" target="_blank">WebAssembly</a>, and that these components now provide many of the capabilities and functionalities that plugins pioneered.</p>
<p>&#8220;Over time, we’ve seen helper apps evolve to become plugins, and more recently, have seen many of these plugin capabilities get incorporated into open web standards,&#8221; Adobe said. &#8220;Today, most browser vendors are integrating capabilities once provided by plugins directly into browsers and deprecating plugins.&#8221;</p>
<p>It&#8217;s remarkable how quickly Flash has seen a decline in both use and favor, particularly among the top browser makers. Just three years ago, at least 80 percent of desktop <strong>Chrome</strong> users visited a site with Flash each day, according to Google. Today, usage of Flash among Chrome users stands at just <a href="https://www.chromium.org/flash-roadmap/flash-usage-trends" target="_blank">17 percent</a> and continues to decline (see Google graphic below).</p>
<p>For <strong>Mac</strong> users, the turning away from Flash began in 2010, when Apple co-founder <strong>Steve Jobs</strong> famously penned his &#8220;<a href="https://en.wikipedia.org/wiki/Thoughts_on_Flash" target="_blank">Thoughts on Flash</a>&#8221; memo that outlined the reasons why the technology would not be allowed on the company&#8217;s iOS products. Apple stopped pre-installing the plugin that same year.</p>
<div id="attachment_40188" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40188" src="media/a60c8e3a.flashimpressions-google-580x436.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/flashimpressions-google-580x436.png" alt="The percentage of Chrome users over time that have used Flash on a Web site. Image: Google." width="580" height="436" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/08/flashimpressions-google-580x436.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/08/flashimpressions-google-768x578.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/08/flashimpressions-google.png 893w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The percentage of Chrome users over time that have used Flash on a Web site. Image: Google.</p></div>
<p>&#8220;Today, if users install Flash, it remains off by default,&#8221; <a href="https://webkit.org/blog/7839/adobe-announces-flash-distribution-and-updates-to-end/" target="_blank">a post</a> by Apple&#8217;s WebKit Team explains. &#8220;Safari requires <a href="https://webkit.org/blog/6589/next-steps-for-legacy-plug-ins/" target="_blank" data-ss1501680086="1">explicit approval</a> on each website before running the Flash plugin.&#8221;</p>
<p>Mozilla said that starting this month Firefox users will choose which websites are able to run the Flash plugin.</p>
<p>&#8220;Flash will be disabled by default for most users in 2019, and only users running the Firefox Extended Support Release will be able to continue using Flash through the final end-of-life at the end of 2020,&#8221; <a href="https://blog.mozilla.org/futurereleases/2017/07/25/firefox-roadmap-flash-end-life/" target="_blank">writes</a> <strong>Benjamin Smedberg</strong> for Mozilla. &#8220;In order to preserve user security, once Flash is no longer supported by Adobe security patches, no version of Firefox will load the plugin.&#8221;<span id="more-40140"></span></p>
<p>Facebook has long hosted plenty of games that invoke Flash, but over time more Facebook apps and games turned to HTML5, the company said.</p>
<p>&#8220;Today, more than 200 HTML5 games are live on our platform, most of which launched within the last year,&#8221; <a href="https://developers.facebook.com/blog/post/2017/07/25/Games-Migration-to-Open-Web-Standards/" target="_blank">wrote</a> Facebook&#8217;s <strong>Jakub Pudelek</strong>. &#8220;Many of the largest developers on the platform&#8230;migrated at least one Flash game to HTML5 on the Facebook platform with minimal impact to their existing customers.&#8221;</p>
<p>Finally, Microsoft said it has begun <a href="https://blogs.windows.com/msedgedev/2016/12/14/edge-flash-click-run/" target="_blank">phasing out</a> Flash from Microsoft Edge and Internet Explorer, culminating in the removal of Flash from Windows entirely by the end of 2020. For now, Microsoft Edge, the default browser on newer versions of Windows, will continue to ask users for permission to run Flash on most sites the first time the site is visited, remembering the user&#8217;s preference on any subsequent visits.</p>
<p>By mid- to late 2018, Microsoft says, Edge will require permission for Flash to be run each browser session. But by mid 2018, Microsoft will disable Flash by default in both Edge and Internet Explorer. Read more about Microsoft&#8217;s timeline for Flash elimination <a href="https://blogs.windows.com/msedgedev/2017/07/25/flash-on-windows-timeline/" target="_blank">here</a>.</p>
<p>For years, unpatched vulnerabilities in Flash plugins have been the top moneymaker for users of various commercial &#8220;exploit kits,&#8221; crimeware designed to be stitched into the fabric of hacked or malicious sites and exploit browser plugin flaws.</p>
<p>An <a href="https://www.recordedfuture.com/top-vulnerabilities-2016/" target="_blank">analysis of exploit kit activity</a>  by Arlington, Va.-based security firm <strong>Recorded Future</strong> showed that Flash Player vulnerabilities provided six of the top 10 vulnerabilities used by exploit kits in 2016 [full disclosure: Recorded Future is an advertiser on this blog].</p>
<div id="attachment_40192" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40192" src="media/7ad8431a.flashflaws-ek-580x474.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/flashflaws-ek-580x474.png" alt="Image: Recorded Future" width="580" height="474" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/08/flashflaws-ek-580x474.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/08/flashflaws-ek.png 619w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Image: Recorded Future</p></div>
<p>I look forward to a time when Flash Player is in the rearview mirror entirely. Until then, KrebsOnSecurity will continue to call attention to new security updates for Flash Player and other widely used Adobe products.</p>
<p>Even so, I&#8217;ll also continue to encourage readers to remove or hobble Flash Player unless and until it is needed for a specific site or purpose. More on that approach (as well as slightly less radical solutions ) can be found in <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">A Month Without Adobe Flash Player</a>. The short version is that you can probably get by without Flash installed and not miss it at all.</p>
<p>For readers still unwilling to cut the cord, there are half-measures that work almost as well. Fortunately, <a href="https://support.google.com/chrome/answer/108086?hl=en" target="_blank">disabling Flash in Chrome</a> is simple enough. Paste &#8220;<a href="chrome://settings/content" target="_blank">chrome://settings/content</a>&#8221; into a Chrome browser bar and then select &#8220;Flash&#8221; from the list of items. By default it should be set to &#8220;Ask first&#8221; before running Flash, although users also can disable Flash entirely here or whitelist and blacklist specific sites.</p>
<p>Another, perhaps less elegant, solution is to keep Flash installed in a browser that you don&#8217;t normally use, and then to only use that browser on sites that require it.</p>


feed_id: https://krebsonsecurity.com/?p=40144
title: Critical Security Fixes from Adobe, Microsoft
uri: Critical-Security-Fixes-from-Adobe-Microsoft
url: https://krebsonsecurity.com/2017/08/critical-security-fixes-from-adobe-microsoft-2/
content:
<p><strong>Adobe</strong> has released updates to fix dozens of vulnerabilities in its <strong>Acrobat</strong>, <strong>Reader</strong> and <strong>Flash Player</strong> software. Separately, <strong>Microsoft</strong> today issued patches to plug 48 security holes in <strong>Windows</strong> and other Microsoft products. If you use Windows or Adobe products, it&#8217;s time once again to get your patches on.</p>
<p><img class="alignright size-full wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="229" height="240" />More than two dozen of the vulnerabilities fixed in today&#8217;s Windows patch bundle address &#8220;critical&#8221; flaws that can be exploited by malware or miscreants to assume complete, remote control over a vulnerable PC with little or no help from the user.</p>
<p>Security firm <strong>Qualys</strong> recommends that top priority for patching should go to <a href="https://support.microsoft.com/gl-es/help/4034034/windows-search-remote-code-execution-vulnerability" target="_blank">a vulnerability</a> in the <strong>Windows Search</strong> service, noting that this is the third recent Patch <span class="aBn" tabindex="0" data-term="goog_136068006"><span class="aQJ">Tuesday</span></span> to feature a vulnerability in this service.</p>
<p>Qualys&#8217; <strong>Jimmy Graham</strong> <a href="https://blog.qualys.com/misc/2017/08/08/august-patch-tuesday-25-critical-microsoft-vulnerabilities-43-for-adobe" target="_blank">observes</a> that many of the vulnerabilities in this month’s release involve the Windows Scripting Engine, which can impact both browsers and <strong>Microsoft Office</strong>, and should be considered for prioritizing for workstation-type systems.</p>
<p>According to Microsoft, none of flaws in August&#8217;s Patch Tuesday are being actively exploited in the wild, although <em>Bleeping Computer</em> <a href="https://www.bleepingcomputer.com/news/microsoft/microsofts-august-patch-tuesday-fixes-48-security-issues/" target="_blank">notes</a> that three of the bugs were publicly detailed before today&#8217;s patch release.</p>
<p>Case in point: This month&#8217;s patch batch from Microsoft does <em>not</em> address the recently-detailed <a href="https://smbloris.com/" target="_blank">SMBLoris flaw</a>, a vulnerability in all versions of Windows that can be used to remotely freeze up vulnerable systems or cause them to crash.<span id="more-40144"></span></p>
<p><img class="alignleft size-full wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="211" height="180" />For those of you who still have Adobe Flash Player installed in a browser, it&#8217;s time to <a href="https://get.adobe.com/flashplayer/" target="_blank">update</a> and/or restart your browser. The latest version of Flash Player is <a href="https://helpx.adobe.com/security/products/flash-player/apsb17-23.html" target="_blank">v. 26.0.0.151</a> for Windows, Mac and Linux systems.</p>
<p>Windows users who browse the Web with anything other than <strong>Internet Explorer</strong> may need to apply the Flash patch twice, once with IE and again using the alternative browser (<strong>Firefox</strong>, <strong>Opera</strong>, e.g.).</p>
<p><strong>Chrome </strong>and IE should auto-install the latest Flash version on browser restart (users may need to manually check for updates and/or restart the browser to get the latest Flash version). Chrome users may need to restart the browser to install or automatically download the latest version. When in doubt, click the vertical three dot icon to the right of the URL bar, select “Help,” then “About Chrome”: If there is an update available, Chrome should install it then. Chrome will replace that three dot icon with an up-arrow inside of a circle when updates are ready to install).</p>
<p>Better yet, consider removing or at least hobbling Flash Player, which is a perennial target of malware attacks. For more on how to do that and other ways to reduce your exposure to Flash-based attacks, <a href="https://krebsonsecurity.com/2017/08/flash-player-is-dead-long-live-flash-player/" target="_blank">see this post</a>.</p>
<p>By the way, the bulk of the vulnerabilities that Adobe patched today were in <a href="https://helpx.adobe.com/security/products/acrobat/apsb17-24.html" target="_blank">versions of its Acrobat and Adobe PDF Reader</a> software. If you use either of these products, please take a moment to update them today.</p>
<p>As always, if anyone experiences weirdness or troubles after installing today&#8217;s updates, please leave us a note about it in the comments.</p>


feed_id: https://krebsonsecurity.com/?p=40244
title: Alleged vDOS Operators Arrested, Charged
uri: Alleged-vDOS-Operators-Arrested-Charged
url: https://krebsonsecurity.com/2017/08/alleged-vdos-operators-arrested-charged/
content:
<p>Two young Israeli men alleged by this author to have co-founded <strong>vDOS</strong> &#8212; until recently the largest and most profitable cyber attack-for-hire service online &#8212; were arrested and formally indicted this week in Israel on conspiracy and hacking charges.</p>
<p>On Sept. 8, 2016, KrebsOnSecurity <a href="http://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">published a story</a> about the hacking of vDOS, a service that attracted tens of thousands of paying customers and facilitated more than two million distributed denial-of-service (DDoS) attacks over the four year period it was in business.</p>
<p>That story named two then 18-year-old Israelis — <strong>Yarden &#8220;applej4ck&#8221; Bidani</strong> and <strong>Itay &#8220;p1st&#8221; Huri</strong> — as the likely owners and operators of vDOS. Within hours of that story&#8217;s publication the two <a href="https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/" target="_blank">were detained by Israeli police</a>, placed on house arrest for 10 days, and forbidden from using the Internet for a month.</p>
<div id="attachment_36386" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36386" src="media/8d4e34c1.vdosloggedin-580x405.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdosloggedin-580x405.png" alt="vDOS as it existed on Sept. 8, 2016." width="580" height="405" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdosloggedin-580x405.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdosloggedin-768x536.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdosloggedin.png 877w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">vDOS as it existed on Sept. 8, 2016.</p></div>
<p>On Tuesday, Israeli prosecutors announced they had <a href="http://www.israeldefense.co.il/he/node/30643" target="_blank">formally arrested and charged</a> two 19-year-olds with conspiring to commit a felony, prohibited activities, tampering with or disrupting a computer, and storing or disseminating false information. A <a href="https://pastebin.com/tkcGaYrF" target="_blank">statement</a> from a spokesman for the Israeli state attorney&#8217;s office said prosecutors couldn&#8217;t name the accused because their alleged crimes were committed while they were minors.</p>
<p>But a number of details match perfectly with previous reporting on Bidani and Huri. As noted in the original Sept. 2016 expose&#8217; on vDOS&#8217;s alleged founders, Israeli prosecutors say the two men made more than $600,000 in two of the four years the service was in operation. vDOS was shuttered for good not longer after Bidani and Huri&#8217;s initial detention in Sept. 2016.</p>
<p>&#8220;The defendants were constantly improving the attack code and finding different network security weaknesses that would enable them to offer increased attack services that could overcome existing defenses and create real damage to servers and services worldwide,&#8221; Israeli prosecutors alleged of the accused and their enterprise.<span id="more-40244"></span></p>
<p>&#8220;Subscribers were able to select an &#8216;attack&#8217; package from the various packages offered, with the packages classified by the duration of each attack in seconds, the number of simultaneous attacks and the magnitude of the attack in Gigabits per second, and their prices ranged from $ 19.99 to $ 499.99,&#8221; the allegation continues.</p>
<div id="attachment_36294" style="width: 237px" class="wp-caption alignright"><img class=" wp-image-36294" src="media/40d39be4.yardbid-580x639.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/yardbid-580x639.png" alt="19-year-old Yarden Bidani." width="227" height="250" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/yardbid-580x639.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/yardbid-768x847.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/yardbid.png 800w" sizes="(max-width: 227px) 100vw, 227px" /><p class="wp-caption-text">19-year-old Yarden Bidani.</p></div>
<p>Lawyers for Bidani and Huri could not be immediately reached for comment. But both have said their clients were merely operating a defensive “stresser” service sold to companies that wished to test whether their sites could withstand large cyberattacks.</p>
<p>The owners of these stresser services have sought to hide behind wordy “terms of service” agreements to which all customers must agree, arguing that these agreements <a href="https://krebsonsecurity.com/2013/05/ragebooter-legit-ddos-service-or-fed-backdoor/" target="_blank">absolve them of any sort of liability</a> for how their customers use the service.</p>
<p>Law enforcement officials both in the United States and abroad say stresser services enable illegal activity, and they’ve recently begun arresting both owners and users of these services.</p>
<p>In December 2016, federal investigators in the U.S. and Europe <a href="https://krebsonsecurity.com/2016/12/operation-tarpit-targets-customers-of-online-attack-for-hire-services/" target="_blank">arrested nearly three-dozen people</a> suspected of patronizing stresser services (also known as “<a href="https://krebsonsecurity.com/?s=booter&amp;x=0&amp;y=0" target="_blank">booter</a>” services). That crackdown was billed as part of an effort by authorities to weaken demand for these services, and to impress upon customers that hiring someone to launch cyberattacks on your behalf can land you in jail.</p>
<p>In October 2016, the U.S. Justice Department <a href="https://krebsonsecurity.com/2016/10/feds-charge-two-in-lizard-squad-investigation/" target="_blank">charged two 19-year-old men</a> alleged to have operated a stresser service affiliated with the hacking group known as the <a href="https://krebsonsecurity.com/?s=lizard+squad&amp;x=0&amp;y=0" target="_blank">Lizard Squad</a>.</p>
<p>KrebsOnSecurity paid a heavy price for breaking the story on vDOS’s hacking and the subsequent arrest of its alleged proprietors. Less than two weeks after those stories were published in September 2016, this site came under <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">one of the largest DDoS attacks</a> the Internet has ever witnessed.</p>
<p>That series of attacks ultimately knocked this site offline for nearly four days. According to <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank">follow-up reporting published in January 2017</a>, the attacks were paid for by a cybercriminal who was upset and/or inconvenienced by my exposé on vDOS.</p>
<p>At the height of vDOS’s profitability in mid-2015, the DDoS-for-hire service <em>was earning its then-17-year-old proprietors more than $42,000 a month</em> in PayPal and Bitcoin payments from thousands of subscribers. That’s according to <a href="https://krebsonsecurity.com/2017/06/following-the-money-hobbled-vdos-attack-for-hire-service/" target="_blank">an analysis</a> of the leaked vDOS database performed by researchers at <strong>New York University</strong>.</p>
<div id="attachment_36219" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36219" src="media/fa2da85d.vdoshome-580x379.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome-580x379.png" alt="The vDos home page." width="580" height="379" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome-580x379.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome-768x502.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome-940x615.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome.png 1191w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The vDOS home page.</p></div>


feed_id: https://krebsonsecurity.com/?p=40257
title: Beware of Security by Press Release
uri: Beware-of-Security-by-Press-Release
url: https://krebsonsecurity.com/2017/08/beware-of-security-by-press-release/
content:
<p>On Wednesday, the security industry once again witnessed an all-too-familiar cycle: I call it &#8220;security by press release.&#8221; It goes a bit like this: A security firm releases a report claiming to have unearthed a major flaw in a competitor&#8217;s product; members of the trade press uncritically <a href="https://gizmodo.com/top-security-firm-may-be-leaking-terabytes-of-confident-1797667775" target="_blank">republish</a> the claims without adding much clarity or waiting for responses from the affected vendor; blindsided vendor responds in a blog post showing how the issue is considerably less dire than originally claimed.</p>
<p>At issue are claims made by Denver-based security company <strong>DirectDefense</strong>, which published <a href="https://www.directdefense.com/harvesting-cb-response-data-leaks-fun-profit/" target="_blank">a report</a> this week warning that <strong>Cb Response </strong>&#8212; a suite of security tools sold by competitor <strong>Carbon Black</strong> (formerly <a href="https://krebsonsecurity.com/2013/02/security-firm-bit9-hacked-used-to-spread-malware/" target="_blank">Bit9</a>) &#8212; was leaking potentially sensitive and proprietary data from customers who use its product.</p>
<p><img class="aligncenter size-medium wp-image-40262" src="media/7a7596b5.snm-580x469.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/snm-580x469.png" alt="snm" width="580" height="469" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/08/snm-580x469.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/08/snm.png 754w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>DirectDefense warned about a problem with Cb Response&#8217;s use of &#8220;a cloud-based multiscanner&#8221; to scan suspicious files for malware. DirectDefense didn&#8217;t name the scanner in question, but it&#8217;s Google&#8217;s <a href="https://www.virustotal.com" target="_blank">VirusTotal</a> &#8212; a free tool that lets anyone submit a suspicious file and have it scanned against dozens of commercial anti-malware tools. There&#8217;s also a paid version of VirusTotal that allows customers to examine any file uploaded to the service.</p>
<p>Specifically, DirectDefense claimed that Cb Response&#8217;s sharing of suspicious files with VirusTotal could expose sensitive data because VirusTotal allows paying customers to download any files submitted by other users. This is the full extent of the &#8220;vulnerability&#8221; that DirectDefense labeled &#8220;the world&#8217;s largest pay-for-play data exfiltration botnet.&#8221;</p>
<p>Carbon Black responded with <a href="https://www.carbonblack.com/2017/08/09/directdefense-incorrectly-asserts-architectural-flaw-in-cb-response/" target="_blank">its own blog post</a> noting that the feature DirectDefense warned about was not turned on by default, and that Carbon Black <a href="media/ff33ba66.Blog_Image_2.png" data-original-source="http://www.carbonblack.com/wp-content/uploads/2017/08/Blog_Image_2.png" target="_blank">informs customers of the privacy risks</a> that may be associated with sharing files with VirusTotal.</p>
<h4>ANALYSIS</h4>
<p><strong>Adrian Sanabria</strong>, a security expert and founder of <strong>Savage Security</strong>, published <a href="https://blog.savagesec.com/words-have-meanings-dc925219bb8e?source=user_profile---------0--------------" target="_blank">a blog post</a> that called &#8220;bullshit&#8221; on DirectDefense&#8217;s findings, noting that the company inexplicably singles out a competitor when many other security firms similarly allow customers to submit files to VirusTotal.</p>
<p>&#8220;Dozens<strong class="markup--strong markup--p-strong"> </strong>of other security vendors either have an option to automatically submit binaries (yes, whole binaries, not just the hash) to VirusTotal or do it without the customers knowledge altogether,&#8221; Sanabria wrote. &#8220;In singling out Carbon Black, DirectDefense opens itself up to criticism and closer scrutiny.&#8221;</p>
<p>Such as <a href="https://twitter.com/Direct_Defense/status/894651409123033088" target="_blank">shilling for a partner firm</a> (<strong>Cylance</strong>) that stands to gain from taking Cabon Black down a few notches in the public eye, Sanabria observed [link added].</p>
<p>&#8220;I personally don’t believe DirectDefense is a shill for Cylance, but in singling out one of many vendors that do the same thing, they’ve stepped into a classic PR gaffe that <a class="markup--anchor markup--p-anchor" href="https://twitter.com/threatthreat/status/895306825763041284" target="_blank" rel="noreferrer" data-href="https://twitter.com/threatthreat/status/895306825763041284" data-ss1502373666="1">makes them look like one</a>,&#8221; he wrote.<span id="more-40257"></span></p>
<p>My take is that most people in corporate cybersecurity roles understand what VirusTotal is and the potential privacy risks involved in uploading files to the service &#8212; either on a one-off basis or automatically submitted through some security suite like CB Response (if not, those security folks probably need to investigate another career).</p>
<p>That&#8217;s not to say that organizations don&#8217;t inadvertently overshare. I&#8217;ve seen instances where entire email threads and apparently sensitive documents have been submitted to VirusTotal along with embedded malware.</p>
<p><strong>Lesley Carhart</strong>, a security incident response team leader and <a href="http://twitter.com/hacks4pancakes" target="_blank">a prolific security commentator on Twitter</a>, said there are immense amounts of trust given VirusTotal. Carhart said if a malicious actor were able to identify individual files uploaded from a target organization to VirusTotal &#8212; even just as file hashes &#8212; they could gain lots of information about the organization, including what software suites they use, what operating systems, and which document types.</p>
<p>&#8220;They provide an amazing free resource for the infosec community, as well as some great paid services,&#8221; Carhart said of VirusTotal. &#8220;However, we have unintentionally given them one of the largest repositories of files in the world.&#8221;</p>
<p>If DirectDefense&#8217;s report helped some security people better grasp the risks of oversharing with multiscanners like VirusTotal, that&#8217;s a plus. But from where I sit, these types of overblown research reports tend to live or die by uncritical and/or unbalanced coverage in the news media &#8212; also known as &#8220;churnalism.&#8221;</p>
<p>My advice to tech reporters: Quit taking claims like these at face value and start asking some basic questions before publishing anything. For example, the early coverage of DirectDefense&#8217;s report in the media suggests that few reporters even asked about the identity of the multiscanner referenced throughout the report. Also, it&#8217;s clear that few (if any) reporters asked DirectDefense whether it had alerted Carbon Black before going public with their findings (it hadn&#8217;t).</p>
<p>Pro tip: If a researcher or company with a vulnerability &#8220;scoop&#8221; doesn&#8217;t mention interaction with the affected vendor before going public with their research, this should be a giant red flag indicating that this individual or entity is merely trying to use the media to generate short-term PR buzz, and that the &#8220;vulnerability&#8221; in question is little more than smoke and mirrors.</p>


feed_id: https://krebsonsecurity.com/?p=40294
title: Blowing the Whistle on Bad Attribution
uri: Blowing-the-Whistle-on-Bad-Attribution
url: https://krebsonsecurity.com/2017/08/blowing-the-whistle-on-bad-attribution/
content:
<p><em>The New York Times</em> this week published a fascinating story about a young programmer in Ukraine who&#8217;d turned himself in to the local police. The Times says the man did so after one of his software tools was identified by the U.S. government as part of the arsenal used by Russian hackers suspected of hacking into the <strong>Democratic National Committee </strong>(DNC) last year. It&#8217;s a good read, as long as you can ignore that the premise of the piece is completely wrong.</p>
<p>The story, &#8220;<a href="https://www.nytimes.com/2017/08/16/world/europe/russia-ukraine-malware-hacking-witness.html" target="_blank">In Ukraine, a Malware Expert Who Could Blow the Whistle on Russian Hacking</a>,&#8221; details the plight of a hacker in Kiev better known as &#8220;<strong>Profexer</strong>,&#8221; who has reportedly agreed to be a witness for the FBI. From the story:</p>
<blockquote><p>&#8220;Profexer&#8217;s posts, already accessible to only a small band of fellow hackers and cybercriminals looking for software tips, blinked out in January &#8212; just days after American intelligence agencies publicly identified a program he had written as one tool used in Russian hacking in the United States. American intelligence agencies have determined Russian hackers were behind the electronic break-in of the Democratic National Committee.&#8221;</p></blockquote>
<p>The Times&#8217; reasoning for focusing on the travails of Mr. Profexer comes from <a href="https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity" target="_blank">the &#8220;GRIZZLYSTEPPE&#8221; report</a>, a collection of technical indicators or attack &#8220;signatures&#8221; published in December 2016 by the U.S. government that companies can use to determine whether their networks may be compromised by a number of different Russian cybercrime groups.</p>
<p>The only trouble is nothing in the GRIZZLYSTEPPE report said which of those technical indicators were found in the DNC hack. In fact, Prefexer&#8217;s &#8220;P.A.S. Web shell&#8221; tool &#8212; a program designed to insert a digital backdoor that lets attackers control a hacked Web site remotely &#8212; was specifically <em>not</em> among the hacking tools found in the DNC break-in.</p>
<p><div id="attachment_40297" style="width: 440px" class="wp-caption aligncenter"><img class="size-full wp-image-40297" src="media/b39ab63a.pas30.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/pas30.png" alt="The P.A.S. Web shell, as previously offered for free on the now-defunct site profexer[dot]name." width="430" height="268" /><p class="wp-caption-text">The P.A.S. Web shell, as previously offered for free on the now-defunct site profexer[dot]name.</p></div>That&#8217;s according to <strong>Crowdstrike</strong>, the company called in to examine the DNC&#8217;s servers following the intrusion. In a statement released to KrebsOnSecurity, Crowdstrike said it <a href="https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/" target="_blank">published the list of malware</a> that it found was used in the DNC hack, and that the Web shell named in the New York Times story was not on that list.</p>
<p><strong>Robert M. Lee </strong>is<strong> </strong>founder of the industrial cybersecurity firm <strong>Dragos, Inc.</strong> and an expert on the challenges associated with attribution in cybercrime. In a post on his personal blog, Lee challenged The Times on its conclusions.</p>
<p>&#8220;The GRIZZLYSTEPPE report has nothing to do with the DNC breach though and was a collection of technical indicators the government compiled from multiple agencies all working different Russian related threat groups,&#8221; Lee <a href="http://www.robertmlee.org/russian-election-meddling-grizzleysteppe-and-bananas/" target="_blank">wrote</a>.</p>
<p>&#8220;The threat group that compromised the DNC was Russian but not all Russian groups broke into the DNC,&#8221; he continued. &#8220;The GRIZZLYSTEPPE report was also highly criticized for its lack of accuracy and lack of a clear message and purpose. I covered it <a href="http://www.robertmlee.org/critiques-of-the-dhsfbis-grizzly-steppe-report/" data-ss1503017050="1">here </a>on my blog but that was also picked up by numerous journalists and <a href="https://krebsonsecurity.com/2017/01/dni-putin-led-cyberattack-propaganda-effort-to-elect-trump-denigrate-clinton/" target="_blank">covered elsewhere</a> [link added]. In other words, there’s no excuse for not knowing how widely criticized the GRIZZLYSTEPPE report was before citing it as good evidence in a NYT piece.&#8221;</p>
<p>Perhaps in response to Lee&#8217;s blog post, The Times issued a correction to the story, re-writing the above-quoted and indented paragraph to read:</p>
<blockquote><p>&#8220;It is the first known instance of a living witness emerging from the arid mass of technical detail that has so far shaped the investigation into the election hacking and the heated debate it has stirred. The Ukrainian police declined to divulge the man’s name or other details, other than that he is living in <a class="meta-loc" title="More news and information about Ukraine." href="http://topics.nytimes.com/top/news/international/countriesandterritories/ukraine/index.html?inline=nyt-geo" data-ss1503013572="1">Ukraine</a> and has not been arrested.&#8221;</p></blockquote>
<p>[Side note: Profexer may well have been doxed by <a href="https://off-guardian.org/2017/01/09/did-a-ukrainian-university-student-create-grizzly-steppe/" target="_blank">this publication</a> just weeks after the GRIZZLYSTEPPE report was released.]<span id="more-40294"></span></p>
<p>This would not be the first time the GRIZZLYSTEPPE report provided fodder for some too-hasty hacking conclusions by a major newspaper. On December 31 2016, <em>The Washington Post</em> published <a href="https://www.washingtonpost.com/world/national-security/russian-hackers-penetrated-us-electricity-grid-through-a-utility-in-vermont/2016/12/30/8fc90cc4-ceec-11e6-b8a2-8c2a61b0436f_story.html" target="_blank">a breathless story</a> reporting that an electric utility in Vermont had been compromised by Russian hackers who had penetrated the U.S. electric grid.</p>
<p>The Post cited unnamed &#8220;U.S. officials&#8221; saying the Vermont utility had found a threat signature from the GRIZZLYSTEPPE report inside its networks. Not long after the story ran, the utility in question said it detected the malware signature in a single laptop that was not connected to the grid, and the Post was forced to <a href="https://www.washingtonpost.com/world/national-security/russian-government-hackers-do-not-appear-to-have-targeted-vermont-utility-say-people-close-to-investigation/2017/01/02/70c25956-d12c-11e6-945a-76f69a399dd5_story.html" target="_blank">significantly walk back its story</a>.</p>
<p><strong>Matt Tait</strong>, a senior fellow at the <strong>Robert Strauss Center for International Security and Law</strong> at <strong>UT Austin</strong>, said <strong>i</strong>ndicators <strong>o</strong>f <strong>c</strong>ompromise or IOCs like those listed in the GRIZZLYSTEPPE report have limited value in attributing who may be responsible for an online attack.</p>
<p>&#8220;It&#8217;s a classic problem that these IOCs indicate you may be compromised, but they&#8217;re not very good for attribution,&#8221; Tait said. &#8220;The Grizzly Steppe report is a massive file of signatures, and loads of people have run those, found various things on their network, and then assumed it&#8217;s all related to the DNC hack. But there&#8217;s absolutely no tie between the DNC hack that in any way involved this P.A.S. Web shell.&#8221;</p>
<p>If it&#8217;s not always clear how seriously to take conclusions from Uncle Sam about the sources of cybercrime, it certainly doesn&#8217;t help when intelligence agencies are still relying on discredited sources of information about the sources of cyberattacks. As Mr. Lee observed at the top of his blog post, the Twitter account for the <strong>U.S. Defense Intelligence Agency</strong> <a href="https://twitter.com/DefenseIntel/status/897106479546851329" target="_blank">tweeted on Aug. 14, 2017:</a> &#8220;Cyber attacks going on right now #DoDIIS17&#8221;.</p>
<p>The DIA tweet included a brief video of the global threat map produced by <strong>Norse Corp.</strong>, a company whose lovely but otherwise misguided efforts at cyber attack attribution have been repeatedly denounced by Lee and other cybersecurity experts. For more on how Norse self-destructed from the inside, see my Jan. 2016 story, <a href="https://krebsonsecurity.com/2016/01/sources-security-firm-norse-corp-imploding/" target="_blank">Sources: Security Firm Norse Corp. Imploding</a>.</p>
<p><img class="aligncenter size-medium wp-image-40296" src="media/d0b98ec4.dia-norse-580x568.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/dia-norse-580x568.png" alt="dia-norse" width="580" height="568" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/08/dia-norse-580x568.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/08/dia-norse-768x752.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/08/dia-norse.png 885w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>One final note: <strong>Wired.com</strong> has a lengthy but tremendous new story worth reading called <a href="https://www.wired.com/story/a-guide-to-russias-high-tech-tool-box-for-subverting-us-democracy" target="_blank">A Guide to Russia&#8217;s High Tech Tool Box for Subverting US Democracy</a>. It makes a convincing case that the real, long-term goal of Russian state-sponsored hacking activity is to sow public and popular distrust in the democratic process and to weaken democratic institutions inside countries that support the <a href="https://en.wikipedia.org/wiki/NATO" target="_blank">North Atlantic Treaty Organization</a> (NATO).</p>


feed_id: https://krebsonsecurity.com/?p=40289
title: Carbon Emissions: Oversharing Bug Puts Security Vendor Back in Spotlight
uri: Carbon-Emissions-Oversharing-Bug-Puts-Security-Vendor-Back-in-Spotlig
url:
https://krebsonsecurity.com/2017/08/carbon-emissions-oversharing-bug-puts-security-vendor-back-in-spotlight/

content:
<p>Last week, security firm <strong>DirectDefense</strong> came under fire for over-hyping claims that <strong>Cb Response</strong>, a cybersecurity product sold by competitor <strong>Carbon Black</strong>, was leaking proprietary from customers who use it. Carbon Black responded that the bug identified by its competitor was a feature, and that customers were amply cautioned in advance about the potential privacy risks of using the feature. Now Carbon Black is warning that an internal review has revealed a wholly separate bug in Cb Response that could in fact result in some customers unintentionally sharing sensitive files.</p>
<p><img src="media/005a5fa1.cblogo.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/cblogo.png" alt="cblogo" width="225" height="118" class="alignright size-full wp-image-40322" />As noted in <a href="https://krebsonsecurity.com/2017/08/beware-of-security-by-press-release/" target="_blank">last week&#8217;s story</a>, DirectDefense warned about a problem with Cb Response’s use of Google’s <a href="https://www.virustotal.com/" target="_blank">VirusTotal</a> — a free tool that lets anyone submit a suspicious file and have it scanned against dozens of commercial anti-malware tools. There is also a paid version of VirusTotal that allows customers to examine any file uploaded to the service.</p>
<p>Specifically, DirectDefense claimed that Cb Response’s sharing of suspicious files with VirusTotal could expose sensitive data because VirusTotal allows paying customers to download any files submitted by other users. DirectDefense labeled the bug “the world’s largest pay-for-play data exfiltration botnet.”</p>
<p>Numerous industry analysts leapt to Carbon Black&#8217;s defense &#8212; with some even calling &#8220;bullshit&#8221; on the findings &#8212; pointing out that plenty of other vendors submit files through Virustotal and that DirectDefense was merely trying to besmirch a competitor&#8217;s product.</p>
<p>But earlier this week, Carbon Black began quietly notifying customers that an internal review of the claims revealed a completely different bug that could result in some benign customer files being miscategorized as executable files and inadvertently uploaded to Virustotal for scanning.</p>
<p>&#8220;On Thursday, we discovered a bug affecting a small percentage of our Cb Response customers,&#8221; said <strong>Mike Viscuso</strong>, co-founder and chief technology officer at Carbon Black. &#8220;Our review is still ongoing, but based on what we learned to date it requires a very specific customer configuration, and we have already taken steps to remediate the bug and protect our customers.&#8221;<span id="more-40289"></span></p>
<p>Viscuso said this bug appears to affect a small number of Cb Response customers who have enabled VirusTotal submissions and use the program on a Mac OS in the presence of specific third-party applications. For example, he said, when a Mac user opens <strong>Spotify</strong>, the popular music service will read a configuration file in a way that causes Cb Response to classify regular content files (e.g., Microsoft Word, PDF, .TXT) as an unknown <a href="http://www.webopedia.com/TERM/B/binary_file.html" target="_blank">binary file</a>. A binary file is computer-readable but not human readable; for example, executable programs (e.g., .exe files on Windows) are stored as binary files.</p>
<p>According to Viscuso, the bug was introduced in the Mac version of Cb Response roughly three months ago. He said part of the problem seems to stem from the file classification tool that ships with the Cb Response &#8212; explaining that the tool sometimes misclassifies corrupted binary files. One of the most common sources of corrupted binary files are antivirus products, which often modify suspected malicious binaries after placing the files in quarantine to ensure the programs can&#8217;t be accidentally run.</p>
<p>The Carbon Black discovery comes as more software-as-a-service providers are seeking ways to alert customers who may be inadvertently sharing sensitive data. Amazon recently launched <a href="http://www.csoonline.com/article/3217029/cloud-security/amazon-macie-automates-cloud-data-protection-with-machine-learning.html" target="_blank">Amazon Macie</a>, a new security service that uses machine learning to discover and classify sensitive data such as personal information in AWS, alerting customers when such data is moved, accessed or otherwise publicly available.</p>
<p>Viscuso said the company was considering whether it, too, could offer any additional service that might help customers prevent the accidental sharing of content files to third-party services like VirusTotal. In the meantime, he said, Carbon Black is providing a full list of uploaded files to affected customers, asking them to report whether the files were binaries or content files.</p>


feed_id: https://krebsonsecurity.com/?p=40626
title: Breach at Equifax May Impact 143M Americans
uri: Breach-at-Equifax-May-Impact-143M-Americans
url: https://krebsonsecurity.com/2017/09/breach-at-equifax-may-impact-143m-americans/
content:
<p><strong>Equifax</strong>, one of the &#8220;big-three&#8221; U.S. credit bureaus, said today that a data breach at the company may have affected 143 million Americans, jeopardizing consumer Social Security numbers, birth dates, addresses and some driver&#8217;s license numbers.</p>
<p>In a press release today, Equifax [<a href="https://www.google.com/finance?q=NYSE:EFX" target="_blank">NYSE:EFX</a>] said it discovered the &#8220;unauthorized access&#8221; on July 29, after which it hired an outside forensics firm to investigate. Equifax said the investigation is still ongoing, but that the breach also jeopardized credit card numbers for roughly 209,000 U.S. consumers and &#8220;certain dispute documents with personal identifying information for approximately 182,000 U.S. consumers.&#8221;</p>
<div align="center"><iframe src="http://www.youtube.com/embed/bh1gzJFVFLc" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>In addition, the company said it identified unauthorized access to &#8220;limited personal information for certain UK and Canadian residents,&#8221; and that it would work with regulators in those countries to determine next steps.</p>
<p>“This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do. I apologize to consumers and our business customers for the concern and frustration this causes,” said <strong>Chairman and Chief Executive Officer</strong> <strong>Richard F. Smith</strong> in a statement released to the media, along with <a href="https://youtu.be/bh1gzJFVFLc" target="_blank">a video message</a>. “We pride ourselves on being a leader in managing and protecting data, and we are conducting a thorough review of our overall security operations.”</p>
<p>Equifax said the attackers were able to break into the company&#8217;s systems by exploiting an application vulnerability to gain access to certain files. It did not say which application or which vulnerability was the source of the breach.</p>
<p>Equifax has set up a Web site &#8212; <a href="https://www.equifaxsecurity2017.com" target="_blank">https://www.equifaxsecurity2017.com</a> &#8212; that anyone concerned can visit to see if they may be impacted by the breach. The site also lets consumers enroll in <strong>TrustedID Premier</strong>, a 3-bureau credit monitoring service (Equifax, Experian and Trans Union) that is also operated by Equifax.</p>
<p>According to Equifax, when you begin, you will be asked to provide your last name and the last six digits of your Social Security number. Based on that information, you will receive a message indicating whether your personal information may have been impacted by this incident. Regardless of whether your information may have been impacted, the company says it will provide everyone the option to enroll in <strong>TrustedID Premier</strong>. The offer ends Nov. 21, 2017.</p>
<h4>ANALYSIS</h4>
<p>A time of publication, the Trustedid.com site Experian was promoting for free credit monitoring services was only intermittently available, likely because of the high volume of traffic following today&#8217;s announcement.</p>
<p>Several readers who have taken my advice and placed <a href="https://krebsonsecurity.com/?s=security+freeze&amp;x=0&amp;y=0" target="_blank">security freezes</a> (also called a credit freeze) on their file with Equifax have written in asking whether this intrusion means cybercriminals could also be in possession of the unique PIN code needed to lift the freeze.</p>
<p>So far, the answer seems to be &#8220;no.&#8221; Equifax was clear that its investigation is ongoing. However, in a FAQ about the breach, Equifax said it has found no evidence to date of any unauthorized activity on the company&#8217;s core consumer or commercial credit reporting databases.<span id="more-40626"></span></p>
<p>I have long urged consumers to assume that all of the personal information jeopardized in this breach is already compromised and for sale many times over in the cybercrime underground (because it demonstrably is for a significant portion of Americans). One step in acting on that assumption is placing a credit freeze on one&#8217;s file with the three major credit bureaus and with <strong>Innovis</strong> &#8212; a fourth bureau that is often used by businesses but overlooked by consumers.</p>
<p>For more information on the difference between credit monitoring and a security freeze (and why consumers should take full advantage of both) can be found in <a href="https://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">this story</a>.</p>
<p>I have made no secret of my disdain for the practice of companies offering credit monitoring in the wake of a data breach &#8212; especially in cases where the breach only involves credit card accounts, since credit monitoring services typically only look for new account fraud and do little or nothing to prevent fraud on existing consumer credit accounts.</p>
<p>The fact that the breached entity (Equifax) is offering to sign consumers up for its own identity protection services strikes me as pretty rich. Typically, the way these arrangements work is the credit monitoring is free for a period of time, and then consumers are pitched on purchasing additional protection when their free coverage expires. In the case of this offering, consumers are eligible for the free service for one year.</p>
<p>However, the company appears to be metering how many consumers can sign up for the service at one time, offering the service to many of those affected at a future &#8220;designated enrollment date.&#8221;</p>
<p>That the intruders were able to access such a large amount of sensitive consumer data via a vulnerability in the company&#8217;s Web site suggests that Equifax may have fallen behind in applying security updates to its Internet-facing Web applications. Although the attackers could have exploited an unknown flaw in those applications, I would fully expect Equifax to highlight this fact if it were true &#8212; if for no other reason than doing so might make them less culpable and appear as though this was a crime which could have been perpetrated against any company running said Web applications.</p>
<p>This is hardly the first time Equifax or another major credit bureau has experienced a breach that impacted a significant number of Americans. In May, KrebsOnSecurity reported that fraudsters <a href="https://krebsonsecurity.com/2017/05/fraudsters-exploited-lax-security-at-equifaxs-talx-payroll-division/" target="_blank">exploited lax security at Equifax&#8217;s TALX payroll division</a>, which provides online payroll, HR and tax services.</p>
<p>In 2015, a breach at <strong>Experian</strong> jeopardized the personal data <a href="https://krebsonsecurity.com/2015/10/experian-breach-affects-15-million-consumers/" target="_blank">on at least 15 million consumers</a>. Experian also for several months granted access to its databases to a Vietnamese man posing as a private investigator in the U.S. In reality, the guy was <a href="https://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/" target="_blank">running an identity theft service</a> that let cyber thieves look up personal and financial data <a href="https://krebsonsecurity.com/2014/03/experian-lapse-allowed-id-theft-service-to-access-200-million-consumer-records/" target="_blank">on more than 200 million Americans</a>.</p>
<p>My take on this: The credit bureaus &#8212; which make piles of money by compiling incredibly detailed dossiers on consumers and selling that information to marketers &#8212; have for the most part shown themselves to be terrible stewards of very sensitive data, and are long overdue for more oversight from regulators and lawmakers.</p>
<p>It&#8217;s unclear why Web applications tied to so much sensitive consumer data were left unpatched, but a lack of security leadership at Equifax may have been a contributing factor. Until very recently, the company was searching for someone to fill the role of <a href="https://equifax.gr8people.com/index.gp?opportunityID=7194&amp;method=cappportal.showJob&amp;sysLayoutID=122" target="_blank">vice president of cybersecurity</a>, which according to Equifax is akin to the role of a chief information security officer (CISO).</p>
<p>The company appears to have announced the breach after the close of the stock market on Thursday. Shares of Equifax closed trading on the NSYE at $142.72, up almost one percent over Wednesday&#8217;s price.</p>
<p>This is a developing story. Updates will be added as needed.</p>
<p>Further reading:</p>
<p><a href="http://krebsonsecurity.com/2014/03/are-credit-monitoring-services-worth-it/" target="_blank">Are Credit Monitoring Services Really Worth It?</a></p>
<p><a href="https://krebsonsecurity.com/2015/11/report-everyone-should-get-a-security-freeze/" target="_blank">Report: Everyone Should Get a Security Freeze</a></p>
<p><a href="https://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">How I Learned to Stop Worrying and Embrace the Security Freeze</a></p>


feed_id: https://krebsonsecurity.com/?p=40291
title: Who Is Marcus Hutchins?
uri: Who-Is-Marcus-Hutchins
url: https://krebsonsecurity.com/2017/09/who-is-marcus-hutchins/
content:
<p>In early August 2017, <strong>FBI</strong> agents in Las Vegas arrested 23-year-old British security researcher <strong>Marcus Hutchins</strong> on suspicion of authoring and/or selling &#8220;<strong>Kronos</strong>,&#8221; a strain of malware designed to steal online banking credentials. Hutchins was virtually unknown to most in the security community until May 2017 when the U.K. media revealed him as the &#8220;accidental hero&#8221; who inadvertently halted the global spread of <a href="https://krebsonsecurity.com/?s=wannacry&#038;x=0&#038;y=0" target="_blank">WannaCry</a>, a ransomware contagion that had taken the world by storm just days before.</p>
<p>Relatively few knew it before his arrest, but Hutchins has for many years authored the popular cybersecurity blog <a href="https://www.malwaretech.com/" target="_blank">MalwareTech</a>. When this fact became more widely known &#8212; combined with his hero status for halting Wannacry &#8212; a great many MalwareTech readers quickly leapt to his defense to denounce his arrest. They reasoned that the government&#8217;s case was built on flimsy and scant evidence, noting that Hutchins has worked tirelessly to expose cybercriminals and their malicious tools. To date, some 226 supporters have <a href="https://www.crowdjustice.com/case/malwaretech/" target="_blank">donated more than $14,000</a> to his defense fund.</p>
<div id="attachment_40551" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40551" src="media/896b4b3d.hutchins-580x289.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/hutchins-580x289.png" alt="Marcus Hutchins, just after he was revealed as the security expert who stopped the WannaCry worm. Image: twitter.com/malwaretechblog" width="580" height="289" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/09/hutchins-580x289.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/09/hutchins.png 622w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Marcus Hutchins, just after he was revealed as the security expert who stopped the WannaCry worm. Image: twitter.com/malwaretechblog</p></div>
<p>At first, I did not believe the charges against Hutchins would hold up under scrutiny. But as I began to dig deeper into the history tied to dozens of hacker forum pseudonyms, email addresses and domains he apparently used over the past decade, a very different picture began to emerge.</p>
<p>In this post, I will attempt to describe and illustrate more than three weeks&#8217; worth of connecting the dots from what appear to be Hutchins&#8217; earliest hacker forum accounts to his real-life identity. The clues suggest that Hutchins began developing and selling malware in his mid-teens &#8212; only to later develop a change of heart and earnestly endeavor to leave that part of his life squarely in the rearview mirror.</p>
<h4>GH0STHOSTING/IARKEY</h4>
<p>I began this investigation with a simple search of domain name registration records at <strong>domaintools.com</strong> [full disclosure: Domain Tools recently was an advertiser on this site]. A search for &#8220;Marcus Hutchins&#8221; turned up a half dozen domains registered to a U.K. resident by the same name who supplied the email address &#8220;<strong>surfallday2day@hotmail.co.uk</strong>.&#8221;</p>
<p>One of those domains &#8212; <strong>Gh0sthosting[dot]com</strong> (the third character in that domain is a zero) &#8212; corresponds to a hosting service that was advertised and sold circa 2009-2010 on <a href="https://krebsonsecurity.com/?s=hackforums" target="_blank">Hackforums[dot]net</a>, a massively popular forum overrun with young, impressionable men who desperately wish to be elite coders or hackers (or at least recognized as such by their peers).</p>
<p>The surfallday2day@hotmail.co.uk address tied to Gh0sthosting&#8217;s initial domain registration records also was used to <a href="media/f2afc282.iarkeyskpe.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/iarkeyskpe.png" target="_blank">register a Skype account</a> named <strong>Iarkey</strong> that listed its alias as &#8220;Marcus.&#8221; A <a href="https://www.twitter.com/iarkey" target="_blank">Twitter account</a> registered in 2009 under the nickname &#8220;Iarkey&#8221; points to Gh0sthosting[dot]com.</p>
<p>Gh0sthosting was sold by a Hackforums user who used the same Iarkey nickname, and in 2009 Iarkey told fellow Hackforums users in a sales thread for his business that Gh0sthosting was &#8220;mainly for blackhats wanting to phish.&#8221; In a separate post just a few days apart from that sales thread, Iarkey <a href="media/a8022fbf.daloseronly15.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/daloseronly15.png" target="_blank">responds that he is &#8220;only 15&#8221; years old</a>, and in another he confirms that his email address is surfallday2day@hotmail.co.uk.</p>
<p><img class="aligncenter size-full wp-image-40521" src="media/a8022fbf.daloseronly15.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/daloseronly15.png" alt="daloseronly15" width="512" height="266" /></p>
<p>A review of the historic reputation tied to the Gh0sthosting domain suggests that at least some customers took Iarkey up on his offer: <strong>Malwaredomainlist.com</strong>, for example, <a href="http://www.malwaredomainlist.com/mdl.php?inactive=on&amp;sort=IP&amp;search=dnsless.gh0sthosting.com&amp;colsearch=All&amp;ascordesc=DESC&amp;quantity=100&amp;page=0" target="_blank">shows</a> that around this same time in 2009 Gh0sthosting was observed hosting plenty of malware, including trojan horse programs, phishing pages and malware exploits.</p>
<p>A &#8220;reverse WHOIS&#8221; search at Domaintools.com shows that Iarkey&#8217;s surfallday2day email address was used initially to register several other domains, including <strong>uploadwith[dot]us</strong> and <strong>thecodebases[dot]com</strong>.</p>
<p>Shortly after registering Gh0sthosting and other domains tied to his surfallday2day@hotmail.co.uk address, Iarkey evidently thought better of including his real name and email address in his domain name registration records. Thecodebases[dot]com, for example, changed its WHOIS ownership to a &#8220;James Green&#8221; in the U.K., and switched the email to &#8220;<strong>herpderpderp2@hotmail.co.uk</strong>.&#8221;</p>
<p>A reverse WHOIS lookup at domaintools.com for that email address shows it was used to register a Hackforums parody (or phishing?) site called <strong>Heckforums[dot]net</strong>. The domain records showed this address was tied to a Hackforums clique called &#8220;<strong>Atthackers</strong>.&#8221; The records also listed a <strong>Michael Chanata</strong> from Florida as the owner. We&#8217;ll come back to Michael Chanata and Atthackers at the end of this post.<span id="more-40291"></span></p>
<h4>DA LOSER/FLIPERTYJOPKINS</h4>
<p>As early as 2009, Iarkey was outed several times on Hackforums as being Marcus Hutchins from the United Kingdom. In most of those instances he <a href="media/80ac642f.iarkey-daloser-hutchins-whoismyname.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/iarkey-daloser-hutchins-whoismyname.png" target="_blank">makes no effort to deny the association</a> &#8212; and in a handful of posts he laments that fellow members felt the need to &#8220;dox&#8221; him by posting his real address and name in the hacking forum for all to see.</p>
<p>Iarkey, like many other extremely active Hackforums users, changed his nickname on the forum constantly, and two of his early nicknames on Hackforums around 2009 were &#8220;<strong>Flipertyjopkins</strong>&#8221; and &#8220;<strong>Da Loser</strong>&#8220;.</p>
<div id="attachment_40518" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/80ac642f.iarkey-daloser-hutchins-whoismyname.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/iarkey-daloser-hutchins-whoismyname.png"> <img class="wp-image-39807 size-medium" src="media/ffc9ff41.iarkey-daloser-hutchins-whoismyname-580x317.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/iarkey-daloser-hutchins-whoismyname-580x317.png" alt=" " width="500" height="317" /></a><p class="wp-caption-text">Hackforums user &#8220;Da Loser&#8221; is doxed by another member.</p></div>
<p>Happily, Hackforums has a useful feature that allows anyone willing to take the time to dig through a user&#8217;s postings to learn when and if that user was previously tied to another account.</p>
<p>This is especially evident in multi-page Hackforums discussion threads that span many days or weeks: If a user changes his nickname during that time, the forum is set up so that it includes the user&#8217;s most previous nickname in any replies that quote the original nickname &#8212; ostensibly so that users can follow along with who&#8217;s who and who said what to whom.</p>
<p>In the screen shot below, for instance, we can see one of Hutchins&#8217; earliest accounts &#8212; Da Loser &#8212; being quoted under his Flipertyjopkins nickname.</p>
<div id="attachment_40519" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/e348b533.daloser-fliperty2.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/daloser-fliperty2.png"> <img class="wp-image-39807 size-medium" src="media/8e137346.daloser-fliperty2-580x219.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/daloser-fliperty2-580x219.png" alt=" " width="500" height="317" /></a><p class="wp-caption-text">A screen shot showing Hackforums&#8217; tendency to note when users switch between different usernames.</p></div>
<p>Both the Da Loser and Flipertyjopkins identities on Hackforums referenced the same domains in 2009 as theirs &#8212; Gh0sthosting &#8212; as well as another domain called &#8220;<strong>hackblack.co[dot]uk</strong>.&#8221; Da Loser references the hackblack domain as the place where other Hackforums users can download &#8220;the sourcecode of my IE/MSN messenger password stealer (aka M_Stealer).&#8221;</p>
<a class="lightbox" href="media/21aaa4a6.daloser-hackblack.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/daloser-hackblack.png"> <img class="wp-image-39807 size-medium" src="media/a0c79a17.daloser-hackblack-580x141.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/daloser-hackblack-580x141.png" alt=" " width="580" height="141" /></a>
<p>In another post, Da Loser brags about how his password stealing program goes undetected by multiple antivirus scanners, pointing to a (now deleted) screenshot at a Photobucket account for a &#8220;flipertyjopkins&#8221;:</p>
<a class="lightbox" href="media/a8933c19.daloser-iestealer-hackblack.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/daloser-iestealer-hackblack.png"> <img class="wp-image-39807 size-medium" src="media/b57d40e9.daloser-iestealer-hackblack-580x264.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/daloser-iestealer-hackblack-580x264.png" alt=" " width="580" height="264" /></a>
<p>Another screenshot from Da Loser&#8217;s postings in June 2009 shows him advertising the Hackblack domain and the Surfallday2day@hotmail.co.uk address:</p>
<div id="attachment_40523" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/6a518dfa.daloser-cheaphosting-hackblack-HF.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/daloser-cheaphosting-hackblack-HF.png"> <img class="wp-image-39807 size-medium" src="media/8f5b3252.daloser-cheaphosting-hackblack-HF-580x170.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/daloser-cheaphosting-hackblack-HF-580x170.png" alt=" " width="580" height="170" /></a><p class="wp-caption-text">Hackforums user &#8220;Da Loser&#8221; advertises his &#8220;Hackblack&#8221; hosting and points to the surfallday2day email address.</p></div>
<p>An Internet search for this Hackblack domain reveals <a href="https://community.mybb.com/thread-48779-post-341323.html" target="_blank">a thread on the Web hosting forum MyBB</a> started by a user Flipertyjopkins, who asks other members for help configuring his site, which he lists as http://hackblack.freehost10[dot]com.</p>
<div id="attachment_40525" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/a4148db9.flipperty-mybb.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/flipperty-mybb.png"> <img class="wp-image-39807 size-medium" src="media/eff30812.flipperty-mybb-580x569.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/flipperty-mybb-580x569.png" alt=" " width="580" height="569" /></a><p class="wp-caption-text">A user named Flipertyjopkins asks for help for his domain, hackblack.freehost10[dot]com.</p></div>
<p>Poking around the Web for these nicknames and domains turned up a <strong>Youtube</strong> user account named Flipertyjopkins that includes several videos uploaded 7-8 years ago that instruct viewers on how to use various types of password-stealing malware. In one of the videos &#8212; titled &#8220;<a href="https://www.youtube.com/watch?v=Iy8K0YXW1Uw" target="_blank">Hotmail cracker v1.3</a>&#8221; &#8212; Flipertyjopkins narrates how to use a piece of malware by the same name to steal passwords from unsuspecting victims.</p>
<p>Approximately two minutes and 48 seconds into the video, we can briefly see an MSN Messenger chat window shown behind the Microsoft Notepad application he is using to narrate the video. The video clearly shows that the MSN Messenger client is logged in to with the address &#8220;hutchins22@hotmail.com.&#8221;</p>
<div id="attachment_40526" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/73f2d2d5.fliperty.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/fliperty.png"> <img class="wp-image-39807 size-medium" src="media/f7d48284.fliperty-580x170.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/fliperty-580x170.png" alt=" " width="580" height="170" /></a><p class="wp-caption-text">The email address &#8220;hutchins22@hotmail.com&#8221; can be seen briefly in the background of this video.</p></div>
<p>To close out the discussion of Flipertyjopkins, I should note that this email address showed up multiple times in the database leak from <strong>Hostinger.co.uk</strong>, a British Web hosting company that <a href="https://threatpost.com/web-hosting-service-000webhost-hacked-information-of-13-million-leaked/115200/" target="_blank">got hacked in 2015</a>. A copy of that database can be found in several places online, and it shows that one Hostinger customer named Marcus used an account under the email address <strong>flipertyjopkins@gmail.com</strong>.</p>
<p>According to the leaked user database, the password for that account &#8212; &#8220;<strong>emmy009</strong>&#8221; &#8212; also was used to register two other accounts at Hostinger, including the usernames &#8220;hacker&#8221; (email address: <strong>flipertyjopkins@googlemail.com</strong>) and &#8220;flipertyjopkins&#8221; (email: surfallday2day@hotmail.co.uk).</p>
<h4>ELEMENT PRODUCTS/GONE WITH THE WIND</h4>
<p>Most of the activities and actions that can be attributed to Iarkey/Flipertyjopkins/Da Loser et. al on Hackforums are fairly small-time  &#8212; and hardly rise to the level of coding from scratch a complex banking trojan and selling it to cybercriminals.</p>
<p>However, multiple threads on Hackforums state that Hutchins around 2011-2012 switched to two new nicknames that corresponded to users who were far more heavily involved in coding and selling complex malicious software: &#8220;<strong>Element Products</strong>,&#8221; and later, &#8220;<strong>Gone With The Wind</strong>.&#8221;</p>
<p>Hackforums&#8217; nickname preservation feature leaves little doubt that the user Element Products at some point in 2012 changed his nickname to Gone With the Wind. However, for almost a week I could not see any signs of a connection between these two accounts and the ones previously and obviously associated with Hutchins (Flipertyjopkins, Iarkey, etc.).</p>
<p>In the meantime, I endeavored to find out as much as possible about <strong>Element Products</strong> &#8212; a suite of software and services including a keystroke logger, a &#8220;stresser&#8221; or online attack service, as well as a &#8220;no-distribute&#8221; malware scanner.</p>
<p>Unlike legitimate scanning services such as <a href="https://www.virustotal.com" target="_blank">Virustotal</a> &#8212; which scan malicious software against dozens of antivirus tools and then share the output with all participating antivirus companies &#8212; no-distribute scanners are made and marketed to malware authors who wish to see how broadly their malware is detected without tipping off the antivirus firms to a new, more stealthy version of the code.</p>
<p>Indeed, Element Scanner &#8212; which was sold in subscription packages starting at $40 per month &#8212; scanned all customer malware with some 37 different antivirus tools. But according to posts from Gone With the Wind, the scanner merely resold the services of <a href="https://krebsonsecurity.com/tag/scan4you-net/" target="_blank">scan4you[dot]net</a>, a multiscanner that was extremely powerful and popular for several years across a variety of underground cybercrime forums.</p>
<p><img class="aligncenter size-medium wp-image-40545" src="media/7d6c652f.element-580x754.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/element-580x754.png" alt="element" width="580" height="754" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/09/element-580x754.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/09/element.png 679w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>According to <a href="https://www.bleepingcomputer.com/news/security/owners-of-virustotal-for-crooks-service-arrested/" target="_blank">a story at Bleepingcomputer.com</a>, scan4you disappeared in July 2017, around the same time that two Latvian men were arrested for running an unnamed no-distribute scanner.</p>
<p>[Side note: Element Scanner was later incorporated as the default scanning application of &#8220;<strong>Blackshades</strong>,&#8221; a remote access trojan that was extremely popular on Hackforums for several years until its developers and dozens of customers <a href="https://krebsonsecurity.com/2014/05/blackshades-trojan-users-had-it-coming/" target="_blank">were arrested in an international law enforcement sting in May 2014</a>. Incidentally, as the story linked in the previous sentence explains, the administrator and owner of Hackforums would play an integral role in setting up many of his forum&#8217;s users for the Blackshades sting operation.]</p>
<p>According to one thread on Hackforums, Element Products was sold in 2012 to another Hackforums user named &#8220;Dal33t.&#8221; This was the nickname used by <strong>Ammar Zuberi</strong>, a young man from Dubai who &#8212; according to this <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank">this January 2017 KrebsOnSecurity story</a> &#8212; may have been associated with a group of miscreants on Hackforums that specialized in using botnets to take high-profile Web sites offline. Zuberi could not be immediately reached for comment.</p>
<p>I soon discovered that Element Products was by far the least harmful product that this user sold on Hackforums. In a separate thread in 2012, Element Products announces the availability of a new product he had for sale &#8212; dubbed the &#8220;<a href="media/919cb1be.aresformgrabber.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/aresformgrabber.png" target="_blank">Ares Form Grabber</a>&#8221; &#8212; a program that could be used to surreptitiously steal usernames and passwords from victims.</p>
<p>Element Products/Gone With The Wind also advertised himself on Hackforums as an authorized reseller of the infamous exploit kit known as &#8220;<a href="https://krebsonsecurity.com/?s=blackhole&amp;x=0&amp;y=0" target="_blank">Blackhole</a>.&#8221; Exploit kits are programs made to be stitched into hacked and malicious Web sites so that when visitors browse to the site with outdated and insecure browser plugins the browser is automatically infected with whatever malware the attacker wishes to foist on the victim.</p>
<p>In addition, Element Products ran a &#8220;bot shop,&#8221; in which he sold access to bots claimed to have enslaved through his own personal use of Blackhole:</p>
<div id="attachment_40544" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/4e859be1.botshop.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/botshop.png"> <img class="wp-image-39807 size-medium" src="media/db8785fb.botshop-580x432.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/botshop-580x432.png" alt=" " width="580" height="432" /></a><p class="wp-caption-text">Gone With The Wind&#8217;s &#8220;Bot Shop,&#8221; which sold access to computers hacked with the help of the Blackhole exploit kit.</p></div>
<p>A bit more digging showed that the Element Products user on Hackforums co-sold his wares along with another Hackforums user named &#8220;<strong>Kill4Joy</strong>,&#8221; who advertised his contact address as <strong>kill4joy@live.com</strong>.</p>
<p>Ironically, Hackforums was itself hacked in 2012, and a leaked copy of the user database from that hack shows this Kill4Joy user initially registered on the forum in 2011 with the email address <strong>rohang93@live.com</strong>.</p>
<p>A reverse WHOIS search at domaintools.com shows that email address was used to register several domain names, including <strong>contegoprint.info</strong>. The registration records for that domain show that it was registered by a <strong>Rohan Gupta</strong> from Illinois.</p>
<p>I learned that Gupta is now attending graduate school at the <strong>University of Illinois at Urbana-Champaign</strong>, where he is studying computer engineering. Reached via telephone, Gupta confirmed that he worked with the Hackforums user Element Products six years ago, but said he only handled sales for the Element Scanner product, which he says was completely legal.</p>
<p>&#8220;I was associated with Element Scanner which was non-malicious,&#8221; Gupta said. &#8220;It wasn&#8217;t black hat, and I wasn&#8217;t associated with the programming, I just assisted with the sales.&#8221;</p>
<p>Gupta said his partner and developer of the software went by the name <strong>Michael Chanata</strong> and communicated with him via a Skype account registered to the email address <strong>atthackers@hotmail.com</strong>.</p>
<p>Recall that we heard at the beginning of this story that the name Michael Chanata was tied to Heckforums.net, a domain closely connected to the Iarkey nickname on Hackforums. Curious to see if this Michael Chanata character showed up somewhere on Hackforums, I used the forum&#8217;s search function to find out.</p>
<p>The following screenshot from a July 2011 Hackforums thread suggests that Michael Chanata was yet another nickname used by Da Loser, a Hackforums account associated with Marcus Hutchins&#8217; early email addresses and Web sites.</p>
<div id="attachment_40530" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/24420d4a.daloser-chanata.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/daloser-chanata.png"> <img class="wp-image-39807 size-medium" src="media/bc5668b2.daloser-chanata-580x333.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/daloser-chanata-580x333.png" alt="daloser-chanata" alt=" " width="580" height="333" /></a><p class="wp-caption-text">Hackforums shows that the user &#8220;Da Loser&#8221; at the same time used the nickname &#8220;Michael Chanata.&#8221;</p></div>
<h4>BV1/ORGY</h4>
<p>Interesting connections, to be sure, but I wasn&#8217;t satisfied with this finding and wanted more conclusive evidence of the supposed link. So I turned to &#8220;passive DNS&#8221; tools from <a href="https://www.dnsdb.info/" target="_blank">Farsight Security</a> — which keeps a historic record of which domain names map to which IP addresses.</p>
<p>Using Farsight&#8217;s tools, I found that Element Scanner&#8217;s various Web sites (elementscanner[dot]com/net/su/ru) were at one point hosted at the Internet address <strong>184.168.88.189 </strong>alongside just a handful of other interesting domains, including <strong>bigkeshhosting[dot]com</strong> and <strong>bvnetworks[dot]com</strong>.</p>
<p>At first, I didn&#8217;t fully recognize the nicknames buried in each of these domains, but a few minutes of searching on Hackforums reminded me that bigkeshhosting[dot]com was a project run by a Hackforums user named &#8220;Orgy.&#8221;</p>
<p>I originally wrote about Orgy &#8212; whose real name is <strong>Robert George Danielson</strong> &#8212; in <a href="https://krebsonsecurity.com/2012/08/booter-shells-turn-web-sites-into-weapons/" target="_blank">a 2012 story</a> about a pair of stresser or &#8220;booter&#8221; (DDoS-for-hire) sites. As noted in that piece, Danielson has had several brushes with the law, including a guilty plea for stealing multiple firearms from the home of a local police chief.</p>
<p>I also learned that the bvnetworks[dot]com domain belonged to Orgy&#8217;s good friend and associate on Hackforums &#8212; a user who for many years went by the nickname &#8220;BV1.&#8221; In real life, BV1 is 27-year-old <strong>Brendan Johnston</strong>, a California man <a href="https://www.justice.gov/usao-sdny/pr/california-man-pleads-guilty-manhattan-federal-court-selling-blackshades-malware" target="_blank">who went to prison in 2014</a> for his role in selling the Blackshades trojan.</p>
<p>When I discovered the connection to BV1, I searched my inbox for anything related to this nickname. Lo and behold, I found an anonymous tip I&#8217;d received through KrebsOnSecurity.com&#8217;s contact form in March 2013 which informed me of BV1&#8217;s real identity and said he was close friends with Orgy and the Hackforums user Iarkey.</p>
<p>According to this anonymous informant, Iarkey was an administrator of an Internet relay chat (IRC) forum that BV1 and Orgy frequented called <strong>irc.voidptr.cz</strong>.</p>
<p>&#8220;You already know that Orgy is running a new booter, but BV1 claims to have &#8216;left&#8217; the hacking business because all the information on his family/himself has been leaked on the internet, but that is a lie,&#8221; the anonymous tipster wrote. &#8220;If you connect to http://irc.voidptr. cz ran by &#8216;touchme&#8217; aka &#8216;iarkey&#8217; from hackforums you can usually find both BV1 and Orgy in there.&#8221;</p>
<h4>TOUCHME/TOUCH MY MALWARE/MAYBE TOUCHME</h4>
<p>Until recently, I was unfamiliar with the nickname TouchMe. Naturally, I started digging into Hackforums again. An exhaustive search on the forum shows that TouchMe &#8212; and later &#8220;<a href="media/e612de56.touchmemaybe-iarkey.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/touchmemaybe-iarkey.png" target="_blank">Touch Me Maybe</a>&#8221; and &#8220;<a href="media/a12ad185.mwt-touchmymalware.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/mwt-touchmymalware.png" target="_blank">Touch My Malware</a>&#8221; &#8212; were yet other nicknames for the same account.</p>
<p>In a Hackforums post from July 2012, the user Touch Me Maybe pointed to a writeup that he claimed to have authored on his own Web site: <strong>touchmymalware.blogspot.com:</strong></p>
<div id="attachment_40541" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/c6fbe7ff.touchmemaybe-touchmymalware.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/touchmemaybe-touchmymalware.png"> <img class="wp-image-39807 size-medium" src="media/2e721b91.touchmemaybe-touchmymalware-580x112.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/touchmemaybe-touchmymalware-580x112.png" alt=" " width="580" height="112" /></a><p class="wp-caption-text">The Hackforums user &#8220;Touch Me Maybe&#8221; seems to refer to his own blog and malware analysis at touchmymalware.blogspot.com, which now redirects to Marcus Hutchins&#8217; blog &#8212; Malwaretech.com</p></div>
<p>If you visit this domain name now, it redirects to <strong>Malwaretech.com</strong>, which is the same blog that Hutchins was updating for years until his arrest in August.</p>
<p>There are other facts to support a connection between MalwareTech and the IRC forum voidptr.cz: A passive DNS scan for irc.voidptr.cz at Farsight Security shows that at one time the IRC channel was hosted at the Internet address <strong>52.86.95.180</strong> &#8212; where it shared space with just one other domain: irc.malwaretech.com.</p>
<p>All of the connections explained in this blog post &#8212; and some that weren&#8217;t &#8212; can be seen in the following mind map that I created with the excellent <strong>MindNode Pro</strong> for Mac.</p>
<div id="attachment_40592" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/977c661f.gh0stele.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/gh0stele.png"> <img class="wp-image-39807 size-medium" src="media/3e3c6ed2.gh0stele-580x275.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/gh0stele-580x275.png" alt=" " width="580" height="275" /></a><p class="wp-caption-text">A mind map I created to keep track of the myriad data points mentioned in this story. Click the image to enlarge.</p></div>
<p>Following Hutchins&#8217; arrest, multiple Hackforums members posted what they suspected about his various presences on the forum. In one post from October 2011, Hackforums founder and administrator <strong>Jesse &#8220;Omniscient&#8221; LaBrocca</strong> said Iarkey <a href="media/301d528f.omni-hundredsofaccounts-1.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/omni-hundredsofaccounts-1.png" target="_blank">had hundreds of accounts</a> on Hackforums.</p>
<p>In one of the longest threads on Hackforums about Hutchins&#8217; arrest there are several postings from a user named &#8220;Previously Known As&#8221; who self-identifies in that post and multiple related threads as BV1. In one such post, dated Aug. 7, 2017, BV1 observes that Hutchins failed to successfully separate his online selves from his real life identity.</p>
<div id="attachment_40549" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/65ac8893.bv1-mwt-warnedhim-1.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/bv1-mwt-warnedhim-1.png"> <img class="wp-image-39807 size-medium" src="media/a915ff81.bv1-mwt-warnedhim-1-580x196.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/bv1-mwt-warnedhim-1-580x196.png" alt=" " width="580" height="196" /></a><p class="wp-caption-text">Brendan &#8220;BV1&#8221; Johnston says he worried his old friend&#8217;s operational security mistakes would one day catch up with him.</p></div>
<p>&#8220;He definitely thought he separated TouchMe/MWT from iarkey/Element,&#8221; said BV1. &#8220;People warned him, myself included, that people can still connect MWT to iarkey, but he never seemed to care too much. He has so many accounts on HF at this point, I doubt someone will be able to connect all the dots. It sucks that some of the worst accounts have been traced back to him already. He ran a hosting company and a Minecraft server with Orgy and I.&#8221;</p>
<p>In a brief interview with KrebsOnSecurity, Brendan &#8220;BV1&#8221; Johnston said Hutchins was a good friend. Johnston said Hutchins had &#8212; like many others who later segued into jobs in the information security industry &#8212; initially dabbled in the dark side. But Johnston said his old friend sincerely tried to turn things around in late 2012 &#8212; when Gone With the Wind sold most of his coding projects to other Hackforums members and began focusing on blogging about poorly-written malware.</p>
<p>&#8220;I feel like I know Marcus better than most people do online, and when I heard about the accusations I was completely shocked,&#8221; Johnston said. &#8220;He tried for such a long time to steer me down a straight and narrow path that seeing this tied to him didn&#8217;t make sense to me at all.&#8221;</p>
<p>Let me be clear: I have no information to support the claim that Hutchins authored or sold the Kronos banking trojan. According to the government, Hutchins did so in 2014 on the Dark Web marketplace <strong>AlphaBay</strong> &#8212; which was taken down in July 2017 as part of <a href="https://krebsonsecurity.com/?s=alphabay&amp;x=0&amp;y=0" target="_blank">a coordinated, global law enforcement raid</a> on AlphaBay sellers and buyers alike.</p>
<p>However, the findings in this report suggest that for several years Hutchins enjoyed a fairly successful stint coding malicious software for others, said <strong>Nicholas Weaver</strong>, a security researcher at the <a href="https://www.icsi.berkeley.edu/" target="_blank">International Computer Science Institute</a> and a lecturer at <strong>UC Berkeley.</strong></p>
<p>&#8220;It appears like Mr. Hutchins had a significant and prosperous blackhat career that he at least mostly gave up in 2013,&#8221; Weaver said. &#8220;Which might have been forgotten if it wasn’t for the involuntary British press coverage on WannaCry raising his profile and making him out as a &#8216;hero&#8217;.&#8221;</p>
<p>Weaver continued:</p>
<p>&#8220;I can easily imagine the Feds taking the opportunity to use a penny-ante charge against a known &#8216;bad guy&#8217; when they can’t charge for more significant crimes,&#8221; he said. &#8220;But the Feds would have done far less collateral damage if they actually provided a criminal complaint with these sorts of detail rather than a perfunctory indictment.&#8221;</p>
<p>Hutchins did not try to hide the fact that he has written and published unique malware strains, which in the United States at least is a form of protected speech.</p>
<p>In December 2014, for example, Hutchins posted <a href="https://github.com/MalwareTech/TinyXPB" target="_blank">to his Github page</a> the source code to <a href="https://webcache.googleusercontent.com/search?q=cache:-dJCVEkeYJ8J:https://dlscrib.com/tinyxpb-windows-xp-32-bit-bootkit_58b9733be12e899f4aadd383_pdf.html+&amp;cd=16&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank">TinyXPB</a>, malware he claims to have written that is designed to seize control of a computer so that the malware loads before the operating system can even boot up.</p>
<p>While the publicly available documents related to his case are light on details, it seems clear that prosecutors can make a case against those who attempt to sell malware to cybercriminals &#8212; such as on hacker forums like AlphaBay &#8212; if they can demonstrate the accused had knowledge and intent that the malware would be used to commit a crime. </p>
<p>The Justice Department&#8217;s <a href="https://www.documentcloud.org/documents/3912520-Marcus-Hutchinson-Indictment.html" target="_blank">indictment against Hutchins</a> suggests that the prosecution is relying heavily on the word of an unnamed co-conspirator who became a confidential informant for the government. <strong>Update, 9:08 a.m.:</strong>  Several readers on Twitter disagreed with the previous statement, noting that U.S. prosecutors have said the other unnamed suspect in the Hutchins indictment <a href="https://www.theguardian.com/technology/2017/aug/04/wannacry-marcus-hutchins-kronos-malware-arrest" target="_blank">is still at large</a>.</p>
<p><em>Original story:</em></p>
<p>According to <a href="https://www.bankinfosecurity.com/blogs/case-against-marcus-malwaretech-hutchins-gets-complex-p-2537" target="_blank">a story</a> at <em>BankInfoSecurity</em>, the evidence submitted by prosecutors for the government includes:</p>
<ul>
<li>Statements made by Hutchins after he was arrested.</li>
<li>A CD containing two audio recordings from a county jail in Nevada where he was detained by the FBI.</li>
<li>150 pages of Jabber chats between the defendant and an individual.</li>
<li>Business records from Apple, Google and Yahoo.</li>
<li>Statements (350 pages) by the defendant from another internet forum, which were seized by the government in another district.</li>
<li>Three to four samples of malware.</li>
<li>A search warrant executed on a third party, which may contain some privileged information.</li>
</ul>
<p>Hutchins declined to comment for this story, citing his ongoing prosecution. He has pleaded not guilty to all four counts against him, including conspiracy to distribute malicious software with the intent to cause damage to 10 or more affected computers without authorization, and conspiracy to distribute malware designed to intercept protected electronic communications. FBI officials have not yet responded to requests for comment.</p>


feed_id: https://krebsonsecurity.com/?p=40470
title: Twitter Bots Use Likes, RTs for Intimidation
uri: Twitter-Bots-Use-Likes-RTs-for-Intimidation
url: https://krebsonsecurity.com/2017/08/twitter-bots-use-likes-rts-for-intimidation/
content:
<p>I awoke this morning to find my account on <strong>Twitter</strong> (<a href="https://www.twitter.com/briankrebs" target="_blank">@briankrebs</a>) had attracted almost 12,000 new followers overnight. Then I noticed I&#8217;d gained almost as many followers as the number of re-tweets (RTs) earned for <a href="https://twitter.com/briankrebs/status/902545914304319491" target="_blank">a tweet I published on Tuesday</a>. The tweet stated how every time I tweet something related to <strong>Russian President Vladimir Putin</strong> I get a predictable stream of replies that are in support of <strong>President Trump</strong> &#8212; even in cases when neither Trump nor the 2016 U.S. presidential campaign were mentioned.</p>
<div id="attachment_40479" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40479" src="media/ace75d2d.botcomment-580x619.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/botcomment-580x619.png" alt="This tweet about Putin generated more than 12,000 retweets and likes in a few hours." width="580" height="619" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/08/botcomment-580x619.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/08/botcomment.png 668w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">This tweet about Putin generated more than 12,000 retweets and likes in a few hours.</p></div>
<p>Upon further examination, it appears that almost all of my new followers were compliments of a social media botnet that is being used to amplify fake news and to intimidate journalists, activists and researchers. The botnet or botnets appear to be targeting people who are exposing the extent to which sock puppet and bot accounts on social media platforms can be used to influence public opinion.</p>
<p>After tweeting about my new bounty of suspicious-looking Twitter friends I learned from my legitimate followers on Twitter that @briankrebs wasn&#8217;t alone and that several journalists and nonprofit groups that have written recently about bot-like activity on Twitter experienced something similar over the past few days.</p>
<p>These tweet and follow storms seem capable of tripping some kind of mechanism at Twitter that seeks to detect when accounts are suspected of artificially beefing up their follower counts by purchasing followers (for more on that dodgy industry, check out <a href="https://krebsonsecurity.com/2013/08/buying-battles-in-the-war-on-twitter-spam/" target="_blank">this post</a>).</p>
<p>Earlier today, <em>Daily Beast</em> cybersecurity reporter <strong>Joseph Cox</strong> <a href="http://www.thedailybeast.com/how-a-bot-army-probably-got-me-kicked-off-twitter" target="_blank">had his Twitter account suspended temporarily</a> after the account was the beneficiary of hundreds of bot followers over a brief period on Tuesday. This likely was the goal in the campaign against my site as well.</p>
<div id="attachment_40486" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40486" src="media/4c7d10ae.jcox-580x515.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/jcox-580x515.png" alt="Cox observed the same likely bot accounts that followed him following me and a short list of other users in the same order." width="580" height="515" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/08/jcox-580x515.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/08/jcox.png 721w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Cox observed the same likely bot accounts that followed him following me and a short list of other users in the same order.</p></div>
<p>&#8220;Right after my Daily Beast story about suspicious activity by pro-Kremlin bots went live, my own account came under attack,&#8221; Cox wrote.</p>
<p>Let that sink in for a moment: A huge collection of botted accounts &#8212; the vast majority of which should be easily detectable as such &#8212; may be able to abuse Twitter&#8217;s anti-abuse tools to temporarily shutter the accounts of real people suspected of being bots!</p>
<p>Overnight between Aug. 28 and 29, a large Twitter botnet took aim at <a href="https://www.twitter.com/dfrlab" target="_blank">the account</a> for the <strong>Digital Forensic Research Lab</strong>, a project run by the <a href="https://en.wikipedia.org/wiki/Atlantic_Council" target="_blank">Atlantic Council</a>, a political think-tank based in Washington, D.C. In a post about the incident, DFRLab said the attack used fake accounts to impersonate and attack its members.</p>
<p>Those personal attacks &#8212; which included tweets and images lamenting the supposed death of DFR senior fellow <a href="https://www.twitter.com/benimmo" target="_blank">Ben Nimmo</a> &#8212; were then amplified and re-tweeted by tens of thousands of apparently automated accounts, according to <a href="https://medium.com/dfrlab/botspot-the-intimidators-135244bfe46b" target="_blank">a blost post</a> published today by DFRLab.</p>
<p>Suspecting that DFRLab was now being followed by many more botted accounts that might retweet or otherwise react to any further tweets mentioning bot attacks, Nimmo cleverly composed another tweet about the bot attack &#8212; only this time CC&#8217;ing the @Twitter and @Twittersupport accounts. Sure enough, that sly tweet was retweeted by bots more than 73,000 times before the tweet storm died down.</p>
<p><img class="aligncenter size-medium wp-image-40485" src="media/584a30cf.tweetbotattack-580x284.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/tweetbotattack-580x284.png" alt="tweetbotattack" width="580" height="284" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/08/tweetbotattack-580x284.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/08/tweetbotattack.png 720w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>&#8220;We considered that the bots had probably been programmed to react to a relatively simple set of triggers, most likely the words &#8216;bot attack&#8217; and the @DFRLab handle,&#8221; Nimmo wrote. &#8220;To test the hypothesis, we posted a tweet mentioning the same words, and were retweeted over 500 times in nine minutes — something which, admittedly, does not occur regularly with our human followers.&#8221; Read more about the DFRLab episode <a href="https://medium.com/dfrlab/botspot-the-intimidators-135244bfe46b" target="_blank">here</a>.</p>
<p>This week&#8217;s Twitter bot drama follows similar attacks on public interest groups earlier this month. On Aug. 19, the award-winning investigative journalism site <strong>ProPublica.org</strong> published the story, <a href="https://www.propublica.org/article/leading-tech-companies-help-extremist-sites-monetize-hate/" target="_blank">Leading Tech Companies Help Extremist Sites Monetize Hate</a>.</p>
<p>On the morning of Tuesday, Aug. 22, several ProPublica reporters began receiving <a href="https://krebsonsecurity.com/?s=email+flood&amp;x=0&amp;y=0" target="_blank">email bombs</a> &#8212; email list subscription attacks that can inundate a targeted inbox with dozens or even hundreds of email list subscription confirmation requests per minute. These attacks are designed to deluge the victim&#8217;s inbox with so many subscription confirmation requests that it becomes extremely time-consuming to fish out the legitimate messages amid the dross.</p>
<p>On Wednesday ProPublica author <strong>Jeff Larson</strong> saw <a href="https://twitter.com/thejefflarson/status/900089494027632641" target="_blank">a tweet he sent</a> about the email attacks get re-tweeted 1,200 times. Later that evening, senior reporting fellow <strong>Lauren Kirchner</strong> noticed a similar sized response to <a href="https://twitter.com/lkirchner/status/900338815965040641" target="_blank">her tweet</a> about how the subscription attack was affecting her ability to respond to messages.</p>
<p>On top of that, several ProPublica staffers suddenly gained about 500 new followers. On Thursday, ProPublica&#8217;s managing editor <strong>Eric Umansky</strong> <a href="https://twitter.com/ericuman/status/900877797236891648" target="_blank">noticed</a> that a tweet accusing ProPublica of being an &#8220;alt-left #HateGroup and #FakeNews site funded by Soros&#8221; had received more than 23,000 re-tweets.<span id="more-40470"></span></p>
<p>Today, the 500 or so bot accounts that had followed the ProPublica employees unfollowed them. Interestingly, a little more than 24 hours after the tweet that got my account 12,000+ new followers, all of those followers are no longer following @briankrebs.</p>
<p>I thought at first perhaps Twitter had suspended the accounts, but a random check of the 11,500+ accounts that I was able to catalog today as new followers shows that most of them remain active.</p>
<p>Asked to respond to criticism that it isn&#8217;t doing enough to find and ban bot accounts on its network, Twitter declined to comment, directing me instead to <a href="https://blog.twitter.com/official/en_us/topics/company/2017/Our-Approach-Bots-Misinformation.html" target="_blank">this post</a> in June from Twitter Vice President of Public Policy <strong>Colin Crowell</strong>, which stated in part:</p>
<blockquote><p>While bots can be a positive and vital tool, from customer support to public safety, we strictly prohibit the use of bots and other networks of manipulation to undermine the core functionality of our service. We’ve been doubling down on our efforts here, <b>expanding our team and resources, and building new tools and processes</b>. We’ll continue to iterate, learn, and make improvements on a rolling basis to ensure our tech is effective in the face of new challenges.</p>
<p><b>We’re working hard to detect spammy behaviors at source</b>, such as the mass distribution of Tweets or attempts to manipulate trending topics. We also reduce the visibility of potentially spammy Tweets or accounts while we investigate whether a policy violation has occurred. When we do detect duplicative, or suspicious activity, we suspend accounts. We also frequently take action against applications that abuse the public API to<a href="https://support.twitter.com/articles/76915" target="_blank"> automate activity on Twitter</a>, stopping potentially manipulative bots at the source.</p>
<p>It’s worth noting that in order to respond to this challenge efficiently and <b>to ensure people cannot circumvent these safeguards</b>, we’re unable to share the details of these internal signals in our public API. While this means research conducted by third parties about the impact of bots on Twitter is often inaccurate and methodologically flawed, we must protect the future effectiveness of our work.</p></blockquote>
<p>It is possible that someone or some organization is simply purchasing botted accounts from shadowy sellers who peddle these sorts of things. If that&#8217;s the case, however, whoever built the botnet that retweeted my tweet 12,000 times certainly selected a diverse range of accounts.</p>
<p><a href="http://mith.umd.edu/people/person/ed-summers/" target="_blank">Ed Summers</a>, a software developer at the <strong>Maryland Institute for Technology in the Humanities</strong>, graciously offered to grab some basic information about the more than 11,500 suspected new bot followers that were still following my account earlier this morning. An analysis of that data indicates that more than 75 percent of the accounts (8,836) were created before 2013 &#8212; with the largest group of accounts (3,366) created six years ago.</p>
<p>Summers has published the entire list of suspected bot accounts at <a href="https://github.com/edsu/botnet-retweets/blob/master/briankrebs.csv" target="_blank">his Github page</a>. He&#8217;s also published <a href="https://github.com/edsu/botnet-retweets/blob/master/benimmo.csv" target="_blank">a list </a>of the 20,000 or so suspected bot accounts that re-tweeted Nimmo&#8217;s fake death, and found <a href="https://github.com/edsu/botnet-retweets/blob/master/briankrebs_benimmo.csv" target="_blank">an overlap of at least 1,865 accounts</a> with the 11,500+ suspected bot accounts that targeted my account this week.</p>
<p>I mentioned earlier that most of these bot accounts should have been easy to detect as such: The vast majority of bot accounts that hit my account this week had very few followers: More than 2,700 have zero followers, and more than half of the accounts have fewer than five followers.</p>
<p>Finally, I&#8217;ve noticed that most of them appear to be artificially boosting the popularity of a broad variety of businesses and entertainers around the globe, often using tweets from multiple languages. When these bots are not intimidating or otherwise harassing reporters and researchers, they appear to be part of a business that can be hired to do promotional tweets.</p>
<div id="attachment_40483" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/efdbcbc6.rtsource.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/rtsource.png"> <img class="wp-image-39807 size-medium" src="media/5ff2f1fd.rtsource-580x227.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/rtsource-580x227.png" alt=" " width="580" height="300" /></a><p class="wp-caption-text">An analysis of the data by @ChiefKleck</p></div>
<p>Further reading:</p>
<p><a href="https://krebsonsecurity.com/2011/12/twitter-bots-drown-out-anti-kremlin-tweets/" target="_blank">Twitter Bots Drown Out Anti-Kremlin Tweets<br />
</a></p>
<p><a href="https://krebsonsecurity.com/2013/08/buying-battles-in-the-war-on-twitter-spam/" target="_blank">Buying Battles in the War on Twitter Spam</a></p>
<p><a href="http://dashboard.securingdemocracy.org/" target="_blank">SecuringDemocracy.org: Tracking Russian Influence Operations on Twitter</a></p>
<p>Update: 9:52 a.m. ET: Corrected spelling of name for managing editor of ProPublica.</p>


feed_id: https://krebsonsecurity.com/?p=40459
title: Beware of Hurricane Harvey Relief Scams
uri: Beware-of-Hurricane-Harvey-Relief-Scams
url: https://krebsonsecurity.com/2017/08/beware-of-hurricane-harvey-relief-scams/
content:
<p>U.S. federal agencies are warning citizens anxious to donate money for those victimized by Hurricane Harvey to be especially wary of scam artists. In years past we&#8217;ve seen shameless fraudsters stand up fake charities and other bogus relief efforts in a bid to capitalize on public concern over an ongoing disaster. Here are some tips to help ensure sure your aid dollars go directly to those most in need.</p>
<p><img class="aligncenter size-full wp-image-40460" src="media/2d13189f.charityscam.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/charityscam.png" alt="charityscam" width="467" height="328" />The <strong>Federal Trade Commission</strong> (FTC) issued an alert Monday urging consumers to be on the lookout for a potential surge in charity scams. The FTC advises those who wish to donate to stick to charities they know, and to be on the lookout for charities or relief Web sites that seem to have sprung up overnight in response to current events (such as houstonfloodrelief.net, registered on Aug. 28, 2017). Sometimes these sites are set up by well-meaning people with the best of intentions (however misguided), but it&#8217;s best not to take a chance.</p>
<p>The FTC also warns consumers not to assume that a charity message posted on social media is a legitimate, and urges folks to research the organization before donating by visiting charity evaluation sites such as <a href="http://www.charitynavigator.org/" target="_blank">Charity Navigator</a>, <a href="https://www.charitywatch.org/home" target="_blank">Charity Watch</a>, <a href="http://www.guidestar.org/" target="_blank">GuideStar</a>, or the <a href="http://give.org/" target="_blank">Better Business Bureau&#8217;s Wise Giving Alliance</a>. The agency also reminds people who wish to donate via text message to confirm the number with the source before you donate.</p>
<p>From the <strong>US Computer Emergency Readiness Team</strong> (US-CERT) comes a reminder that malware purveyors frequently use natural disasters and other breaking news items of broad interest to trick people into clicking on malicious links or opening booby-trapped email attachments.</p>
<p>If anyone spots additional recently-registered Harvey-themed relief domains, please drop a note in the comments below.</p>
<p><strong>Update, 11:42 p.m. ET:</strong> A reader pointed out a newly-registered domain &#8212; harveyfloodrelief[dot]org &#8212; that is currently requesting PayPal donations on behalf of Harvey victims.</p>


feed_id: https://krebsonsecurity.com/?p=40428
title: Tech Firms Team Up to Take Down ‘WireX’ Android DDoS Botnet
uri: Tech-Firms-Team-Up-to-Take-Down-WireX-Android-DDoS-Botnet
url: https://krebsonsecurity.com/2017/08/tech-firms-team-up-to-take-down-wirex-android-ddos-botnet/
content:
<p>A half dozen technology and security companies &#8212; some of them competitors &#8212; issued the exact same press release today. This unusual level of cross-industry collaboration caps a successful effort to dismantle &#8216;<strong>WireX</strong>,&#8217; an extraordinary new crime machine comprising tens of thousands of hacked <strong>Android</strong> mobile devices that was used this month to launch a series of massive cyber attacks.</p>
<p>Experts involved in the takedown warn that WireX marks the emergence of a new class of attack tools that are more challenging to defend against and thus require broader industry cooperation to defeat.</p>
<div id="attachment_40436" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40436" src="media/a68477a9.wirexvolume-580x256.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/wirexvolume-580x256.png" alt="This graphic shows the rapid growth of the WireX botnet in the first three weeks of August 2017." width="580" height="256" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/08/wirexvolume-580x256.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/08/wirexvolume-768x339.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/08/wirexvolume.png 886w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">This graphic shows the rapid growth of the WireX botnet in the first three weeks of August 2017.</p></div>
<p>News of WireX&#8217;s emergence first surfaced August 2, 2017, when a modest collection of hacked Android devices was first spotted conducting some fairly small online attacks. Less than two weeks later, however, the number of infected Android devices enslaved by WireX had ballooned to the tens of thousands.</p>
<p>More worrisome was that those in control of the botnet were now wielding it to take down several large websites in the hospitality industry &#8212; pelting the targeted sites with so much junk traffic that the sites were no longer able to accommodate legitimate visitors.</p>
<p>Experts tracking the attacks soon zeroed in on the malware that powers WireX: Approximately 300 different mobile apps scattered across <strong>Google</strong>&#8216;s <a href="https://play.google.com/store?hl=en" target="_blank">Play store</a> that were mimicking seemingly innocuous programs, including video players, ringtones or simple tools such as file managers.</p>
<p>&#8220;We identified approximately 300 apps associated with the issue, blocked them from the Play Store, and we’re in the process of removing them from all affected devices,&#8221; Google said in a written statement. &#8220;The researchers’ findings, combined with our own analysis, have enabled us to better protect Android users, everywhere.&#8221;</p>
<p>Perhaps to avoid raising suspicion, the tainted Play store applications all performed their basic stated functions. But those apps also bundled a small program that would launch quietly in the background and cause the infected mobile device to surreptitiously connect to an Internet server used by the malware&#8217;s creators to control the entire network of hacked devices. From there, the infected mobile device would await commands from the control server regarding which Websites to attack and how.</p>
<div id="attachment_40437" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40437" src="media/edaf0713.wirexapps-580x344.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/wirexapps-580x344.png" alt="A sampling of the apps from Google's Play store that were tainted with the WireX malware." width="580" height="344" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/08/wirexapps-580x344.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/08/wirexapps.png 722w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A sampling of the apps from Google&#8217;s Play store that were tainted with the WireX malware.</p></div>
<p>Experts involved in the takedown say it&#8217;s not clear exactly how many Android devices may have been infected with WireX, in part because only a fraction of the overall infected systems were able to attack a target at any given time. Devices that were powered off would not attack, but those that were turned on with the device&#8217;s screen locked could still carry on attacks in the background, they found.</p>
<p>&#8220;I know in the cases where we pulled data out of our platform for the people being targeted we saw 130,000 to 160,000 (unique Internet addresses) involved in the attack,&#8221; said <strong>Chad Seaman</strong>, a senior engineer at <strong>Akamai</strong>, a company that specializes in helping firms weather large DDoS attacks (Akamai protected KrebsOnSecurity from hundreds of attacks prior to the large Mirai assault last year).</p>
<p>The identical press release that Akamai and other firms involved in the WireX takedown agreed to publish says the botnet infected a minimum of 70,000 Android systems, but Seaman says that figure is conservative.</p>
<p>&#8220;Seventy thousand was a safe bet because this botnet makes it so that if you&#8217;re driving down the highway and your phone is busy attacking some website, there&#8217;s a chance your device could show up in the attack logs with three or four or even five different Internet addresses,&#8221; Seaman said in an interview with KrebsOnSecurity. &#8220;We saw attacks coming from infected devices in over 100 countries. It was coming from everywhere.&#8221;</p>
<h4>BUILDING ON MIRAI</h4>
<p>Security experts from Akamai and other companies that participated in the WireX takedown say the basis for their collaboration was forged in the monstrous and unprecedented distributed denial-of-service (DDoS) attacks launched last year by <a href="https://krebsonsecurity.com/?s=mirai&amp;x=0&amp;y=0" target="_blank">Mirai</a>, a malware strain that seeks out poorly-secured &#8220;Internet of things&#8221; (IoT) devices such as security cameras, digital video recorders and Internet routers.</p>
<p>The first and largest of the Mirai botnets was used in a giant attack last September that <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank">knocked this Web site offline for several days</a>. Just a few days after that &#8212; when the source code that powers Mirai was <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank">published online</a> for all the world to see and use &#8212; dozens of copycat Mirai botnets emerged. Several of those botnets were used to conduct massive DDoS attacks against a variety of targets, leading to widespread Internet outages for many top Internet destinations.</p>
<p><strong>Allison Nixon</strong>, director of security research at New York City-based security firm <a href="https://www.flashpoint-intel.com" target="_blank">Flashpoint</a>, said the Mirai attacks were a wake-up call for the security industry and a rallying cry for more collaboration.</p>
<p>&#8220;When those really large Mirai DDoS botnets started showing up and taking down massive pieces of Internet infrastructure, that caused massive interruptions in service for people that normally don&#8217;t deal with DDoS attacks,&#8221; Nixon said. &#8220;It sparked a lot of collaboration. Different players in the industry started to take notice, and <span class="pullquote pqleft">a bunch of us realized that we needed to deal with this thing because if we didn&#8217;t it would just keep getting bigger and rampaging around</span>.&#8221;</p>
<p>Mirai was notable not only for the unprecedented size of the attacks it could launch but also for its ability to spread rapidly to new machines. But for all its sheer firepower, Mirai is not a particularly sophisticated attack platform. Well, not in comparison to WireX, that is.</p>
<h4>CLICK-FRAUD ORIGINS</h4>
<p>According to the group&#8217;s research, the WireX botnet likely began its existence as a distributed method for conducting &#8220;<a href="https://en.wikipedia.org/wiki/Click_fraud" target="_blank">click fraud</a>,&#8221; a pernicious form of online advertising fraud that will cost publishers and businesses an estimated $16 billion this year, according to <a href="https://www.cnbc.com/2017/03/15/businesses-could-lose-164-billion-to-online-advert-fraud-in-2017.html" target="_blank">recent estimates</a>. Multiple antivirus tools currently detect the WireX malware as a known click fraud malware variant.</p>
<p>The researchers believe that at some point the click-fraud botnet was repurposed to conduct DDoS attacks. While DDoS botnets powered by Android devices are extremely unusual (if not unprecedented at this scale), it is the botnet&#8217;s ability to generate what appears to be regular Internet traffic from mobile browsers that strikes fear in the heart of experts who specialize in defending companies from large-scale DDoS attacks.<span id="more-40428"></span></p>
<p>DDoS defenders often rely on developing custom &#8220;filters&#8221; or &#8220;signatures&#8221; that can help them separate DDoS attack traffic from legitimate Web browser traffic destined for a targeted site. But experts say WireX has the capability to make that process much harder.</p>
<p>That&#8217;s because WireX includes its own so-called &#8220;headless&#8221; Web browser that can do everything a real, user-driven browser can do, except without actually displaying the browser to the user of the infected system.</p>
<p>Also, Wirex can encrypt the attack traffic using SSL &#8212; the same technology that typically protects the security of a browser session when an Android user visits a Web site which requires the submission of sensitive data. This adds a layer of obfuscation to the attack traffic, because the defender needs to decrypt incoming data packets before being able to tell whether the traffic inside matches a malicious attack traffic signature.</p>
<p>Translation: It can be far more difficult and time-consuming than usual for defenders to tell WireX traffic apart from clicks generated by legitimate Internet users trying to browse to a targeted site.</p>
<p>&#8220;These are pretty miserable and painful attacks to mitigate, and it was these kinds of advanced functionalities that made this threat stick out like a sore thumb,&#8221; Akamai&#8217;s Seaman said.</p>
<h4>NOWHERE TO HIDE</h4>
<p>Traditionally, many companies that found themselves on the receiving end of a large DDoS attack sought to conceal this fact from the public &#8212; perhaps out of fear that customers or users might conclude the attack succeeded because of some security failure on the part of the victim.</p>
<p>But the stigma associated with being hit with a large DDoS is starting to fade, Flashpoint&#8217;s Nixon said, if for no other reason than it is becoming far more difficult for victims to conceal such attacks from public knowledge.</p>
<p>&#8220;Many companies, including Flashpoint, have built out different capabilities in order to see when a third party is being DDoS&#8217;d,&#8221; Nixon said. &#8220;Even though I work at a company that doesn&#8217;t do DDoS mitigation, we can still get visibility when a third-party is getting attacked. Also, network operators and ISPs have a strong interest in not having their networks abused for DDoS, and many of them have built capabilities to know when their networks are passing DDoS traffic.&#8221;</p>
<p>Just as multiple nation states now employ a variety of techniques and technologies to keep tabs on nation states that might conduct underground tests of highly destructive nuclear weapons, a great deal more organizations are now actively looking for signs of large-scale DDoS attacks, Seaman added.</p>
<p>&#8220;The people operating those satellites and seismograph sensors to detect nuclear [detonations] can tell you how big it was and maybe what kind of bomb it was, but they probably won&#8217;t be able to tell you right away who launched it,&#8221; he said. &#8220;It&#8217;s only when we take many of these reports together in the aggregate that we can get a much better sense of what&#8217;s really going on. It&#8217;s a good example of none of us being as smart as all of us.&#8221;</p>
<p>According to the WireX industry consortium, the smartest step that organizations can take when under a DDoS attack is to talk to their security vendor(s) and make it clear that they are open to sharing detailed metrics related to the attack.</p>
<p>&#8220;With this information, those of us who are empowered to dismantle these schemes can learn much more about them than would otherwise be possible,&#8221; the report notes. &#8220;There is no shame in asking for help. Not only is there no shame, but in most cases it is impossible to hide the fact that you are under a DDoS attack. A number of research efforts have the ability to detect the existence of DDoS attacks happening globally against third parties no matter how much those parties want to keep the issue quiet. There are few benefits to being secretive and numerous benefits to being forthcoming.&#8221;</p>
<p>Identical copies of the WireX report and Appendix are available at the following links:</p>
<p><a href="https://www.flashpoint-intel.com/blog/wirex-botnet-industry-collaboration/" target="_blank">Flashpoint</a></p>
<p><a href="https://blogs.akamai.com/2017/08/the-wirex-botnet-an-example-of-cross-organizational-cooperation.html" target="_blank">Akamai</a></p>
<p><a href="https://blog.cloudflare.com/the-wirex-botnet/" target="_blank">Cloudflare</a></p>
<p><a href="https://www.riskiq.com/blog/labs/wirex-botnet" target="_blank">RiskIQ</a></p>


feed_id: https://krebsonsecurity.com/?p=40368
title: Is Your Mobile Carrier Your Weakest Link?
uri: Is-Your-Mobile-Carrier-Your-Weakest-Link
url: https://krebsonsecurity.com/2017/08/is-your-mobile-carrier-your-weakest-link/
content:
<p>More online services than ever now offer two-step authentication &#8212; requiring customers to complete a login using their phone or other mobile device after supplying a username and password. But with so many services relying on your mobile for that second factor, there has never been more riding on the security of your mobile account. Below are some tips to ensure your mobile device (or, more specifically, your mobile carrier) isn&#8217;t the weakest link in your security chain.</p>
<p>For reasons explored more in <a href="https://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank">The Value of a Hacked Email Account</a>, many people become so preoccupied with securing online access to their financial accounts that they overlook or forget the fact that all of those precautions may be moot if hackers can access your email inbox. From that 2013 piece:</p>
<p>&#8220;Sign up with any service online, and it will almost certainly require you to supply an email address. In nearly all cases, the person who is in control of that address can reset the password of any associated services or accounts –merely by requesting a password reset email.&#8221;</p>
<p><img class="aligncenter size-medium wp-image-40415" src="media/06d4cf91.phonefraudsmaller-580x292.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller-580x292.png" alt="phonefraudsmaller" width="580" height="292" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller-580x292.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png 609w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>Many webmail providers now encourage users to take advantage of two-step (a.k.a. &#8220;two factor&#8221;) authentication methods in addition to passwords for securing access to email. This usually involves the user adding a mobile phone number to their account that gets sent a one-time code that needs to be entered after supplying the account password. The idea here is that even if thieves somehow manage to phish or otherwise glean your account password, they still need access to your phone to discover the one-time code.</p>
<p>Depending on how you&#8217;ve set up two-step authentication, however, this may be far from airtight security. What&#8217;s more, not all two-step authentication methods are equally secure. Probably the most common form of secondary authentication &#8212; a one-time code sent to your mobile device via SMS/text message &#8212; is also the least secure.<span id="more-40368"></span></p>
<p>That&#8217;s because thieves who manage to phish or otherwise filch your password can then simply ring your mobile provider pretending to be you, claiming that your phone is lost and that you need to activate a new phone and corresponding new SIM card. Or, they convince a gullible or inexperienced customer support rep to temporarily forward all of your calls and texts to a different number (this happened to me in 2013).</p>
<p>A <a href="https://www.nytimes.com/2017/08/21/business/dealbook/phone-hack-bitcoin-virtual-currency.html" target="_blank">harrowing story</a> in <em>The New York Times</em> last week showcased several such hacks against Bitcoin enthusiasts, but in truth these types of social engineering attacks have been going on for years.</p>
<p>True, not everyone will attract the kind of interest from cybercrooks as someone holding large amounts of a non-repudiable virtual currency. But it&#8217;s still a good idea to take a few minutes and check whether some of the services you use that offer two-step authentication might offer an app-based method &#8212; such as <a href="https://support.google.com/accounts/answer/1066447?hl=en" target="_blank">Google Authenticator</a> or <a href="https://authy.com/" target="_blank">Authy</a> &#8212; as opposed to a text-based method.</p>
<p>By the way, I&#8217;m not the only one bugging people to move away from texting for codes: The <strong>National Institute of Standards and Technology </strong>(NIST) recently issued <a href="https://pages.nist.gov/800-63-3/" target="_blank">new proposed digital authentication guidelines</a> urging organizations to favor other forms of two-factor — such as time-base one-time passwords generated by mobile apps — over text messaging.</p>
<p>Fortunately, some of the more popular online services offer multiple options for two-step authentication, although many of those that offer alternatives to texting one-time codes still steer users toward this option. I took stock of my own exposure to text-based two-step authentication and found three services I rely upon daily for my work still had the SMS option selected when a more secure app-based option was available.</p>
<p>Take a moment to review the authentication options available for the services you use on a regular basis. To do this, head on over to <a href="https://www.twofactorauth.org" target="_blank">twofactorauth.org</a>. A simple search for &#8220;Facebook,&#8221; for example, shows that the social networking site offers secondary authentication options via SMS, hardware token (such as a physical USB <a href="https://www.yubico.com/solutions/fido-u2f/" target="_blank">security key</a>) and software token (Google Authenticator, e.g.).</p>
<p>In the case of Facebook, if you previously received one-time tokens via SMS, you may have to temporarily disable two-step authentication via text message before enabling the security key and software token approaches.</p>
<div id="attachment_40417" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40417" src="media/a3c47d64.2fauth-580x409.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/2fauth-580x409.png" alt="Lots of companies now offer multiple options for two-step authentication that go beyond SMS. Image: twofactorauth.org" width="580" height="409" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/08/2fauth-580x409.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/08/2fauth-768x542.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/08/2fauth-940x663.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/08/2fauth.png 1072w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Lots of companies now offer multiple options for two-step authentication that go beyond SMS. Image: twofactorauth.org</p></div>
<p>Also, some people (present company included) need extra security and may be willing to put up with additional minor inconveniences in exchange for added peace of mind that thieves aren&#8217;t going to just waltz in and steal everything. This is particularly true for people with serious assets tied up in online sites and services that may not offer more robust authentication options.</p>
<p><a href="https://techcrunch.com/2017/08/23/i-was-hacked/?ncid=rss" target="_blank">This piece</a> over at <em>Techcrunch</em> last week tells the story of another Bitcoin enthusiast who took some pretty extreme measures after someone tricked his mobile provider into switching his account to a new phone. Like requesting that the provider lock your phone&#8217;s SIM card to your device and prevent the phone from being used with another SIM card (the downside of this is if you really do lose your phone it could be much more complicated with this option turned on).</p>
<p>The story also recommends calling your telecommunications provider and asking them to set a passcode or PIN on your account that needs to be supplied before a customer service representative will discuss the account details.</p>
<p>&#8220;Make sure it applies to ALL account changes,&#8221; the Techcrunch pieces advises. &#8220;Make sure it applies to all numbers on the account. Ask them what happens if you forget the passcode. Ask them what happens if you lose that too.&#8221;</p>
<p>I should note that just because SMS is less secure than other forms of two-step authentication, that should not disqualify it as a worthwhile security step when more secure alternatives are unavailable. Any form of two-factor authentication is better than relying solely on usernames and passwords.</p>
<p>Some online services allow people to receive one-time codes via an automated phonecall. I hope it goes without saying this, but this method also is vulnerable to an attacker tricking a customer support person at your mobile provider into doing something they shouldn&#8217;t. Read the penultimate update to <a href="https://blog.cloudflare.com/post-mortem-todays-attack-apparent-google-app/" target="_blank">this 2012 blog post</a> about how the CEO of <strong>Cloudflare</strong> had his account hacked after someone social engineered an <strong>AT&amp;T</strong> representative into forwarding his second factor by automated phone call to a number the attackers controlled.</p>
<p>Finally, be judicious about what you install on your mobile device, and spend a few minutes researching the reputation and longevity of any app you wish to install before you install it. Also, pay close attention the permissions being requested by apps that you install: A mobile device compromised by mobile malware may not be the most reliable or secure second factor.</p>


feed_id: https://krebsonsecurity.com/?p=40370
title: Why It’s Still A Bad Idea to Post or Trash Your Airline Boarding Pass
uri: Why-It-s-Still-A-Bad-Idea-to-Post-or-Trash-Your-Airline-Boarding-Pas
url:
https://krebsonsecurity.com/2017/08/why-its-still-a-bad-idea-to-post-or-trash-your-airline-boarding-pass/

content:
<p>An October 2015 piece published here about the potential dangers of tossing out or posting online your airline boarding pass remains one of the most-read stories on this site. One reason may be that the advice remains timely and relevant: A talk recently given at a Czech security conference advances that research and offers several reminders of how being careless with your boarding pass could jeopardize your privacy or even cause trip disruptions down the road.</p>
<p>In <a href="https://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass-barcode-a-lot/" target="_blank">What&#8217;s In a Boarding Pass Barcode? A Lot</a>, KrebsOnSecurity told the story of a reader whose friend posted a picture of a boarding pass on Facebook. The reader was able to use the airline&#8217;s Web site combined with data printed on the boarding pass to discover additional information about his friend. That data included details of future travel, the ability to alter or cancel upcoming flights, and a key component need to access the traveler&#8217;s frequent flyer account.</p>
<div id="attachment_40375" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40375" src="media/d8a4a571.instaboarding-580x548.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/instaboarding-580x548.png" alt="A search on Instagram for &quot;boarding pass&quot; returned 91,000+ results." width="580" height="548" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/08/instaboarding-580x548.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/08/instaboarding-768x725.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/08/instaboarding-940x887.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/08/instaboarding.png 948w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A search on Instagram for &#8220;boarding pass&#8221; returned 91,000+ results.</p></div>
<p>More recently, security researcher <a href="https://www.michalspacek.com/" data-ss1503589564="1">Michal Špaček</a> gave a talk at a conference in the Czech Republic in which he explained how a few details gleaned from a picture of a friend&#8217;s boarding pass posted online give him the ability to view passport information on his friend via the airline&#8217;s Web site, and to change the password for another friend&#8217;s <strong>United Airlines</strong> frequent flyer account.</p>
<p>Working from a <strong>British Airways</strong> boarding pass that a friend posted to <strong>Instagram</strong>, Špaček found he could log in to the airline&#8217;s passenger reservations page using the six-digit <strong>booking code</strong> (a.k.a. <strong>PNR</strong> or <strong>p</strong>assenger <strong>n</strong>ame <strong>r</strong>ecord) and the last name of the passenger (both are displayed on the front of the BA boarding pass).</p>
<p>Once inside his friend&#8217;s account, Špaček saw he could cancel future flights, and view or edit his friend&#8217;s passport number, citizenship, expiration date and date of birth. In my 2015 story, I showed how this exact technique permitted access to the same information on <strong>Lufthansa</strong> customers (this still appears to be the case).</p>
<p>Špaček also reminds readers about the dangers of posting boarding pass barcodes or <a href="https://en.wikipedia.org/wiki/QR_code" target="_blank">QR codes</a> online, noting there are several barcode scanning apps and Web sites that can extract text data stored in bar codes and QR codes. Boarding pass bar codes and QR codes usually contain all of the data shown on the front of a boarding pass, and some boarding pass barcodes actually conceal even <em>more</em> personal information than what&#8217;s printed on the boarding pass.</p>
<p>As I noted back in 2015, <strong>United Airlines</strong> treats its customers’ frequent flyer numbers as secret access codes. For example, if you’re looking for your <strong>United Mileage Plus</strong> number, and you don’t have the original document or member card they mailed to you, good luck finding this information in your email correspondence with the company.</p>
<p>When United does include this code in correspondence, all but the last three characters are replaced with asterisks. The same is true with United’s boarding passes. However, the customer&#8217;s full Mileage Plus number is available if you take the time to decode the barcode on any United boarding pass.</p>
<p>Until very recently, if you knew the Mileage Plus number and last name of a United customer, you would have been able to reset their frequent flyer account password simply by guessing <a href="https://krebsonsecurity.com/2016/08/united-airlines-sets-minimum-bar-on-security/" target="_blank">the multiple-choice answer to two secret questions</a> about the customer. However, United has since added a third step &#8212; requiring the customer to click a link in an email that gets generated when someone successfully guesses the multiple-choice answers to the two secret questions.<span id="more-40370"></span></p>
<p>It&#8217;s crazy how many people post pictures of their boarding pass on various social networking sites, often before and/or during their existing trip. A search on <strong>Instagram</strong> for <a href="https://www.instagram.com/explore/tags/boardingpass/" target="_blank">the term &#8220;boarding pass&#8221;</a>, for example, returned more than 91,000 such images. Not all of those images include the full barcode or boarding record locator, but plenty enough do and that&#8217;s just one social network.</p>
<p>For anyone interested in how much of today&#8217;s airline industry still relies on security by obscurity, check out <a href="https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carmen_sandiego#webm" target="_blank">this excellent talk</a> from last year&#8217;s <strong>Chaos Communication Congress</strong> (CCC) in Berlin by security researchers <strong>Karsten Nohl</strong> and <strong>Nemanja Nikodijevic</strong>. <span class="pullquote pqleft">Nohl notes that the six digit booking code or PNR is essentially a temporary password issued by airlines that is then summarily printed on all luggage tags and inside all boarding pass barcodes.</span></p>
<p>&#8220;You would imagine that if they treat it as a password equivalent then they would keep it secret like a password,&#8221; Nohl said. &#8220;Only, they don&#8217;t, but rather print it on everything you get from the airline. For instance, on every piece of luggage you have your last name and the six-digit (PNR) code.&#8221;</p>
<p>In his talk, Nohl showed how these PNRs are used in code-sharing agreements between and among airlines, meaning that gaining access to someone else&#8217;s frequent flyer account may reveal information associated with that customer&#8217;s accounts at other airlines.</p>
<p>Nohl and his co-presenter also demonstrated how some third-party travel sites do little to prevent automated programs from rapidly submitting the same last name and changing the PNR, essentially letting an attacker <a href="http://searchsecurity.techtarget.com/definition/brute-force-cracking" target="_blank">brute-force</a> a targeted customer&#8217;s PNR.</p>
<p>My advice: Avoid the temptation to brag online about that upcoming trip or vacation. Thieves looking to rob someone in your area will be delighted to see this kind of information posted online.</p>
<p>Don&#8217;t post online pictures of your boarding pass or anything else with a barcode in it (e.g., there are currently <a href="https://www.instagram.com/explore/tags/concerttickets/" target="_blank">42,000 search results</a> on Instagram for &#8220;concert tickets&#8221;).</p>
<p>Finally, avoid leaving your boarding pass in the trash at the airport or tucked into that seat-back pocket in front of you before deplaning. Instead, bring it home and shred it. Better still, don&#8217;t get a paper boarding pass at all (use a mobile).</p>


feed_id: https://krebsonsecurity.com/?p=40346
title: Dumping Data from Deep-Insert Skimmers
uri: Dumping-Data-from-Deep-Insert-Skimmers
url: https://krebsonsecurity.com/2017/08/dumping-data-from-deep-insert-skimmers/
content:
<p>I recently heard from a police detective who was seeking help identifying some strange devices found on two Romanian men caught maxing out stolen credit cards at local retailers. Further inspection revealed the devices to be semi-flexible data transfer wands that thieves can use to extract stolen ATM card data from &#8220;<a href="https://krebsonsecurity.com/2016/05/crooks-go-deep-with-deep-insert-skimmers/" target="_blank">deep-insert skimmers</a>,&#8221; wafer-thin fraud devices made to be hidden inside of the card acceptance slot on a cash machine.</p>
<p>The investigator agreed to share the photos if I kept his identity out of this story. He told KrebsOnSecurity that the two men were thought to be part of a crime gang active in the northeast United States, and that the almost 4-inch orange plastic wands allow thieves to download data from a deep insert skimmer. Depending on how the deep-insert skimmer is built, thieves may be able to use the wands to retrieve card data without having to remove the skimmer from the throat of the ATM.</p>
<p>Deep insert skimmers are different from <a href="https://krebsonsecurity.com/2016/06/atm-insert-skimmers-in-action/" target="_blank">typical insert skimmers</a> in that they are placed in various positions within the card reader transport, behind the shutter of a motorized card reader and completely hidden from the consumer at the front of the ATM.</p>
<p>Here&#8217;s a look at these insert skimmer wands (for want of a better term):</p>
<div id="attachment_40350" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40350" src="media/b8c079fb.insertskimcord-580x452.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/insertskimcord-580x452.png" alt="These plastic wands allow thieves to extract stolen card data stored by insert skimmers. " width="580" height="452" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/08/insertskimcord-580x452.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/08/insertskimcord-768x599.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/08/insertskimcord-940x733.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/08/insertskimcord.png 1261w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">These plastic wands allow thieves to extract stolen card data stored by insert skimmers.</p></div>
<p>This is what the wand (left) looks like when inserted into a deep-insert skimmer (right):</p>
<div id="attachment_40351" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40351" src="media/43e7f2e3.insertskimpluggedin-580x238.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/insertskimpluggedin-580x238.png" alt="A data transfer wand inserted into a deep-insert skimmer." width="580" height="238" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/08/insertskimpluggedin-580x238.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/08/insertskimpluggedin-768x316.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/08/insertskimpluggedin-940x386.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/08/insertskimpluggedin.png 1521w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A data transfer wand inserted into a deep-insert skimmer.</p></div>
<p><span id="more-40346"></span>The following image shows three data transfer wands and three insert skimmers seized from compromised ATMs:</p>
<div id="attachment_40352" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40352" src="media/7cbe7ce5.insertskim-withcord-580x471.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/08/insertskim-withcord-580x471.png" alt="Insert skimmers (top) and data transfer wands." width="580" height="471" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/08/insertskim-withcord-580x471.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/08/insertskim-withcord-768x624.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/08/insertskim-withcord-940x764.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/08/insertskim-withcord.png 1021w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Insert skimmers (top) and data transfer wands.</p></div>
<p><strong>Charlie Harrow</strong>, solutions manager for ATM maker <strong>NCR Corp.</strong>, said he has not physically examined the devices pictured above, but that they appear to have a USB interface on one end (the end that plugs into whatever device the crooks use to download stolen card data from the deep-insert skimmer) and a <a href="https://www.google.com/search?q=low+profile+header&amp;tbm=isch&amp;imgil=Nnag6vp2oZfMfM%253A%253BG6Xily3WcB-l-M%253Bhttp%25253A%25252F%25252Fwww.fischerelektronik.de%25252Fen%25252Flatest-news%25252Fpress-releases%25252Freleases%25252Fdouble-row-precision-male-and-female-headers-low-profile%25252F&amp;source=iu&amp;pf=m&amp;fir=Nnag6vp2oZfMfM%253A%252CG6Xily3WcB-l-M%252C_&amp;usg=__Ht4HBdq_LjKNXOX_DQ85u_vJgj0%3D&amp;biw=1222&amp;bih=763&amp;dpr=1.25&amp;ved=0ahUKEwjntPCb9urVAhXK7IMKHS2ZAYAQyjcIZQ&amp;ei=bi6cWefFGMrZjwStsoaACA#imgrc=Nnag6vp2oZfMfM:" target="_blank">low profile header</a> on the other.</p>
<p>&#8220;USB connectors are too big generally to put on a skimmer, especially the newer deep insert skimmers,&#8221; Harrow said. &#8220;Those devices have very low profile connections such that the overall device thickness is kept to a minimum.&#8221;</p>
<p>Once you know about all the ways that skimmer thieves are coming up with to fleece banks and consumers, it’s difficult not to go through life seeing every ATM as potentially compromised. I&#8217;m constantly banging and pulling on the poor machines and half expecting half hoping parts to come unglued. I’m always disappointed, but it hasn’t stopped me all the same.</p>
<p>Truthfully, you probably have a better chance of getting physically mugged after withdrawing cash than you do encountering a skimmer in real life. So keep your wits about you when you’re at the ATM, and avoid dodgy-looking and standalone cash machines in low-lit areas, if possible. When possible, stick to ATMs that are physically installed at a bank. And be especially vigilant when withdrawing cash on the weekends; thieves tend to install skimming devices on Saturdays after business hours — when they know the bank won’t be open again for more than 24 hours.</p>
<p>Lastly but most importantly, covering the PIN pad with your hand defeats one key component of most skimmer scams: The spy camera that thieves typically hide somewhere on or near the compromised ATM to capture customers entering their PINs.</p>
<p>Shockingly, few people bother to take this simple, effective step, as detailed in <a href="http://krebsonsecurity.com/2012/09/a-handy-way-to-foil-atm-skimmer-scams/" target="_blank">this skimmer tale from 2012</a>, wherein I obtained hours worth of video seized from two ATM skimming operations and saw customer after customer walk up, insert their cards and punch in their digits — all in the clear.</p>
<p>For more on how these insert skimmers work, check out <a href="http://krebsonsecurity.com/2016/05/crooks-go-deep-with-deep-insert-skimmers/" target="_blank">Crooks Go Deep With ‘Deep Insert’ Skimmers</a>. If you’re here because, like me, you find skimmers of all kinds fascinating, please see my series <a href="http://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers</a>.</p>


feed_id: https://krebsonsecurity.com/?p=40658
title: Equifax Breach Response Turns Dumpster Fire
uri: Equifax-Breach-Response-Turns-Dumpster-Fire
url: https://krebsonsecurity.com/2017/09/equifax-breach-response-turns-dumpster-fire/
content:
<p>I cannot recall a previous data breach in which the breached company&#8217;s public outreach and response has been so haphazard and ill-conceived as the one coming right now from big-three credit bureau <strong>Equifax</strong>, which rather clumsily announced Thursday that an intrusion jeopardized Social security numbers and other information on 143 million Americans.</p>
<h4>WEB SITE WOES</h4>
<p>As noted in <a href="https://krebsonsecurity.com/2017/09/breach-at-equifax-may-impact-143m-americans/" target="_blank">yesterday&#8217;s breaking story</a> on this breach, the Web site that Equifax advertised as the place where concerned Americans could go to find out whether they were impacted by this breach &#8212; <a href="https://www.equifaxsecurity2017.com" target="_blank">equifaxsecurity2017.com</a> &#8212;<br />
is completely broken at best, and little more than a stalling tactic or sham at worst.</p>
<p>In the early hours after the breach announcement, the site was being flagged by various browsers as a phishing threat. In some cases, people visiting the site were told they were not affected, only to find they received a different answer when they checked the site with the same information on their mobile phones.</p>
<p><img src="media/a0705e97.phonelaptopequifax-580x477.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/phonelaptopequifax-580x477.png" alt="phonelaptopequifax" width="580" height="477" class="aligncenter size-medium wp-image-40673" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/09/phonelaptopequifax-580x477.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/09/phonelaptopequifax-768x632.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/09/phonelaptopequifax.png 811w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>Others (myself included) received not a yes or no answer to the question of whether we were impacted, but instead a message that credit monitoring services we were eligible for were not available and to check back later in the month. The site asked users to enter their last name and last six digits of their SSN, but at the prompting of a reader&#8217;s comment I confirmed that just entering gibberish names and numbers produced the same result as the one I saw when I entered my real information: Come back on Sept. 13.</p>
<p>Who&#8217;s responsible for this debacle? Well, Equifax of course. But most large companies that can afford to do so hire outside public relations or disaster response firms to walk them through the safest ways to notify affected consumers. In this case, Equifax appears to have hired global PR firm <strong>Edelman PR</strong>.</p>
<p>What gives me this idea? Until just a couple of hours ago, the copy of <strong>WordPress</strong> installed at equifaxsecurity2017.com included a publicly accessible user database entry showing a user named &#8220;Edelman&#8221; was the first (and only?) user registered on the site.</p>
<div id="attachment_40660" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/3cf6a2eb.equifax-edelman.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/equifax-edelman.png"> <img class="wp-image-39807 size-medium" src="media/9326ef2d.equifax-edelman-580x31.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/equifax-edelman-580x31.png" alt=" " width="580" height="31" /></a><p class="wp-caption-text">Code that was publicly available on equifaxsecurity2017.com until very recently showed account information for an outside PR firm.</p></div>
<p>I reached out to Edelman for more information and will update this story when I hear from them.</p>
<h4>EARLY WARNING?</h4>
<p>In its breach disclosure Thursday, Equifax said it hired an outside computer security forensic firm to investigate as soon as it discovered unauthorized access to its Web site. <strong>ZDNet</strong> published <a href="http://www.zdnet.com/article/security-firm-mandiant-said-to-be-helping-equifax-in-hack-aftermath/" target="_blank">a story</a> Thursday saying that the outside firm was Alexandria, Va.-based <strong>Mandiant</strong> &#8212; a security firm bought by <strong>FireEye</strong> in 2014.</p>
<p>Interestingly, anyone who happened to have been monitoring look-alike domains for Equifax.com prior to yesterday&#8217;s breach announcement may have had an early clue about the upcoming announcement. One interesting domain that was registered on Sept. 5, 2017 is &#8220;<strong>equihax.com</strong>,&#8221; which according to domain registration records was purchased by an Alexandria, Va. resident named <strong>Brandan Schondorfer</strong>.</p>
<p>A quick Google search shows that Schondorfer works for Mandiant. <a href="http://www.twitter.com/rayjwatson" target="_blank">Ray Watson</a>, a cybersecurity researcher who messaged me this morning on Twitter about this curiosity, said it is likely that Mandiant has been registering domains that might be attractive to phishers hoping to take advantage of public attention to the breach and spoof Equifax&#8217;s domain.</p>
<p>Watson said it&#8217;s equally likely the equihax.com domain was registered to keep it out of the hands of people who may be looking for domain names they can use to lampoon Equifax for its breach. Schondorfer has not yet returned calls seeking comment. </p>
<h4>EQUIFAX EXECS PULL GOLDEN PARACHUTES?</h4>
<p>Bloomberg <a href="https://www.bloomberg.com/news/articles/2017-09-07/three-equifax-executives-sold-stock-before-revealing-cyber-hack" target="_blank">moved a story</a> yesterday indicating that three top executives at Equifax sold millions of dollars worth of stock during the time between when the company says it discovered the breach and when it notified the public and investors.</p>
<p>Shares of Equifax&#8217;s stock on the New York Stock Exchange [<a href="https://www.google.com/finance?q=NYSE:EFX" target="_blank">NSYE:EFX</a>] were down more than 13 percent at time of publication versus yesterday&#8217;s price.</p>
<p>The executives reportedly told Bloomberg they didn&#8217;t know about the breach when they sold their shares. A law firm in New York has already <a href="http://www.prnewswire.com/news-releases/shareholder-alert---bronstein-gewirtz--grossman-llc-announces-investigation-of-equifax-inc-efx-300516058.html" target="_blank">announced</a> it is investigating potential insider trading claims against Equifax.<span id="more-40658"></span></p>
<h4>CLASS ACTION WAIVER?</h4>
<p>Yesterday&#8217;s story here pointed out the gross conflict of interest in Equifax&#8217;s consumer remedy for this breach: Offering a year&#8217;s worth of free credit monitoring services to all Americans via its own in-house credit monitoring service.</p>
<p>This is particularly rich because a) why should anyone trust Equifax to do anything right security-wise after this debacle and b) these credit monitoring services typically hard-sell consumers to sign up for paid credit protection plans when the free coverage expires.</p>
<div id="attachment_40661" style="width: 335px" class="wp-caption aligncenter"><img class="size-full wp-image-40661" src="media/5265ccdc.arbit-equifax.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/arbit-equifax.png" alt="Verbiage from the terms of service from Equifax's credit monitoring service TrustID Premier." width="325" height="374" /><p class="wp-caption-text">Verbiage from the terms of service from Equifax&#8217;s credit monitoring service TrustID Premier.</p></div>
<p>I have repeatedly urged readers to consider putting a security freeze on their accounts in lieu of or in addition to accepting these free credit monitoring offers, noting that credit monitoring services don&#8217;t protect you against identity theft (the most you can hope for is they alert you when ID thieves do steal your identity), while security freezes can prevent thieves from taking out new lines of credit in your name.</p>
<p>Several readers have written in to point out some legalese in the <a href="https://trustedidpremier.com/static/terms?utm_content=buffer3e866&#038;utm_medium=social&#038;utm_source=twitter.com&#038;utm_campaign=buffer" target="_blank">terms of service</a> the Equifax requires all users to acknowledge before signing up for the service seems to include legal verbiage suggesting that those who do sign up for the free service will waive their rights to participate in future class action lawsuits against the company.</p>
<p>KrebsOnSecurity is still awaiting word from an actual lawyer who&#8217;s looking at this contract, but let me offer my own two cents on this. </p>
<p><strong>Update, 9:45 p.m. ET:</strong> Equifax has updated their breach alert page to include the following response in regard to the unclear legalese: </p>
<p>&#8220;In response to consumer inquiries, we have made it clear that the arbitration clause and class action waiver included in the Equifax and TrustedID Premier terms of use does not apply to this cybersecurity incident.&#8221;</p>
<p><em>Original story:</em></p>
<p>Equifax will almost certainly see itself the target of multiple class action lawsuits as a result of this breach, but there is no guarantee those lawsuits will go the distance and result in a monetary windfall for affected consumers.</p>
<p>Even when these cases do result in a win for the plaintiff class, it can take years. After KrebsOnSecurity <a href="http://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/" target="_blank">broke the story in 2013</a> that Experian had given access to 200 million consumer records to Vietnamese man running an identity theft service, two different law firms <a href="https://krebsonsecurity.com/2015/07/experian-hit-with-class-action-over-id-theft-service/" target="_blank">filed class action suits against Experian</a>.</p>
<p>That case was ultimately tossed out of federal court and remanded to state court, where it is ongoing. That case was filed in 2015.</p>
<p>To close out the subject of civil lawsuits as a way to hold companies accountable for sloppy security, class actions &#8212; even when successful &#8212; rarely result in much of a financial benefit for affected consumers (very often the &#8220;reward&#8221; is a gift card or two-digit dollar amount per victim), while greatly enriching law firms that file the suits.</p>
<p>It&#8217;s my view that these class action lawsuits serve principally to take the pressure off of lawmakers and regulators to do something that might actually prevent more sloppy security practices in the future for the <del>victim</del> culpable companies. And as I noted in yesterday&#8217;s story, the credit bureaus have shown themselves time and again to be terribly unreliable stewards of sensitive consumer data: This time, the intruders were able to get in because Equifax apparently fell behind in patching its Internet-facing Web applications.</p>
<p>In May, KrebsOnSecurity reported that fraudsters <a href="https://krebsonsecurity.com/2017/05/fraudsters-exploited-lax-security-at-equifaxs-talx-payroll-division/" target="_blank">exploited lax security at Equifax’s TALX payroll division</a>, which provides online payroll, HR and tax services. In 2015, a breach at <strong>Experian</strong> jeopardized the personal data <a href="https://krebsonsecurity.com/2015/10/experian-breach-affects-15-million-consumers/" target="_blank">on at least 15 million consumers</a>.</p>
<h4>CAPITALIZING ON FEAR</h4>
<p>Speaking of Experian, the company is now taking advantage of public fear over the breach &#8212; <a href="https://twitter.com/rayjwatson/status/906156884394000385/photo/1" target="_blank">via hashtag #equifaxbreach, for example</a> &#8212; to sign people up for their cleverly-named &#8220;CreditLock&#8221; subscription service (again, hat tip to @rayjwatson).</p>
<p>&#8220;When you have Experian Identity Theft Protection, you can instantly lock or unlock your Experian Credit File with the simple click of a button,&#8221; the ad enthuses. &#8220;Experian gives you instant access to your credit report.&#8221;</p>
<p>First off, all consumers have the legal right to instant access to their credit report via the Web site, annualcreditreport.com. This site, mandated by Congress, gives consumers the right to one free credit report from each of the three major bureaus (Equifax, Trans Union and Experian) every year.</p>
<p>Second, all consumers have a right to request that the bureaus &#8220;freeze&#8221; their credit files, which bars potential creditors or anyone else from viewing your credit history or credit file unless you thaw the freeze (temporarily or permanently).</p>
<p>I have made no secret of my disdain for the practice of companies offering credit monitoring in the wake of a data breach — especially in cases where the breach only involves credit card accounts, since credit monitoring services typically only look for new account fraud and do little or nothing to prevent fraud on existing consumer credit accounts.</p>
<p>Credit monitoring services rarely prevent identity thieves from stealing your identity. The most you can hope for from these services is that they will alert you as soon as someone does steal your identity. Also, the services can be useful in helping victims recover from ID theft.</p>
<p>My advice: Sign up for credit monitoring if you can (and you&#8217;re not holding out for a puny class action windfall) and then freeze your credit files at the major credit bureaus (it is generally not possible to sign up for credit monitoring services after a freeze is in place). Again, advice for how to file a freeze is <a href="https://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">available here</a>.</p>
<p>Whether you are considering a freeze, credit monitoring, or a fraud alert (another, far less restrictive third option), please take a moment to read <a href="https://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">this story</a> in its entirety. It includes a great deal of information that cannot be shared in a short column here.</p>


feed_id: https://krebsonsecurity.com/?p=41002
title: Fear Not: You, Too, Are a Cybercrime Victim!
uri: Fear-Not-You-Too-Are-a-Cybercrime-Victim
url: https://krebsonsecurity.com/2017/10/fear-not-you-too-are-a-cybercrime-victim/
content:
<p>Maybe you&#8217;ve been feeling left out because you weren&#8217;t among the lucky few hundred million or billion who had their personal information stolen in either the <strong>Equifax</strong> or <strong>Yahoo!</strong> breaches. Well buck up, camper: Both companies took steps to make you feel better today.</p>
<p>Yahoo! announced that, our bad!: It wasn&#8217;t just <a href="https://krebsonsecurity.com/2016/12/yahoo-one-billion-more-accounts-hacked/" target="_blank">one billion users</a> who had their account information filched in its record-breaking 2013 data breach. It was <a href="https://www.nytimes.com/2017/10/03/technology/yahoo-hack-3-billion-users.html?_r=0" target="_blank">more like three billion (read: all)</a> users. Meanwhile, big three credit bureau Equifax <a href="http://www.chicagotribune.com/business/ct-biz-equifax-2-5-million-more-americans-story.html" target="_blank">added 2.5 million more victims</a> to its roster of 143 million Americans who had their Social Security numbers and other personal data filched in a breach earlier this year. At the same time, Equifax&#8217;s erstwhile CEO informed Congress that the breach was the result of even more bone-headed security than was first disclosed.</p>
<p>To those still feeling left out by either company after this spate of bad news, I have only one thing to say (although I feel a bit like a broken record in repeating this): Assume you&#8217;re compromised, and take steps accordingly.</p>
<div align="center"><iframe src="http://www.youtube.com/embed/4pgg2LCY8iE" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>If readers are detecting a bit of sarcasm and cynicism in my tone here, it may be that I&#8217;m still wishing I&#8217;d done almost anything else today besides watching three hours worth of testimony from former Equifax CEO <strong>Richard Smith</strong> before lawmakers on a panel of the <strong>House Energy &amp; Commerce Committee</strong>.</p>
<p>While he is no longer the boss of Equifax, Smith gamely agreed to submit to several day&#8217;s worth of grilling from legislators in both houses of Congress this week. It was clear from the questions that lawmakers didn&#8217;t ask in Round One, however, that Smith was far more prepared for the first batch of questioning than they were, and that the entire ordeal would amount to only a gentle braising.</p>
<p>Nevertheless, Smith managed to paint a even more dismal picture than was already known about the company&#8217;s efforts to secure the very data that makes up the core of its business. Helpfully, Smith clarified early on in the hearing that the company&#8217;s customers are in fact banks and other businesses &#8212; not consumers.</p>
<p>Smith told lawmakers that the breach stemmed from a combination of technological error and a human error, casting the breach as the kind of failure that could have happened to anyone. In reality, the company waited 4.5 months (until after it discovered the breach in late July 2017) to fix a dangerous security flaw that it should have known was being exploited on Day One (~March 6 or 7, 2017).</p>
<p>&#8220;The human error involved the failure to apply a software patch to a dispute portal in March 2017,&#8221; Smith said. He declined to explain (and lawmakers inexplicably failed to ask) how 145.5 million Americans &#8212; nearly 60 percent of the adult population of the United States &#8212; could have had their information tied up in a dispute portal at Equifax. &#8220;The technological error involved a scanner which failed to detect a vulnerability on that particular portal.&#8221;</p>
<p>As noted in <a href="https://www.wired.com/story/equifax-ceo-congress-testimony/" target="_blank">this Wired.com story</a>, Smith admitted that the data which was compromised in the breach was not encrypted:</p>
<blockquote>
<p data-reactid="274">When asked by representative Adam Kinzinger of Illinois about what data Equifax encrypts in its systems, Smith admitted that the data compromised in the customer-dispute portal was stored in plaintext and would have been easily readable by attackers. &#8220;We use many techniques to protect data—encryption, tokenization, masking, encryption in motion, encrypting at rest,&#8221; Smith said. &#8220;To be very specific, this data was not encrypted at rest.&#8221;</p>
<p data-reactid="277">It’s unclear exactly what of the pilfered data resided in the portal versus other parts of Equifax’s system, but it turns out that also didn’t matter much, given Equifax&#8217;s attitude toward encryption overall. “OK, so this wasn’t [encrypted], but your core is?” Kinzinger asked. “Some, not all,&#8221; Smith replied. &#8220;There are varying levels of security techniques that the team deploys in different environments around the business.&#8221;</p>
</blockquote>
<p>Smith also sought to justify the company&#8217;s historically poor breach response after it publicly disclosed the breach on Sept. 7 &#8212; roughly 40 days after it says Equifax&#8217;s security team first became aware of the incident (on July 29). As many readers here are well familiar, KrebsOnSecurity <a href="https://krebsonsecurity.com/2017/09/equifax-breach-response-turns-dumpster-fire/" target="_blank">likened that breach response to a dumpster fire</a> &#8212; noting that it was perhaps the most haphazard and ill-conceived of any major data breach disclosure in history.</p>
<p>Smith artfully dodged questions of why the company waited so long to notify the public, and about the perception that Equifax sought to profit off of its own data breach. One lawmaker noted that Smith gave two public speeches in the second and third weeks of August in which <a href="http://www.wsbtv.com/news/local/atlanta/equifax-ceo-weeks-before-disclosing-breach-the-days-are-bright-for-equifax/614695087" target="_blank">he was quoted as saying</a> that fraud was a &#8220;a huge opportunity for Equifax,&#8221; and that it was a &#8220;massive, growing business&#8221; for the company.</p>
<p>Smith interjected that he had &#8220;no indication&#8221; that consumer data was compromised at the time of the Aug. 11 speech. As for the Aug. 17 address, he said &#8220;we did not know how much data was compromised, what data was compromised.&#8221;</p>
<p>Follow-up questions from lawmakers on the panel revealed that Smith didn&#8217;t ask for a briefing about what was then allegedly only classified internally as &#8220;suspicious activity&#8221; until August 15, almost two weeks after the company hired outside cybersecurity experts to examine the issue.</p>
<p>Smith also maneuvered around questions about why Equifax chose to disclose the breach on the very day that <a href="https://en.wikipedia.org/wiki/Hurricane_Irma" target="_blank">Hurricane Irma</a> was dominating front-page news with an imminent landfall on the eastern seaboard of the United States.</p>
<p>However, Smith did blame Irma in explaining why the company&#8217;s phone systems were simply unable to handle the call volume from U.S. consumers concerned about the Category Five data breach, saying that Irma took down two of Equifax&#8217;s largest call centers days after the breach disclosure. He said the company handled over 420 million consumer visits to the portal designed to help people figure out whether they were victimized in the breach, underscoring how so many American adults were forced to revisit the site again and again because it failed to give people consistent answers about whether they were affected.<span id="more-41002"></span></p>
<p>Just a couple of hours after the House Commerce panel hearing ended, <em>Politico</em> ran <a href="http://www.politico.com/story/2017/10/03/equifax-irs-fraud-protection-contract-243419" target="_blank">a story</a> noting that the <strong>Internal Revenue Service</strong> opted to award Equifax a $7.25 million no-bid contract to provide identity-proofing and anti-fraud services to the tax bureau. Bear in mind that Equifax&#8217;s poor security contributed to <a href="https://krebsonsecurity.com/?s=irs+get+transcript+equifax&amp;x=0&amp;y=0" target="_blank">an epidemic of tax refund fraud at the IRS</a> in the 2015 and 2016 tax years, when fraudsters took advantage of weak security questions provided to the IRS by Equifax to file and claim phony tax refund requests on behalf of hundreds of thousands of taxpayers.</p>
<p>Don&#8217;t forget that tax fraudsters <a href="https://krebsonsecurity.com/2017/05/fraudsters-exploited-lax-security-at-equifaxs-talx-payroll-division/" target="_blank">exploited this same lax security at Equifax&#8217;s <strong>TALX</strong> payroll division</a> to steal employee tax records from an as-yet undisclosed number of companies between April 2016 and March 2017.</p>
<p>Finally, much of today&#8217;s hearing centered around questions about the difference between <a href="https://krebsonsecurity.com/?s=credit+freeze&amp;x=0&amp;y=0" target="_blank">a security freeze</a> &#8212; a right that was <a href="http://www.washingtonpost.com/wp-dyn/content/article/2007/05/09/AR2007050900427.html" target="_blank">hard-won on a state-by-state level</a> over several years &#8212; and the &#8220;credit lock&#8221; services being pushed instead by Equifax and the big bureaus. Lawmakers on today&#8217;s panel seemed content with Smith&#8217;s answer that the two things were effectively the same, only that a freeze was more cumbersome and costly, whereas credit locks were free and far more consumer-friendly.</p>
<p>To those still wavering on which is better, I have only to point to reasoning by <strong>Christina Tetreault</strong>, a staff attorney on the financial services team of <strong>Consumers Union</strong> &#8212; the policy arm of <em>Consumer Reports</em>. Tetreault notes that perhaps the main reason a security freeze is the better option is that its promise to guard your credit accounts is guaranteed by law, whereas a credit lock is simply an agreement between you and the credit monitoring company.</p>
<p>&#8220;Having a contractual agreement is not as strong as having protections under law,” Tetreault said. “The contract may be unclear, may include provisions that allow the other party to change it, or include provisions that you may be better off not agreeing to, such as an arbitration agreement.&#8221;</p>
<p>What&#8217;s more, placing a freeze on your file is exactly what Equifax and the other bureaus do not want you to do, because it prevents them from making money by selling your credit file to banks and others (including ID thieves) who wish to grant new lines of credit in your name. If that&#8217;s not the best reason for opting for a freeze, I don&#8217;t know what is.</p>
<p>If anyone needs more convincing on this front, check out <a href="http://www.standard.net/Business/2017/10/03/The-Latest-Another-Wells-Fargo-CEO-faces-an-angry-Congress.html" target="_blank">the testimony</a> given in other committees today by representatives from banking behemoth <strong>Wells Fargo</strong>, which is under fire signing up tens of thousands of auto loan customers for insurance they did not need and in some cases couldn&#8217;t afford. That scandal comes on the heels of another debacle in which Wells Fargo was found to have created more than 3.5 million bank accounts without consumers&#8217; permission between 2009 and 2016.</p>
<p>Mr. Smith is slated to testify before at least <a href="https://www.banking.senate.gov/public/index.cfm/hearings?ID=B61BB78D-CF34-4D54-B7F2-F7F982D77D6F" target="_blank">three</a> <a href="https://www.judiciary.senate.gov/meetings/equifax-continuing-to-monitor-data-broker-cybersecurity" target="_blank">other</a> <a href="https://financialservices.house.gov/calendar/eventsingle.aspx?EventID=402360" target="_blank">committees</a> in the House and Senate this week before he&#8217;s off the hot seat. On Friday, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2017/09/heres-what-to-ask-the-former-equifax-ceo/" target="_blank">a lengthy list of questions</a> that lawmakers should consider asking the former Equifax CEO. Here&#8217;s hoping our elected representatives don&#8217;t merely use these additional opportunities for more grandstanding and regurgitating the same questions.</p>


feed_id: https://krebsonsecurity.com/?p=40915
title: USPS ‘Informed Delivery’ Is Stalker’s Dream
uri: USPS-Informed-Delivery-Is-Stalker-s-Dream
url: https://krebsonsecurity.com/2017/10/usps-informed-delivery-is-stalkers-dream/
content:
<p>A free new service from the <strong>U.S. Postal Service</strong> that provides scanned images of incoming mail before it is slated to arrive at its destination address is raising eyebrows among security experts who worry about the service&#8217;s potential for misuse by private investigators, identity thieves, stalkers or abusive ex-partners. The USPS says it hopes to have changes in place by early next year that could help blunt some of those concerns.</p>
<p>The service, dubbed &#8220;<strong>Informed Delivery</strong>,&#8221; has been available to select addresses in several states since 2014 under a targeted USPS pilot program, but it has since expanded to include many ZIP codes nationwide, according to the Postal Service. U.S. residents can tell if their address is eligible by visiting <a href="https://informeddelivery.usps.com" target="_blank">informeddelivery.usps.com</a>.</p>
<div id="attachment_40983" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40983" src="media/e533c754.informeddelivery-580x250.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/10/informeddelivery-580x250.png" alt="Image: USPS" width="580" height="250" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/10/informeddelivery-580x250.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/10/informeddelivery-768x331.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/10/informeddelivery.png 818w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Image: USPS</p></div>
<p>According to the USPS, some 6.3 million accounts have been created via the service so far. The Postal Service says consumer feedback has been overwhelmingly positive, particularly among residents who travel regularly and wish to keep close tabs on any mail being delivered while they&#8217;re on the road.</p>
<p>But a review of the methods used by the USPS to validate new account signups suggests the service is wide open to abuse by a range of parties, mainly because of weak authentication and because it is not easy to opt out of the service.</p>
<p>Signing up requires an eligible resident <a href="https://reg.usps.com/entreg/RegistrationPortalAction_input" target="_blank">to create a free user account</a> at USPS.com, which asks for the resident&#8217;s name, address and an email address. The final step in validating residents involves answering four so-called &#8220;knowledge-based authentication&#8221; or KBA questions. KrebsOnSecurity has <a href="https://krebsonsecurity.com/?s=kba&amp;x=0&amp;y=0" target="_blank">relentlessly assailed KBA</a> as an unreliable authentication method because so many answers to the multiple-guess questions are available on sites like <strong>Spokeo</strong> and <strong>Zillow</strong>, or via social networking profiles.</p>
<p>Once signed up, a resident can view scanned images of the front of each piece of incoming mail in advance of its arrival. Unfortunately, because of the weak KBA questions (provided by <a href="https://krebsonsecurity.com/?s=equifax+breach&amp;x=0&amp;y=0" target="_blank">recently-breached</a> big-three credit bureau <strong>Equifax</strong>, no less) stalkers, jilted ex-partners, and private investigators also can see who you&#8217;re communicating with via the Postal mail.</p>
<p>Perhaps this wouldn&#8217;t be such a big deal if the USPS notified residents by snail mail when someone signs up for the service at their address, but it doesn&#8217;t.</p>
<p><strong>Peter Swire</strong>, a privacy and security expert at <strong>Georgia Tech</strong> and a senior counsel at the law firm of <strong>Alston &amp; Bird</strong>, said strong authentication relies on information collected from multiple channels &#8212; such as something you know (a password) and something you have (a mobile phone). In this case, however, the USPS has opted not to leverage a channel that it uniquely controls, namely the U.S. Mail system.</p>
<p>&#8220;The whole service is based on a channel they control, and they should use that channel to verify people,&#8221; Swire said. &#8220;That increases user trust that it&#8217;s a good service. Multi-channel authentication is becoming the industry norm, and the U.S. Postal Service should catch up to that.&#8221; <span id="more-40915"></span></p>
<p>I also wanted to know whether there was any way for households to opt out of having scanned images of their mail sent as part of this offering. The USPS replied that consumers may contact the <a href="https://uspshelp.custhelp.com/app/ask_id" target="_blank">Informed Delivery help desk</a> to request that the service not be presented to anyone in their household. &#8220;Each request is individually reviewed and assessed by members of the Postal Service Informed Delivery, Privacy and Legal teams,&#8221; the Postal Service replied.</p>
<p>There does not appear to be any limit on the number of people who can sign up for the service at any one address, except that one needs to know the names and KBA question answers for a valid resident of that address.</p>
<p>&#8220;Informed Delivery may be accessed by any adult member of a household,&#8221; the USPS wrote in response to questions. &#8220;Each member of the household must be able to complete the identity proofing process implemented by the Postal Service.&#8221;</p>
<p>The Postal Service said it is not possible for an address occupant to receive emailed, scanned images of incoming mail at more than one email address. In other words<em>, if you wish to prevent others from signing up in your name or in the name of any other adults at the address, the surest way to do that may be to register your own account and then urge all other adult residents at the address to create their own accounts.</em></p>
<p>A highly positive story about Informed Delivery <a href="https://www.nbcnews.com/business/consumer/new-usps-service-lets-you-digitally-preview-day-s-mail-n741926" target="_blank">published by NBC in April 2017</a> suggests another use for the service: Reducing mail theft. However, without stronger authentication, this service could let local ID thieves determine with pinpoint accuracy exactly when mail worth stealing is set to arrive.</p>
<p>The USPS says businesses are not currently eligible to sign up as recipients of Informed Delivery. However, people running businesses out of their home could also be the target of competitors hoping to steal away customers, or to pose as partner firms in demanding payment for outstanding invoices.</p>
<p>Informed Delivery seems like a useful service for those residents who wish to take advantage of it. But lacking stronger consumer validation the service seems ripe for abuse. The USPS should use its own unique communications channel (snail mail) to alert Americans when their physical address has been signed up for this service.</p>
<p><strong>Bob Dixon</strong>, the executive program director for Informed Delivery, said the Postal Service is working on an approach that it hopes to make available to the public in January 2018 which would allow USPS to send written notification to addresses when someone at that residence signs up for Informed Delivery.</p>
<p>Dixon said that capability will build on technology already in place to notify Americans via mail when a change of address is requested. Currently, the USPS allows address changes via the USPS Web site or in-person at any one of more than 3,000 post offices nationwide. When a request is processed, the USPS sends a confirmation letter to both the old address and the new address.</p>
<p>If someone already signed up for Informed Delivery later posts a change of address request, the USPS does not automatically transfer the Informed Delivery service to the new address: Rather, it sends a mailer with a special code tied to the new address and to the username that requested the change. To resume Informed Delivery at the new address, that code needs to be entered online using the account that requested the address change.</p>
<p>&#8220;Part of coming up with a mail-based verification system will also let us do some additional notification that, candidly, we just haven&#8217;t built yet,&#8221; Dixon said. &#8220;It is our intent to have this ready by January 2018, and it is one of our higher priorities to get it done by then.&#8221;</p>
<p>There is a final precaution that should block anyone from signing up as you: Readers who have taken my advice to freeze their credit files with the four major consumer credit reporting bureaus (Equifax, Experian, Innovis and Trans Union) will find they are not able to sign up for Informed Delivery online. That&#8217;s because having a freeze in place should block Equifax from being able to ask you the four KBA questions. </p>
<p>By the way, this same dynamic works with other services that you may not wish to use but which require you otherwise to plant your flag of identity to prevent others from doing so on your behalf, such as managing your relationship to the <a href="https://krebsonsecurity.com/?s=irs+get+kba&#038;x=0&#038;y=0" rel="noopener" target="_blank">Internal Revenue Service</a> online and the <a href="https://krebsonsecurity.com/2013/09/crooks-hijack-retirement-funds-via-ssa-portal/" rel="noopener" target="_blank">Social Security Administration</a>. For more information on why you should get a freeze and how to do that, <a href="https://krebsonsecurity.com/2017/09/the-equifax-breach-what-you-should-know/" rel="noopener" target="_blank">see this piece</a>.</p>
<p><strong>Update, 3:48 p.m. ET:</strong> Added bit about how a freeze can block someone from signing up in your name.</p>


feed_id: https://krebsonsecurity.com/?p=40935
title: Here’s What to Ask the Former Equifax CEO
uri: Here-s-What-to-Ask-the-Former-Equifax-CEO
url: https://krebsonsecurity.com/2017/09/heres-what-to-ask-the-former-equifax-ceo/
content:
<p><strong>Richard Smith </strong>&#8212; who resigned as chief executive of big-three credit bureau<strong> Equifax</strong> this week in the wake of <a href="https://krebsonsecurity.com/?s=equifax+breach&amp;x=0&amp;y=0" target="_blank">a data breach</a> that exposed 143 million Social Security numbers &#8212; is slated to testify in front of no fewer than four committees on Capitol Hill next week. If I were a lawmaker, here are some of the questions I&#8217;d ask when Mr. Smith goes to Washington.</p>
<p><img class="aligncenter size-medium wp-image-40944" src="media/26c0ae4b.capitol-580x272.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/capitol-580x272.png" alt="capitol" width="580" height="272" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/09/capitol-580x272.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/09/capitol-768x360.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/09/capitol-940x440.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/09/capitol.png 1095w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>Before we delve into the questions, a bit of background is probably in order. The new interim CEO of Equifax &#8212; <strong>Paulino do Rego Barros Jr.</strong> &#8212; took to <em>The Wall Street Journal</em> and <a href="https://www.bloomberg.com/news/articles/2017-09-27/equifax-will-offer-free-credit-freezes-for-life-new-ceo-says" target="_blank" rel="noopener">other media outlets</a> this week to publish a mea culpa on all the ways Equifax failed in responding to this breach (the title of <a href="https://www.wsj.com/articles/on-behalf-of-equifax-im-sorry-1506547253" target="_blank" rel="noopener">the op-ed in The Journal</a> was literally &#8220;I&#8217;m sorry&#8221;).</p>
<p>&#8220;We were hacked,&#8221; Barros wrote. &#8220;That’s the simple fact. But we compounded the problem with insufficient support for consumers. Our website did not function as it should have, and our call center couldn’t manage the volume of calls we received. Answers to key consumer questions were too often delayed, incomplete or both.&#8221;</p>
<p>Barros stated that Equifax was working to roll out a new system by Jan. 31, 2018 that would let consumers &#8220;easily lock and unlock access to their Equifax credit files.&#8221;</p>
<p>&#8220;You will be able to do this at will,&#8221; he continued. &#8220;It will be reliable, safe, and simple. Most significantly, the service will be offered free, for life.&#8221;</p>
<p>I have <a href="https://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">argued for years</a> that all of the data points needed for identity thieves to open new lines of credit in your name and otherwise ruin your credit score are available for sale in the cybercrime underground. To be certain, the Equifax breach holds the prospect that ID thieves could update all that stolen data with newer records. I&#8217;ve argued that the only sane response to this sorry state of affairs is for consumers to freeze their files at the bureaus, which blocks potential creditors &#8212; and ID thieves &#8212; from trashing your credit file and credit score.</p>
<p>Equifax is not the only bureau promoting one of these lock services. Since Equifax announced its breach on Sept. 7, big-three credit bureaus <strong>Trans Union</strong> and <strong>Experian</strong> have worked feverishly to steer consumers seeking freezes toward these locks instead, arguing that they are easier to use and allow consumers to lock and unlock their credit files with little more than the press of a button on a mobile phone app. Oh, and the locks are free, whereas the bureaus can (and do) charge consumers for placing and/or thawing a freeze (the laws freeze fee laws <a href="http://consumersunion.org/research/consumers-unions-guide-to-security-freeze-protection-2/" target="_blank">differ from state to state</a>).</p>
<h4>CREDIT FREEZE VS. CREDIT LOCK</h4>
<p>My first group of questions would center around security freezes or credit freezes, and the difference between those and these credit lock services being pushed hard by the bureaus. </p>
<p>Currently, even consumer watchdog groups say they are uncertain about the difference between a freeze and a lock. See <a href="http://www.uspirg.org/news/usp/equifax%E2%80%99s-offer-free-%E2%80%9Clock%E2%80%9D-raises-questions-best-protection-still-credit-freezes-all-three" target="_blank">this press release</a> from Thursday by <strong>U.S. PIRG</strong>, the federation of state Public Interest Research Groups, for one such example.</p>
<p>Also, I&#8217;m curious to know what percentage of Americans had a freeze prior to the breach, and how many froze their credit files (or attempted to do so) after Equifax announced the breach. The answers to these questions may help explain why the bureaus are now massively pushing their new credit lock offerings (i.e., perhaps they&#8217;re worried about the revenue hit they&#8217;ll take should a significant percentage of Americans decide to freeze their credit files).</p>
<p>I suspect the pre-breach number is less than one percent. I base this guess loosely on some data I received from the head of security at Dropbox, who <a href="http://krebsonsecurity.com/2016/06/dropbox-smeared-in-week-of-megabreaches/" target="_blank">told KrebsOnSecurity last year</a> that less than one percent of its user base of 500 million registered users had chosen to turn on 2-factor authentication for their accounts. This extra security step can block thieves from accessing your account even if they steal your password, but many consumers simply don&#8217;t take advantage of such offerings because either they don&#8217;t know about them or they find them inconvenient.</p>
<p>Bear in mind that while most two-factor offerings are free, most freezes involve fees, so I&#8217;d expect the number of pre-breach freezers to be a fraction of one percent. However, if only one half of one percent of Americans chose to freeze their credit files before Equifax announced its breach &#8212; and if the total number of Americans requesting a freeze post-breach rose to, say, one percent &#8212; that would still be a huge jump (and potentially a painful financial hit to Equifax and the other bureaus).</p>
<p><img class="aligncenter size-full wp-image-40941" src="media/c5c7bb50.creditfreeze.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/creditfreeze.png" alt="creditfreeze" width="521" height="214" /></p>
<p>So without further ado, here are some questions I&#8217;d ask on the topic of credit locks and freezes:</p>
<p>-Approximately how many credit files on Americans does Equifax currently maintain?</p>
<p>-Prior to the Equifax breach, approximately how many Americans had chosen to freeze their credit files at Equifax?</p>
<p>-Approximately how many total Americans today have requested a freeze from Equifax? This should include the company&#8217;s best estimate on the number of people who have requested a freeze but &#8212; because of the many failings of Equifax&#8217;s public response cited by Barros &#8212; were unable to do so via phone or the Internet.</p>
<p>-Approximately how much does Equifax charge each time the company sells a credit check (i.e., a bank or other potential creditor performs a &#8220;pull&#8221; on a consumer credit file)?</p>
<p>-On average, how many times per year does Equifax sell access to consumer&#8217;s credit file to a potential creditor?</p>
<p>-Mr. Barros said Equifax will extend its offer of free credit freezes until the end of January 2018. Why not make them free indefinitely, just as the company says it plans to do with its credit lock service?</p>
<p>-In what way does a consumer placing a freeze on their credit file limit Equifax&#8217;s ability to do business?</p>
<p>-In what way does a consumer placing a lock on their credit file limit Equifax&#8217;s ability to do business?</p>
<p>-If a lock accomplishes the same as a freeze, why create more terminology that only confuses consumers?</p>
<p>-By agreeing to use Equifax&#8217;s lock service, will consumers also be opting in to any additional marketing arrangements, either via Equifax or any of its partners?<span id="more-40935"></span></p>
<h4>BREACH RESPONSE</h4>
<p>Equifax <a href="https://krebsonsecurity.com/2017/09/equifax-breach-response-turns-dumpster-fire/" target="_blank">could hardly have bungled their breach response more if they tried</a>. It is said that one should never attribute to malice what can more easily be explained by incompetence, but Equifax surely should have known that how they handled their public response would be paramount to their ability to quickly put this incident behind them and get back to business as usual.</p>
<p><img class="aligncenter size-medium wp-image-40940" src="media/b5b601ed.dumpsterfire-580x325.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/dumpsterfire-580x325.png" alt="dumpsterfire" width="580" height="325" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/09/dumpsterfire-580x325.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/09/dumpsterfire.png 588w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>Equifax has come under heavy criticism for waiting too long to disclose this breach. It has said that the company became aware of the intrusion on July 29, and yet it did not publicly disclose the breach until Sept. 7.However, when Equifax did disclose, it seemed like everything about the response was rushed and ill-conceived.</p>
<p>One theory that I simply cannot get out of my head is that perhaps Equifax rushed preparations for is breach disclosure and response because it was given a deadline by extortionists who were threatening to disclose the breach on their own if the company did not comply with some kind of demand.</p>
<p>-I&#8217;d ask a question of mine that Equifax refused to answer shortly after the breach: Whether the company was the target of extortionists over this data breach *before* the breach was officially announced on Sept. 7.</p>
<p>-Equifax said the attackers abused a vulnerability in Apache Struts to break in to the company&#8217;s Web applications. That Struts flaw was patched by the Apache Foundation on March 8, 2017, but Equifax waited until after July 30, 2017 &#8212; after it learned of the breach &#8212; to patch the vulnerability. Why did Equifax decide to wait four and a half months to apply this critical update?</p>
<p>-How did Equifax become aware of this breach? Was it from an external source, such as law enforcement?</p>
<p>-Assuming Equifax learned about this breach from law enforcement agencies, what did those agencies say regarding how they learned about the breach?</p>
<h4>FRAUD AND ABUSE</h4>
<p>Multiple news organizations have reported that companies which track crimes related to identity theft &#8212; such as account takeovers, new account fraud, and e-commerce fraud &#8212; saw <a href="http://nypost.com/2017/09/08/credit-card-fraud-spikes-after-equifax-cyber-attack/" target="_blank">huge upticks in all of these areas</a> corresponding to two periods that are central to Equifax&#8217;s breach timeline; the first in mid-May, when Equifax said the intruders began abusing their access to the company, and the second late July/early August, when Equifax said it learned about the breach.</p>
<div id="attachment_40938" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/16f9b95d.threatmetrixfraudpattnerns2017.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/threatmetrixfraudpattnerns2017.png"> <img class="wp-image-39807 size-medium" src="media/b39e6122.threatmetrixfraudpattnerns2017-580x223.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/threatmetrixfraudpattnerns2017-580x223.png" alt=" " width="580" height="223" /></a><p class="wp-caption-text">This chart shows spikes in various forms of identity abuse &#8212; including account takeovers and new account fraud &#8212; as tracked by ThreatMetrix, a San Jose, Calif. firm that helps businesses prevent fraud.</p></div>
<p>-Has Equifax performed any analysis on consumer credit reports to determine if there has been any pattern of consumer harm as a result of this breach?</p>
<p>-Assuming the answer to the previous question is yes, did the company see any spikes in applications for new lines of consumer credit corresponding to these two time periods in 2017?</p>
<p>Many fraud experts report that a fast-growing area of identity theft involves so-called &#8220;synthetic ID theft,&#8221; in which fraudsters take data points from multiple established consumer identities and merge them together to form a new identity. This type of fraud often takes years to result in negative consequences for consumers, and very often the debt collection agencies will go after whoever legitimately owns the Social Security number used by that identity, regardless of who owns the other data points.</p>
<p>-Is Equifax aware of a noticeable increase in synthetic identity theft in recent months or years?</p>
<p>-What steps, if any, does Equifax take to ensure that multiple credit files are not using the same Social Security number?</p>
<p>-Prior to its breach disclosure, Equifax <a href="https://www.wsj.com/articles/equifax-lobbied-for-easier-regulation-before-data-breach-1505169330" target="_blank">spent more than a half million dollars</a> in the first half of 2017 lobbying Congress to pass legislation that would limit the legal liability of credit bureaus in connection with data security lapses. Do you still believe such legislation is necessary? Why or why not?</p>
<p>What questions did I leave out, Dear Readers? Or is there a way to make a question above more succinct? Sound off in the comments below, and I may just add yours to the list!</p>
<p>In the meantime, here are the committees at which Former Equifax CEO Richard Smith will be testifying next week on Capitol Hill. Some of these committees will no doubt be live-streaming the hearings. Check back at the links below on the morning-of for more information on that. Also, <strong>C-SPAN</strong> almost certainly will be streaming some of these as well:</p>
<p>-Tuesday, Oct. 3, 10:00 a.m., <a href="https://energycommerce.house.gov/hearings/oversight-equifax-data-breach-answers-consumers/" target="_blank" rel="noopener">House Energy and Commerce Committee.</a> Rayburn House Office Bldg. Room 2123.</p>
<p>-Wednesday, Oct. 4, 10:00 a.m., <a href="https://www.banking.senate.gov/public/index.cfm/hearings?ID=B61BB78D-CF34-4D54-B7F2-F7F982D77D6F" target="_blank" rel="noopener">Senate Committee on Banking, Housing, &amp; Urban Affairs</a>. Dirksen Senate Office Bldg., Room 538.</p>
<p>-Wednesday, Oct. 4, 2:30 p.m., <a href="https://www.judiciary.senate.gov/meetings/equifax-continuing-to-monitor-data-broker-cybersecurity" target="_blank">Senate Judiciary Subcommittee on Privacy, Technology and the Law</a>. Dirksen Senate Office Bldg., Room 226.</p>
<p>-Thursday, Oct. 5, 9:15 a.m., <a href="https://financialservices.house.gov/calendar/eventsingle.aspx?EventID=402360" target="_blank">House Financial Services Committee</a>. Rayburn House Office Bldg., Room 2128.</p>


feed_id: https://krebsonsecurity.com/?p=40909
title: Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards
uri: Breach-at-Sonic-Drive-In-May-Have-Impacted-Millions-of-Credit-Debit-C
url:
https://krebsonsecurity.com/2017/09/breach-at-sonic-drive-in-may-have-impacted-millions-of-credit-debit-cards/

content:
<p><strong>Sonic Drive-In</strong>, a fast-food chain with nearly 3,600 locations across 45 U.S. states, has acknowledged a breach affecting an unknown number of store payment systems. The ongoing breach may have led to a fire sale on millions of stolen credit and debit card accounts that are now being peddled in shadowy underground cybercrime stores, KrebsOnSecurity has learned.</p>
<p><img class="aligncenter size-medium wp-image-40917" src="media/28c35589.sonicdrivein-580x300.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/sonicdrivein-580x300.png" alt="sonicdrivein" width="580" height="300" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/09/sonicdrivein-580x300.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/09/sonicdrivein-768x397.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/09/sonicdrivein.png 782w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>The first hints of a breach at Oklahoma City-based Sonic came last week when I began hearing from sources at multiple financial institutions who noticed a recent pattern of fraudulent transactions on cards that had all previously been used at Sonic.</p>
<p>I directed several of these banking industry sources to have a look at a brand new batch of some five million credit and debit card accounts that were first put up for sale on Sept. 18 in a credit card theft bazaar <a href="https://krebsonsecurity.com/?s=joker%27s+stash&amp;x=0&amp;y=0" target="_blank">previously featured here</a> called Joker&#8217;s Stash:</p>
<div id="attachment_40912" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40912" src="media/6447ff20.firetigerrr-580x581.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/firetigerrr-580x581.png" alt="This batch of some five million cards put up for sale Sept. 26, 2017 on the popular carding site Joker's Stash has been tied to a breach at Sonic Drive-In" width="580" height="581" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/09/firetigerrr-150x150.png 150w, http://krebsonsecurity.com/wp-content/uploads/2017/09/firetigerrr-580x581.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/09/firetigerrr-768x770.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/09/firetigerrr.png 902w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">This batch of some five million cards put up for sale today (Sept. 26, 2017) on the popular carding site Joker&#8217;s Stash has been tied to a breach at Sonic Drive-In. The first batch of these cards appear to have been uploaded for sale on Sept. 15.</p></div>
<p>Sure enough, two sources who agreed to purchase a handful of cards from that batch of accounts on sale at Joker&#8217;s discovered they all had been recently used at Sonic locations.</p>
<p>Armed with this information, I phoned Sonic, which responded within an hour that it was indeed investigating &#8220;a potential incident&#8221; at some Sonic locations.</p>
<p>&#8220;Our credit card processor informed us last week of unusual activity regarding credit cards used at SONIC,&#8221; reads a statement the company issued to KrebsOnSecurity. &#8220;The security of our guests’ information is very important to SONIC. We are working to understand the nature and scope of this issue, as we know how important this is to our guests. We immediately engaged third-party forensic experts and law enforcement when we heard from our processor. While law enforcement limits the information we can share, we will communicate additional information as we are able.&#8221;</p>
<p><strong>Christi Woodworth</strong>, vice president of public relations at Sonic, said the investigation is still in its early stages, and the company does not yet know how many or which of its stores may be impacted.</p>
<p>The accounts apparently stolen from Sonic are part of a batch of cards that Joker&#8217;s Stash is calling &#8220;Firetigerrr,&#8221; and they are indexed by city, state and ZIP code. This geographic specificity allows potential buyers to purchase only cards that were stolen from Sonic customers who live near them, thus avoiding a common anti-fraud defense in which a financial institution might block out-of-state transactions from a known compromised card.<span id="more-40909"></span></p>
<p>Malicious hackers typically steal credit card data from organizations that accept cards by hacking into point-of-sale systems remotely and seeding those systems with malicious software that can copy account data stored on a card’s magnetic stripe. Thieves can use that data to clone the cards and then use the counterfeits to buy high-priced merchandise from electronics stores and big box retailers.</p>
<p>Prices for the cards advertised in the Firetigerr batch are somewhat higher than for cards stolen in other breaches, likely because this batch is extremely fresh and unlikely to have been canceled by card-issuing banks yet.</p>
<div id="attachment_40914" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/3622ca89.js-buydumps.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/js-buydumps.png"> <img class="wp-image-39807 size-medium" src="media/6491394d.js-buydumps-580x277.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/js-buydumps-580x277.png" alt=" " width="580" height="277" /></a><p class="wp-caption-text">Dumps available for sale on Joker&#8217;s Stash from the &#8220;FireTigerrr&#8221; base, which has been linked to a breach at Sonic Drive-In. Click image to enlarge.</p></div>
<p>Most of the cards range in price from $25 to $50, and the price is influenced by a number of factors, including: the type of card issued (Amex, Visa, MasterCard, etc); the card&#8217;s level (classic, standard, signature, platinum, etc.); whether the card is debit or credit; and the issuing bank.</p>
<p>I should note that it remains unclear whether Sonic is the only company whose customers&#8217; cards are being sold in this particular batch of five million cards at Joker&#8217;s Stash. There are some (as yet unconfirmed) indications that perhaps Sonic customer cards are being mixed in with those stolen from other eatery brands that may be compromised by the same attackers.</p>
<p>The last known major card breach involving a large nationwide fast-food chain <a href="https://krebsonsecurity.com/2016/07/1025-wendys-locations-hit-in-card-breach/" target="_blank" rel="noopener">impacted more than a thousand Wendy&#8217;s locations</a> and persisted for almost nine months after it was <a href="http://krebsonsecurity.com/2016/01/wendys-probes-reports-of-credit-card-breach/" target="_blank">first disclosed here</a>. The Wendy&#8217;s breach <a href="https://krebsonsecurity.com/2016/03/credit-unions-feeling-pinch-in-wendys-breach/" target="_blank" rel="noopener">was extremely costly</a> for card-issuing banks and credit unions, which were forced to continuously re-issue customer cards that kept getting re-compromised every time their customers went back to eat at another Wendy&#8217;s.</p>
<p>Part of the reason Wendy&#8217;s corporate offices had trouble getting a handle on the situation was that most of the breached locations were not corporate-owned but instead independently-owned franchises whose payment card systems were managed by third-party point-of-sale vendors.</p>
<p>According to Sonic&#8217;s <a href="https://en.wikipedia.org/wiki/Sonic_Drive-In" target="_blank">Wikipedia page</a>, roughly 90 percent of Sonic locations across America are franchised.</p>
<p><strong>Dan Berger</strong>, president and CEO of the <strong>National Association of Federally Insured Credit Unions</strong>, said he&#8217;s not looking forward to the prospect of another Wendy&#8217;s-like fiasco.</p>
<p>&#8220;It&#8217;s going to be the financial institution that makes them whole, that pays off the charges or replaces money in the customer&#8217;s checking account, or reissues the cards, and all those costs fall back on the financial institutions,&#8221; Berger said. &#8220;These big card breaches are going to continue until there&#8217;s a national standard that holds retailers and merchants accountable.&#8221;</p>
<p>Financial institutions also bear some of the blame for the current state of affairs. The United States is embarrassingly the last of the G20 nations to make the shift to more secure chip-based cards, which are far more expensive and difficult for criminals to counterfeit. But many financial institutions still haven&#8217;t gotten around to replacing traditional magnetic stripe cards with chip-based cards. According to <strong>Visa</strong>, 58 percent of the more than 421 million Visa cards issued by U.S. financial institutions were chip-based <a href="https://usa.visa.com/visa-everywhere/security/visa-chip-card-stats-march-2017.html" rel="noopener" target="_blank">as of March 2017</a>.</p>
<p>Likewise, retailers that accept chip cards may present a less attractive target to hackers than those that don&#8217;t. In March 2017, Visa said the number of chip-enabled merchant locations in the country reached two million, representing 44 percent of stores that accept Visa.</p>


feed_id: https://krebsonsecurity.com/?p=40890
title: Source: Deloitte Breach Affected All Company Email, Admin Accounts
uri: Source-Deloitte-Breach-Affected-All-Company-Email-Admin-Accounts
url:
https://krebsonsecurity.com/2017/09/source-deloitte-breach-affected-all-company-email-admin-accounts/

content:
<p><strong>Deloitte</strong>, one of the world&#8217;s &#8220;big four&#8221; accounting firms, has acknowledged a breach of its internal email systems, British news outlet <em>The Guardian</em> revealed today. Deloitte has sought to downplay the incident, saying it impacted &#8220;very few&#8221; clients. But according to a source close to the investigation, the breach dates back to at least the fall of 2016, and involves the compromise of all administrator accounts at the company as well as Deloitte&#8217;s entire internal email system.</p>
<p><img class="aligncenter size-medium wp-image-40896" src="media/ff1704ec.deloitte-580x364.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/deloitte-580x364.png" alt="deloitte" width="580" height="364" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/09/deloitte-580x364.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/09/deloitte-768x481.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/09/deloitte.png 812w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>In <a href="https://www.theguardian.com/business/2017/sep/25/deloitte-hit-by-cyber-attack-revealing-clients-secret-emails" target="_blank">a story</a> published Monday morning, <em>The Guardian</em> said a breach at Deloitte involved usernames, passwords and personal data on the accountancy&#8217;s top blue-chip clients.</p>
<p>&#8220;The Guardian understands Deloitte clients across all of these sectors had material in the company email system that was breached,&#8221; The Guardian&#8217;s <strong>Nick Hopkins</strong> wrote. &#8220;The companies include household names as well as US government departments. So far, six of Deloitte’s clients have been told their information was &#8216;impacted&#8217; by the hack.&#8221;</p>
<p>In a statement sent to KrebsOnSecurity, Deloitte acknowledged a &#8220;cyber incident&#8221; involving unauthorized access to its email platform.</p>
<p>&#8220;The review of that platform is complete,&#8221; the statement reads. &#8220;Importantly, the review enabled us to understand precisely what information was at risk and what the hacker actually did and to determine that only very few clients were impacted [and] no disruption has occurred to client businesses, to Deloitte&#8217;s ability to continue to serve clients, or to consumers.&#8221;</p>
<p>However, information shared by a person with direct knowledge of the incident said the company in fact does not yet know precisely when the intrusion occurred, or for how long the hackers were inside of its systems.</p>
<p>This source, speaking on condition of anonymity, said the team investigating the breach focused their attention on a company office in Nashville known as the &#8220;Hermitage,&#8221; where the breach is thought to have begun.</p>
<p>The source confirmed <em>The Guardian</em> reporting that current estimates put the intrusion sometime in the fall of 2016, and added that investigators still are not certain that they have completely evicted the intruders from the network.</p>
<p>Indeed, it appears that Deloitte has known something was not right for some time. According to this source, the company sent out a &#8220;mandatory password reset&#8221; email on Oct. 13, 2016 to all Deloitte employees in the United States. The notice stated that employee passwords and personal identification numbers (PINs) needed to be changed by Oct. 17, 2016, and that employees who failed to do so would be unable to access email or other Deloitte applications. The message also included advice on how to pick complex passwords:</p>
<div id="attachment_40895" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40895" src="media/84a33fee.deloittepwdreset-580x379.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/deloittepwdreset-580x379.png" alt="A screen shot of the mandatory password reset email Deloitte sent to all U.S. employees in Oct. 2016, around the time sources say the breach was first discovered." width="580" height="379" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/09/deloittepwdreset-580x379.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/09/deloittepwdreset-768x502.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/09/deloittepwdreset-940x614.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/09/deloittepwdreset.png 1041w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A screen shot of the mandatory password reset message Deloitte sent to all U.S. employees in Oct. 2016, around the time sources say the breach was first discovered.</p></div>
<p>The source told KrebsOnSecurity they were coming forward with information about the breach because, &#8220;I think it&#8217;s unfortunate how we have handled this and swept it under the rug. It wasn&#8217;t a small amount of emails like reported. They accessed the entire email database and all admin accounts. But we never notified our advisory clients or our cyber intel clients.&#8221;<span id="more-40890"></span></p>
<p>&#8220;Cyber intel&#8221; refers to Deloitte&#8217;s <a href="http://www.cyberintelligencecentre.com/" target="_blank">Cyber Intelligence Centre</a>, which provides 24/7 &#8220;business-focused operational security&#8221; to a number of big companies, including <strong>CSAA Insurance</strong>, <strong>FedEx</strong>, <strong>Invesco, </strong>and <strong>St. Joseph&#8217;s Healthcare System</strong>, among others.</p>
<p>This same source said forensic investigators identified several gigabytes of data being exfiltrated to a server in the United Kingdom. The source further said the hackers had free reign in the network for &#8220;a long time&#8221; and that the company still does not know exactly how much total data was taken.</p>
<p>In its statement about the incident, Deloitte said it responded by &#8220;implementing its comprehensive security protocol and initiating an intensive and thorough review which included mobilizing a team of cyber-security and confidentiality experts inside and outside of Deloitte.&#8221; Additionally, the company said it contacted governmental authorities immediately after it became aware of the incident, and that it contacted each of the &#8220;very few clients impacted.&#8221;</p>
<p>&#8220;Deloitte remains deeply committed to ensuring that its cyber-security defenses are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cyber security,&#8221; the statement concludes.</p>
<p>Deloitte has not yet responded to follow-up requests for comment.  The Guardian reported that Deloitte notified six affected clients, but Deloitte has not said publicly yet when it notified those customers.</p>
<p>Deloitte has a significant cybersecurity consulting practice globally, wherein it advises many of its clients on how best to secure their systems and sensitive data from hackers. In 2012, Deloitte was ranked #1 globally in security consulting based on revenue.</p>
<p>Deloitte refers to one or more of <strong>Deloitte Touche Tohmatsu Limited</strong>, a private company based in the United Kingdom. According to the company&#8217;s Web site, Deloitte has more than 263,000 employees at member firms delivering services in audit and insurance, tax, consulting, financial advisory, risk advisory, and related services in more than 150 countries and territories. Revenues for the fiscal year 2017 were $38.8 billion.</p>
<p>The breach at the big-four accountancy comes on the heels of <a href="https://krebsonsecurity.com/?s=equifax+breach&amp;x=0&amp;y=0" target="_blank">a massive breach at big-three consumer credit bureau Equifax</a>. That incident involved several months of unauthorized access in which intruders stole Social Security numbers, birth dates, and addresses on 143 million Americans.</p>
<p>This is a developing story. Any updates will be posted as available, and noted with update timestamps.</p>


feed_id: https://krebsonsecurity.com/?p=40877
title: Canadian Man Gets 9 Months Detention for Serial Swattings, Bomb Threats
uri: Canadian-Man-Gets-9-Months-Detention-for-Serial-Swattings-Bomb-Threat
url:
https://krebsonsecurity.com/2017/09/canadian-man-gets-9-months-detention-for-serial-swattings-bomb-threats/

content:
<p>A 19-year-old Canadian man was found guilty of making almost three dozen fraudulent calls to emergency services across North America in 2013 and 2014. The false alarms, two of which targeted this author &#8212; involved phoning in phony bomb threats and multiple attempts at &#8220;swatting&#8221; &#8212; a dangerous hoax in which the perpetrator spoofs a call about a hostage situation or other violent crime in progress in the hopes of tricking police into responding at a particular address with deadly force.</p>
<p><strong>Curtis Gervais</strong> of Ottawa was 16 when he began his swatting spree, which prompted police departments across the United States and Canada to respond to fake bomb threats and active shooter reports at a number of schools and residences.</p>
<p>Gervais, who taunted swatting targets using the Twitter accounts &#8220;ProbablyOnion&#8221; and &#8220;ProbablyOnion2,&#8221; got such a high off of his escapades that he hung out a for-hire shingle on Twitter, offering to swat anyone with the following tweet:</p>
<p><img class="aligncenter size-large wp-image-25893" src="media/193d0ff2.wantswat-600x81.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/05/wantswat-600x81.png" alt="wantswat" width="600" height="81" srcset="http://krebsonsecurity.com/wp-content/uploads/2014/05/wantswat-285x38.png 285w, http://krebsonsecurity.com/wp-content/uploads/2014/05/wantswat-600x81.png 600w, http://krebsonsecurity.com/wp-content/uploads/2014/05/wantswat.png 856w" sizes="(max-width: 600px) 100vw, 600px" /></p>
<p>Several Twitter users <a href="media/bfb13b3a.po-montgomerycountyschools.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/05/po-montgomerycountyschools.png" target="_blank" rel="noopener">apparently</a> <a href="media/262d43e5.po-northwesthighschool.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/05/po-northwesthighschool.png" target="_blank" rel="noopener">took</a> <a href="media/6d05324d.po-mountainparkschool.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/05/po-mountainparkschool.png" target="_blank" rel="noopener">him</a> <a href="media/6118c3fe.po-freedomhigh-libertymiddle.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/05/po-freedomhigh-libertymiddle.png" target="_blank" rel="noopener">up</a> <a href="media/9a412281.po-watervlietjuniorhigh.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/05/po-watervlietjuniorhigh.png" target="_blank" rel="noopener">on</a> <a href="media/f2a8dbec.po-melbournehighschool-fla.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/05/po-melbournehighschool-fla.png" target="_blank" rel="noopener">that</a> <a href="media/f2a8dbec.po-melbournehighschool-fla.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/05/po-melbournehighschool-fla.png" target="_blank" rel="noopener">offer</a>. On March 9, 2014, @ProbablyOnion started sending me rude and annoying messages on Twitter. A month later (and several weeks after blocking him on Twitter), I received a phone call from the local police department. It was early in the morning on Apr. 10, and the cops wanted to know if everything was okay at our address.</p>
<p>Since this was <a title="http://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" href="http://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank">not the first time someone had called in a fake hostage situation at my home</a>, the call I received came from the police department’s non-emergency number, and they were unsurprised when I told them that the Krebs manor and all of its inhabitants were just fine.</p>
<p>Minutes after my local police department received that fake notification, @ProbablyOnion was bragging on Twitter about swatting me, including me on his public messages: “You have 5 hostages? And you will kill 1 hostage every 6 times and the police have 25 minutes to get you $100k in clear plastic.” Another message read: “Good morning! Just dispatched a swat team to your house, they didn’t even call you this time, hahaha.”</p>
<p><img class="aligncenter size-large wp-image-25889" src="media/9cd94db4.po2-swatbk-600x362.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/05/po2-swatbk-600x362.png" alt="po2-swatbk" width="600" height="362" srcset="http://krebsonsecurity.com/wp-content/uploads/2014/05/po2-swatbk-285x172.png 285w, http://krebsonsecurity.com/wp-content/uploads/2014/05/po2-swatbk-600x362.png 600w, http://krebsonsecurity.com/wp-content/uploads/2014/05/po2-swatbk.png 820w" sizes="(max-width: 600px) 100vw, 600px" /></p>
<p>I told this user privately that targeting an investigative reporter maybe wasn’t the brightest idea, and that he was likely to wind up in jail soon.  On May 7, @ProbablyOnion tried to get the swat team to visit my home again, and once again without success. “How’s your door?” he tweeted. I <a title="https://twitter.com/briankrebs/status/464109424144314369" href="https://twitter.com/briankrebs/status/464109424144314369" target="_blank">replied</a>: “Door’s fine, Curtis. But I’m guessing yours won’t be soon. Nice opsec!”</p>
<p>I was referring to <a title="http://krebsonsecurity.com/wp-content/uploads/2014/05/pastebin_MzPsBM99_5-7-2014_dox.txt" href="http://krebsonsecurity.com/wp-content/uploads/2014/05/pastebin_MzPsBM99_5-7-2014_dox.txt" target="_blank">a document</a> that had just been leaked on <strong>Pastebin</strong>, which identified @ProbablyOnion as a 19-year-old <strong>Curtis Gervais</strong> from Ontario. @ProbablyOnion laughed it off but didn’t deny the accuracy of the information, except to <a title="https://twitter.com/ProbablyOnion2/status/464104029946400769" href="https://twitter.com/ProbablyOnion2/status/464104029946400769" target="_blank">tweet that the document got his age wrong</a>.</p>
<p>A day later, @ProbablyOnion would <a title="https://twitter.com/ProbablyOnion2/status/464544500233539586" href="https://twitter.com/ProbablyOnion2/status/464544500233539586" target="_blank">post his final tweet</a> before being arrested: “Still awaiting for the horsies to bash down my door,” a taunting reference to the <strong>Royal Canadian Mounted Police</strong> (RCMP).</p>
<p><a href="http://ottawacitizen.com/news/local-news/barrhaven-teen-hacker-plans-to-appeal-nine-month-sentence-in-swatting-case" target="_blank">A Sept. 14, 2017 article</a> in the <em>Ottawa Citizen</em> doesn&#8217;t name Gervais because it is against the law in Canada to name individuals charged with or convicted of crimes committed while they are a minor. But the story quite clearly refers to Gervais, who reportedly is now married and expecting a child.<span id="more-40877"></span></p>
<p>The Citizen says the teenager was arrested by Ottawa police after the U.S. FBI traced his Internet address to his parents&#8217; home. The story notes that &#8220;the hacker&#8221; and his family have maintained his innocence throughout the trial, and that they plan to appeal the verdict. Gervais&#8217; attorneys reportedly claimed the youth was framed by the hacker collective Anonymous, but the judge in the case was unconvinced.</p>
<p>Apparently, <strong>Ontario Court Justice Mitch Hoffman</strong> handed down a lenient sentence in part because of more than 900 hours of volunteer service the accused had performed in recent years. From the story:</p>
<blockquote><p>Hoffman said that troublesome 16-year-old was hard to reconcile with the 19-year-old, recently married and soon-to-be father who stood in court before him, accompanied in court Thursday by his wife, father and mother.</p>
<p>“He has a bright future ahead of him if he uses his high level of computer skills and high intellect in a pro-social way,” Hoffman said. “If he does not, he has a penitentiary cell waiting for him if he uses his skills to criminal ends.”</p></blockquote>
<p>According to the article, the teen will serve six months of his nine-month sentence at a youth group home and three months at home &#8220;under strict restrictions, including the forfeiture of a home computer used to carry out the cyber pranks.&#8221; He also is barred from using Twitter or Skype during his 18-month probation period.</p>
<p>Most people involved in swatting and making bomb threats are young males under the age of 18 — the age when kids seem to have little appreciation for or care about the seriousness of their actions. According to the FBI, each swatting incident costs emergency responders approximately $10,000. Each hoax also unnecessarily endangers the lives of the responders and the public.</p>
<p>In February 2017, another 19-year-old &#8212; a man from Long Beach, Calif. named <strong>Eric &#8220;Cosmo the God&#8221; Taylor</strong> &#8212; was <a href="https://krebsonsecurity.com/2017/02/men-who-sent-swat-team-heroin-to-my-home-sentenced/" target="_blank">sentenced to three year&#8217;s probation</a> for his role in swatting my home in Northern Virginia in 2013. Taylor was among several men involved in making a false report to my local police department at the time about a supposed hostage situation at our house. In response, a <a href="http://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank">heavily-armed police force surrounded my home</a> and put me in handcuffs at gunpoint before the police realized it was all a dangerous hoax.</p>


feed_id: https://krebsonsecurity.com/?p=40849
title: Equifax or Equiphish?
uri: Equifax-or-Equiphish
url: https://krebsonsecurity.com/2017/09/equifax-or-equiphish/
content:
<p>More than a week after it said most people would be eligible to enroll in a free year of its <strong>TrustedID</strong> identity theft monitoring service, big three consumer credit bureau <strong>Equifax</strong> has begun sending out email notifications to people who were able to take the company up on its offer. But in yet another security stumble, the company appears to be training recipients to fall for phishing scams.</p>
<p>Some people who signed up for the service after Equifax <a href="https://krebsonsecurity.com/2017/09/breach-at-equifax-may-impact-143m-americans/">announced Sept. 7</a> that it had lost control over Social Security numbers, dates of birth and other sensitive data on 143 million Americans are still waiting for the promised notice from Equifax. But as I <a href="https://twitter.com/briankrebs/status/911240841510912000" target="_blank">recently noted on Twitter</a>, other folks have received emails from Equifax over the past few days, and the messages do not exactly come across as having emanated from a company that cares much about trying to regain the public&#8217;s trust.</p>
<p>Here&#8217;s a redacted example of an email Equifax sent out to one recipient recently:</p>
<p><img class="aligncenter size-full wp-image-40856" src="media/0450e0b7.equifaxcare.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/equifaxcare.png" alt="equifaxcare" width="524" height="943" /></p>
<p>As we can see, the email purports to have been sent from <strong>trustedid.com</strong>, a domain that Equifax has owned for almost four years. However, Equifax apparently decided it was time for a new &#8212; and perhaps snazzier &#8212; name: <strong>trustedidpremier.com</strong>.</p>
<p>The above-pictured message says it was sent from one domain, and then asks the recipient to respond by clicking on a link to a completely different (but confusingly similar) domain.</p>
<p>My guess is the reason Equifax registered trustedidpremier.com was to help people concerned about the breach to see whether they were one of the 143 million people affected (for more on how that worked out for them, see <a href="https://krebsonsecurity.com/2017/09/equifax-breach-response-turns-dumpster-fire/" target="_blank">Equifax Breach Response Turns Dumpster Fire</a>). I&#8217;d further surmise that Equifax was expecting (and received) so much interest in the service as a result of the breach that all the traffic from the wannabe customers might swamp the trustedid.com site and ruin things for the people who were already signed up for the service before Equifax announced the breach on Sept. 7.</p>
<p>The problem with this dual-domain approach is that the domain trustedidpremier.com is only a few weeks old, so it had very little time to establish itself as a legitimate domain. As a result, in the first few hours after Equifax disclosed the breach the domain was actually flagged as a phishing site by multiple browsers because it was brand new and looked about as professionally designed as a phishing site.</p>
<p>What&#8217;s more, there is nothing tying the domain registration records for trustedidpremier.com to Equifax: The domain is registered to a WHOIS privacy service, which masks information about who really owns the domain (again, not exactly something you might expect from an identity monitoring site). Anyone looking for assurances that the site perhaps was hosted on Internet address space controlled by and assigned to Equifax would also be disappointed: The site is hosted at Amazon.</p>
<p>While there&#8217;s nothing wrong with that exactly, one might reasonably ask: Why didn&#8217;t Equifax just send the email from Equifax.com and host the ID theft monitoring service there as well? Wouldn&#8217;t that have considerably lessened any suspicion that this missive might be a phishing attempt?</p>
<p>Perhaps, but you see while TrustedID is technically owned by Equifax Inc., its services are separate from Equifax and its terms of service are different from those provided by Equifax (almost certainly to separate Equifax from any consumer liability associated with its monitoring service).</p>
<h4>THE BACKSTORY</h4>
<p>What&#8217;s super-interesting about trustedid.com is that it didn&#8217;t always belong to Equifax. According to <a href="https://en.wikipedia.org/wiki/TrustedID" target="_blank">the site&#8217;s Wikipedia page</a>, TrustedID Inc. was purchased by Equifax in 2013, but it was founded in 2004 as an identity protection company which offered a service that let consumers automatically &#8220;freeze&#8221; their credit file at the major bureaus. A freeze prevents Equifax and the other major credit bureaus from selling an individual&#8217;s credit data without first getting consumer consent.</p>
<p>By 2006, some 17 states offered consumers the ability to freeze their credit files, and the credit bureaus were starting to see the freeze as an existential threat to their businesses (in which they make slightly more than a dollar each time a potential creditor &#8212; or ID thief &#8212; asks to peek at your credit file).</p>
<p>Other identity monitoring firms &#8212; such as <strong>LifeLock</strong> &#8212; were by then offering services that automated the placement of identity fraud controls &#8212; such as the &#8220;fraud alert,&#8221; a free service that consumers can request to block creditors from viewing their credit files.</p>
<p>[Author&#8217;s note: Fraud alerts only last for 90 days, although you can renew them as often as you like. More importantly, <em>while lenders and service providers are supposed to seek and obtain your approval before granting credit in your name if you have a fraud alert on your file,</em> <i>they are not legally required to do this — and very often don’t.]</i></p>
<p>Anyway, the era of identity monitoring services automating things like fraud alerts and freezes on behalf of consumers effectively died after a landmark lawsuit filed by big-three bureau <strong>Experian</strong> (<a href="https://krebsonsecurity.com/?s=experian+id+theft&amp;x=0&amp;y=0" target="_blank" rel="noopener">which has its own storied history of data breaches</a>). In 2008, Experian sued <strong>LifeLock, </strong>arguing its practice of automating fraud alerts violated the <a href="https://en.wikipedia.org/wiki/Fair_Credit_Reporting_Act" target="_blank">Fair Credit Reporting Act</a>.</p>
<p>In 2009, a court found in favor of Experian, and that decision effectively killed such services &#8212; mainly because none of the banks wanted to distribute them and sell them as a service anymore.<span id="more-40849"></span></p>
<h4>WHAT SHOULD YOU DO</h4>
<p>These days, consumers in all states have a right to freeze their credit files, and I would strongly encourage all readers to do this. Yes, it can be a pain, and the bureaus certainly seem to be doing everything they can at the moment to make this process extremely difficult and frustrating for consumers. As detailed in the analysis section of last week&#8217;s story &#8212; <a href="https://krebsonsecurity.com/2017/09/equifax-breach-setting-the-record-straight/" target="_blank">Equifax Breach: Setting the Record Straight</a> &#8212; many of the freeze sites are timing out, crashing or telling consumers just to mail in copies of identity documents and printed-out forms.</p>
<p>Other bureaus, like <strong>TransUnion</strong> and Experian, are trying mightily to steer consumers away from a freeze and toward their confusingly named &#8220;<strong>credit lock</strong>&#8221; services &#8212; which claim to be the same thing as freezes only better. The truth is these lock services do not prevent the bureaus from selling your credit reports to anyone who comes asking for them (including ID thieves); and consumers who opt for them over freezes must agree to receive a flood of marketing offers from a myriad of credit bureau industry partners.</p>
<p>While it won&#8217;t stop all forms of identity theft (such as <a href="https://krebsonsecurity.com/?s=tax+refund+fraud&amp;x=0&amp;y=0" target="_blank">tax refund fraud</a> or education loan fraud), a freeze is the option that puts you the consumer in the strongest position to control who gets to monkey with your credit file. In contrast, while credit monitoring services might alert you when someone steals your identity, they&#8217;re not designed to prevent crooks from doing so.</p>
<p>That&#8217;s not to say credit monitoring services aren&#8217;t useful: They can be helpful in recovering from identity theft, which often involves a tedious, lengthy and expensive process for straightening out the phony activity with the bureaus.</p>
<p>The thing is, it&#8217;s almost impossible to sign up for credit monitoring services while a freeze is active on your credit file, so if you&#8217;re interested in signing up for them it&#8217;s best to do so before freezing your credit. But there&#8217;s no need to pay for these services: Hundreds of companies — many of which you have probably transacted with at some point in the last year — have disclosed data breaches and are offering free monitoring. California maintains one of the <a href="https://oag.ca.gov/ecrime/databreach/list" target="_blank">most comprehensive lists</a> of companies that disclosed a breach, and most of those are offering free monitoring.</p>
<p>There&#8217;s a small catch with the freezes: Depending on the state in which you live, the bureaus may each be able to charge you for freezing your file (the fee ranges from $5 to $20); they may also be able to charge you for lifting or temporarily thawing your file in the event you need access to credit. Consumers Union has <a href="http://consumersunion.org/research/consumers-unions-guide-to-security-freeze-protection-2/" target="_blank">a decent rundown</a> of the freeze fees by state.</p>
<p>In short, sign up for whatever free monitoring is available if that&#8217;s of interest, and then freeze your file at the four major bureaus. You can do this online, by phone, or through the mail. Given how unreliable the credit bureau Web sites have been for placing freezes these past few weeks, it may be easiest to do this over the phone. Here are the freeze Web sites and freeze phone numbers for each bureau (note the phone procedures can and likely will change as the bureaus get wise to more consumers learning how to quickly step through their automated voice response systems):</p>
<p><a href="https://www.freeze.equifax.com/Freeze/jsp/SFF_PersonalIDInfo.jsp" target="_blank">Equifax:</a> <strong>866-349-5191; </strong>choose option 3 for a “Security Freeze”</p>
<p><a href="https://www.experian.com/freeze/center.html" target="_blank">Experian</a>: <strong>888-397-3742;</strong><br />
–Press 2 “To learn about fraud or ADD A<br />
SECURITY FREEZE”<br />
–Press 2 “for security freeze options”<br />
–Press 1 “to place a security freeze”<br />
–Press 2 “…for all others”<br />
–enter your info when prompted</p>
<p><a href="https://www.innovis.com/securityFreeze/index" target="_blank">Innovis:</a> <strong>800-540-2505</strong>;<br />
–Press 1 for English<br />
–Press 3 “to place or manage an active duty alert<br />
or a SECURITY FREEZE”<br />
–Press 2 “to place or manage a SECURITY<br />
FREEZE”<br />
–enter your info when prompted</p>
<p><a href="https://freeze.transunion.com" target="_blank">Transunion</a>: <strong>888-909-8872</strong>,<strong> </strong>choose option 3</p>
<p>If you still have questions about freezes, fraud alerts, credit monitoring or anything else related to any of the above, check out the lengthy primer/Q&amp;A I published here on Sept. 11, <a href="https://krebsonsecurity.com/2017/09/the-equifax-breach-what-you-should-know/" target="_blank">The Equifax Breach: What You Should Know</a>.</p>


feed_id: https://krebsonsecurity.com/?p=40828
title: Experian Site Can Give Anyone Your Credit Freeze PIN
uri: Experian-Site-Can-Give-Anyone-Your-Credit-Freeze-PIN
url: https://krebsonsecurity.com/2017/09/experian-site-can-give-anyone-your-credit-freeze-pin/
content:
<p>An alert reader recently pointed my attention to <a href="https://www.experian.com/ncaconline/freezepin" target="_blank">a free online service</a> offered by big-three credit bureau <strong>Experian</strong> that allows anyone to request the personal identification number (PIN) needed to unlock a consumer credit file that was previously frozen at Experian.</p>
<div id="attachment_40829" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40829" src="media/fcf87fff.experianunfreeze-580x511.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/experianunfreeze-580x511.png" alt="Experian's page for retrieving someone's credit freeze PIN requires little more information than has already been leaked by big-three bureau Equifax and a myriad other breaches." width="580" height="511" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/09/experianunfreeze-580x511.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/09/experianunfreeze-768x677.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/09/experianunfreeze-940x828.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/09/experianunfreeze.png 1450w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Experian&#8217;s page for retrieving someone&#8217;s credit freeze PIN requires little more information than has already been leaked by big-three bureau Equifax and a myriad other breaches.</p></div>
<p>The first hurdle for instantly revealing anyone&#8217;s freeze PIN is to provide the person&#8217;s name, address, date of birth and Social Security number (all data that has been jeopardized in breaches 100 times over &#8212; including in <a href="https://krebsonsecurity.com/?s=equifax+breach&amp;x=0&amp;y=0" target="_blank">the recent Equifax breac</a>h &#8212; and that is broadly for sale in the cybercrime underground).</p>
<p>After that, one just needs to input an email address to receive the PIN and swear that the information is true and belongs to the submitter. I&#8217;m certain this warning would deter all but the bravest of identity thieves!</p>
<p>The final authorization check is that Experian asks you to answer four so-called &#8220;knowledge-based authentication&#8221; or KBA questions. As I have noted in countless stories published here previously, the problem with relying on KBA questions to authenticate consumers online is that so much of the information needed to successfully guess the answers to those multiple-choice questions is now indexed or exposed by search engines, social networks and third-party services online — both criminal and commercial.</p>
<p>What’s more, many of the companies that provide and resell these types of KBA challenge/response questions <a href="https://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/" target="_blank">have been hacked in the past</a> by criminals that run their own identity theft services.</p>
<p>“Whenever I’m faced with KBA-type questions I find that database tools like Spokeo, Zillow, etc are my friend because they are more likely to know the answers for me than I am,” said <strong>Nicholas Weaver</strong>, a senior researcher in networking and security for the <a href="https://www.icsi.berkeley.edu/icsi/people/nweaver" target="_blank">International Computer Science Institute</a> (ICSI).</p>
<p>The above quote from Mr. Weaver came in <a href="https://krebsonsecurity.com/2017/05/fraudsters-exploited-lax-security-at-equifaxs-talx-payroll-division/" target="_blank">a story from May 2017</a> which looked at how identity thieves were able to steal financial and personal data for over a year from <a href="https://en.wikipedia.org/wiki/Talx" target="_blank">TALX</a>, an Equifax subsidiary that provides online payroll, HR and tax services. Equifax says crooks were able to reset the 4-digit PIN given to customer employees as a password and then steal W-2 tax data after successfully answering KBA questions about those employees.</p>
<p>In short: Crooks and identity thieves broadly have access to the data needed to reliably answer KBA questions on most consumers. That is why this offering from Experian completely undermines the entire point of placing a freeze. <span id="more-40828"></span></p>
<p>After discovering this portal at Experian, I tried to get my PIN, but the system failed and told me to submit the request via mail. That&#8217;s fine and as far as I&#8217;m concerned the way it should be. However, I also asked my followers on Twitter who have freezes in place at Experian to test it themselves. More than a dozen readers responded in just a few minutes, and most of them reported success at retrieving their PINs on the site and via email after answering the KBA questions.</p>
<p>Here&#8217;s a sample of the KBA questions the site asked one reader:</p>
<blockquote>
<div id=":1cq.ma" class="Mu SP" data-tooltip="September 21, 2017 at 10:11:59 AM UTC-4"><span id=":1cq.co" class="tL8wMe EMoHub" dir="ltr">1. Please select the city that you have previously resided in.</span></div>
<div id=":1cr.ma" class="Mu SP" data-tooltip="September 21, 2017 at 10:12:08 AM UTC-4">
<div id=":1cr.at" class="xH"></div>
<p><span id=":1cr.co" class="tL8wMe EMoHub" dir="ltr">2. According to our records, you previously lived on (XXTH). Please choose the city from the following list where this street is located.</span></p>
</div>
<div id=":1cs.ma" class="Mu SP" data-tooltip="September 21, 2017 at 10:12:14 AM UTC-4">
<div id=":1cs.at" class="xH"></div>
<p><span id=":1cs.co" class="tL8wMe EMoHub" dir="ltr">3. Which of the following people live or previously lived with you at the address you provided?</span></p>
</div>
<div id=":1ct.ma" class="Mu SP" data-tooltip="September 21, 2017 at 10:12:19 AM UTC-4">
<div id=":1ct.at" class="xH"></div>
<p><span id=":1ct.co" class="tL8wMe EMoHub" dir="ltr">4. Please select the model year of the vehicle you purchased or leased prior to July 2017 .</span></p>
</div>
</blockquote>
<div id="attachment_40832" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40832" src="media/96c12016.experianheresyourpin-580x265.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/experianheresyourpin-580x265.png" alt="Experian will display the freeze PIN on its site, and offer to send it to an email address of your choice. " width="580" height="265" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/09/experianheresyourpin-580x265.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/09/experianheresyourpin-768x351.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/09/experianheresyourpin-940x430.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/09/experianheresyourpin.png 1034w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Experian will display the freeze PIN on its site, and offer to send it to an email address of your choice. Image: Rob Jacques.</p></div>
<p>I understand if people who place freezes on their credit files are prone to misplacing the PIN provided by the bureaus that is needed to unlock or thaw a freeze. This is human nature, and the bureaus should absolutely have a reliable process to recover this PIN. However, the information should be sent via snail mail to the address on the credit record, <em>not via email to any old email address.</em></p>
<p>This is yet another example of how someone or some entity other than the credit bureaus needs to be in put in charge of rethinking and rebuilding the process by which consumers apply for and manage credit freezes. I addressed some of these issues &#8212; as well as other abuses by the credit reporting bureaus &#8212; in the second half of <a href="https://krebsonsecurity.com/2017/09/equifax-breach-setting-the-record-straight/" target="_blank">a long story published Wednesday evening</a>.</p>
<p>Experian has not yet responded to requests for comment.</p>
<p>While this service is disappointing, I stand by my recommendation that everyone should place a freeze on their credit files. I published <a href="https://krebsonsecurity.com/2017/09/the-equifax-breach-what-you-should-know/" target="_blank">a detailed Q&amp;A</a> a few days ago about why this is so important and how you can do it. For those wondering about whether it&#8217;s possible and advisable to do this for their kids or dependents, check out <a href="https://krebsonsecurity.com/2016/01/the-lowdown-on-freezing-your-kids-credit/" target="_blank">The Lowdown on Freezing Your Kid&#8217;s Credit</a>.</p>


feed_id: https://krebsonsecurity.com/?p=40806
title: Equifax Breach: Setting the Record Straight
uri: Equifax-Breach-Setting-the-Record-Straight
url: https://krebsonsecurity.com/2017/09/equifax-breach-setting-the-record-straight/
content:
<p><strong>Bloomberg</strong> published a story this week citing three unnamed sources who told the publication that Equifax experienced a breach earlier this year which predated the intrusion that the big-three credit bureau announced on Sept. 7. To be clear, this earlier breach at Equifax is not a new finding and has been a matter of public record for months. Furthermore, it was first reported on this Web site in May 2017.</p>
<p><img class="alignright size-full wp-image-40756" src="media/5b90239d.equihax.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/equihax.png" alt="equihax" width="249" height="232" />In <a href="https://krebsonsecurity.com/2017/09/breach-at-equifax-may-impact-143m-americans/" target="_blank">my initial Sept. 7 story</a> about the Equifax breach affecting more than 140 million Americans, I noted that this was hardly the first time Equifax or another major credit bureau has experienced a breach impacting a significant number of Americans.</p>
<p>On May 17, KrebsOnSecurity reported that fraudsters <a href="https://krebsonsecurity.com/2017/05/fraudsters-exploited-lax-security-at-equifaxs-talx-payroll-division/" target="_blank">exploited lax security at Equifax’s TALX payroll division</a>, which provides online payroll, HR and tax services.</p>
<p>That story was about how Equifax&#8217;s TALX division let customers who use the firm&#8217;s payroll management services authenticate to the service with little more than a 4-digit personal identification number (PIN).</p>
<p>Identity thieves who specialize in perpetrating tax refund fraud figured out that they could reset the PINs of payroll managers at various companies just by answering some multiple-guess questions &#8212; known as &#8220;knowledge-based authentication&#8221; or KBA questions &#8212; such as previous addresses and dates that past home or car loans were granted.</p>
<p>On Tuesday, Sept. 18, Bloomberg <a href="https://www.bloomberg.com/news/articles/2017-09-18/equifax-is-said-to-suffer-a-hack-earlier-than-the-date-disclosed" target="_blank">ran a piece</a> with reporting from no fewer than five journalists there who relied on information provided by three anonymous sources. Those sources reportedly spoke in broad terms about an earlier breach at Equifax, and told the publication that these two incidents were thought to have been perpetrated by the same group of hackers.</p>
<p>The Bloomberg story did not name TALX. Only post-publication did Bloomberg reporters update the piece to include a statement from Equifax saying the breach was unrelated to the hack announced on Sept. 7, and that it had to do with a security incident involving a payroll-related service during the 2016 tax year.</p>
<p>I have thus far seen zero evidence that these two incidents are related. Equifax has said the unauthorized access to customers’ employee tax records (we&#8217;ll call this &#8220;the March breach&#8221; from here on) happened between April 17, 2016 and March 29, 2017.</p>
<p>The criminals responsible for unauthorized activity in the March breach were participating in an insidious but common form of cybercrime known as <a href="https://krebsonsecurity.com/?s=tax+refund+fraud&amp;x=0&amp;y=0" target="_blank">tax refund fraud</a>, which involves filing phony tax refund requests with the IRS and state tax authorities using the personal information from identity theft victims.</p>
<p>My original report on the March breach was based on public breach disclosures that Equifax was required by law to file with several state attorneys general.</p>
<p>Because the TALX incident exposed the tax and payroll records of its customers&#8217; employees, the victim customers were in turn required to notify their employees as well. That story referenced public breach disclosures from five companies that used TALX, including defense contractor giant <a href="https://oag.ca.gov/system/files/Northrop%20Grumman%20Individual%20Notification%20Letter_64772036_1_0.PDF?" target="_blank">Northrop Grumman</a>; staffing firm <a href="media/4566aa18.itu-281065.pdf" data-original-source="http://www.marylandattorneygeneral.gov/ID%20Theft%20Breach%20Notices/2017/itu-281065.pdf" target="_blank">Allegis Group</a>; <a href="media/353f8a77.saint-gobain-20170413.pdf" data-original-source="http://www.doj.nh.gov/consumer/security-breaches/documents/saint-gobain-20170413.pdf" target="_blank">Saint-Gobain Corp</a>.; <a href="media/16933e6d.talx-20170515.pdf" data-original-source="http://www.doj.nh.gov/consumer/security-breaches/documents/talx-20170515.pdf" target="_blank">Erickson Living</a>; and the <a href="http://www.louisvillecardinal.com/2017/04/hackers-steal-university-employee-tax-info/" target="_blank">University of Louisville</a>.</p>
<p>When asked Tuesday about previous media coverage of the March breach, <a href="http://www.npr.org/sections/thetwo-way/2017/09/19/552124551/equifax-confirms-another-security-incident" target="_blank">Equifax pointed National Public Radio</a> (NPR) to <a href="https://krebsonsecurity.com/2017/05/fraudsters-exploited-lax-security-at-equifaxs-talx-payroll-division/" rel="noreferrer" data-ss1505960200="1">coverage in KrebsonSecurity</a>.</p>
<p>One more thing before I move on to the analysis. For more information on why KBA is a woefully ineffective method of stopping fraudsters, see <a href="https://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/" target="_blank">this story from 2013</a> about how some of the biggest vendors of these KBA questions were all hacked by criminals running an identity theft service online.</p>
<p>Or, check out <a href="https://krebsonsecurity.com/?s=irs+get+transcript&amp;x=0&amp;y=0" target="_blank">these stories</a> about how tax refund fraudsters used weak KBA questions to steal personal data on hundreds of thousands of taxpayers directly from the <strong>Internal Revenue Service</strong>&#8216;s own Web site. It&#8217;s probably worth mentioning that Equifax provided those KBA questions as well.</p>
<h4>ANALYSIS</h4>
<p>Over the past two weeks, KrebsOnSecurity has received an unusually large number of inquiries from reporters at major publications who were seeking background interviews so that they could get up to speed on Equifax&#8217;s spotty security history (sadly, Bloomberg was not among them).</p>
<p>These informational interviews &#8212; in which I agree to provide context and am asked to speak mainly on background &#8212; are not unusual; I sometimes field two or three of these requests a month, and very often more when time permits. And for the most part I am always happy to help fellow journalists make sure they get the facts straight before publishing them.</p>
<p>But I do find it slightly disturbing that there appear to be so many reporters on the tech and security beats who apparently lack basic knowledge about what these companies do and their roles in perpetuating &#8212; not fighting &#8212; identity theft.</p>
<p>It seems to me that some of the world&#8217;s most influential publications have for too long given Equifax and the rest of the credit reporting industry a free pass &#8212; perhaps because of the complexities involved in succinctly explaining the issues to consumers. Indeed, I would argue the mainstream media has largely failed to hold these companies&#8217; feet to the fire over a pattern of lax security and a complete disregard for securing the very sensitive consumer data that drives their core businesses.</p>
<p>To be sure, Equifax has dug themselves into a giant public relations hole, and they just keep right on digging. On Sept. 8, I <a href="https://krebsonsecurity.com/2017/09/equifax-breach-response-turns-dumpster-fire/" target="_blank">published a story equating Equifax&#8217;s breach response to a dumpster fire</a>, noting that it could hardly have been more haphazard and ill-conceived.</p>
<p>But I couldn&#8217;t have been more wrong. Since then, Equifax&#8217;s response to this incident has been even more astonishingly poor.</p>
<h4>EQUIPHISH</h4>
<p>On Tuesday, the official Equifax account on Twitter replied to a tweet requesting the Web address of the site that the company set up to give away its free one-year of credit monitoring service. That site is https://www.equifaxsecurity2017.com, but the company&#8217;s Twitter account told users to instead visit securityequifax2017[dot]com, which is currently blocked by multiple browsers as a phishing site.</p>
<p><img class="aligncenter size-medium wp-image-40815" src="media/7705ae24.equiphish-580x240.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/equiphish-580x240.png" alt="equiphish" width="580" height="240" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/09/equiphish-580x240.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/09/equiphish-768x317.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/09/equiphish-940x388.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/09/equiphish.png 1264w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p><span id="more-40806"></span></p>
<h4>FREEZING UP</h4>
<p>Under intense public pressure from federal lawmakers and regulators, Equifax said that for 30 days it would waive the fee it charges for placing a security freeze on one&#8217;s credit file (for more on what a security freeze entails and why you and your family should be freezing their files, please see <a href="https://krebsonsecurity.com/2017/09/the-equifax-breach-what-you-should-know/" target="_blank">The Equifax Breach: What You Should Know</a>).</p>
<p>Unfortunately, the free freeze offer from Equifax doesn&#8217;t mean much if consumers can&#8217;t actually request one via <a href="https://www.freeze.equifax.com/Freeze/jsp/SFF_PersonalIDInfo.jsp" target="_blank">the company&#8217;s freeze page</a>; I have lost count of how many comments have been left here by readers over the past week complaining of being unable to load the site, let alone successfully obtain a freeze. Instead, consumers have been told to submit the requests and freeze fees in writing and to include copies of identity documents to validate the requests.</p>
<p><strong>Sen. Elizabeth Warren</strong> (D-Mass) recently <a href="https://www.cnbc.com/2017/09/15/senator-warren-introduces-equifax-bill-launches-industry-probe.html" target="_blank">introduced a measure</a> that would force the bureaus to eliminate the freeze fees and to streamline the entire process. To my mind, that bill could not get passed soon enough.</p>
<p>Understand that each credit bureau has a legal right to charge up to $20 in some states to freeze a credit file, and in many states they are allowed to charge additional fees if consumers later wish to lift or temporarily thaw a freeze. This is especially rich given that credit bureaus earn roughly $1 every time a potential creditor (or identity thief) inquires about your creditworthiness, according to <strong>Avivah Litan</strong>, a fraud analyst with <strong>Gartner Inc</strong>.</p>
<p>In light of this, it&#8217;s difficult to view these freeze fees as anything other than a bid to discourage consumers from filing them.</p>
<p>The Web sites where consumers can go to file freezes at the other major bureaus &#8212; including <a href="https://freeze.transunion.com/sf/securityFreeze/landingPage.jsp" target="_blank">TransUnion</a> and <a href="https://www.experian.com/ncaconline/freeze" target="_blank">Experian</a> &#8212; have hardly fared any better since Equifax announced the breach on Sept. 7. Currently, if you attempt to freeze your credit file at TransUnion, the company&#8217;s site is relentless in trying to steer you away from a freeze and toward the company&#8217;s free &#8220;credit lock&#8221; service.</p>
<p>That service, called <strong>TrueIdentity</strong>, claims to allow consumers to lock or unlock their credit files for free as often as they like with the touch of a button. But readers who take the bait probably won&#8217;t notice or read the terms of service for TrueIdentity, which has the consumer agree to a class action waiver, a mandatory arbitration clause, and something called &#8216;targeted marketing&#8217; from TransUnion and their myriad partners.</p>
<p>The agreement also states TransUnion may share the data with other companies:</p>
<blockquote><p>&#8220;If you indicated to us when you registered, placed an order or updated your account that you were interested in receiving information about products and services provided by TransUnion Interactive and its marketing partners, or if you opted for the free membership option, your name and email address may be shared with a third party in order to present these offers to you. These entities are only allowed to use shared information for the intended purpose only and will be monitored in accordance with our security and confidentiality policies. In the event you indicate that you want to receive offers from TransUnion Interactive and its marketing partners, your information may be used to serve relevant ads to you when you visit the site and to send you targeted offers.  <strong>For the avoidance of doubt, you understand that in order to receive the free membership, you must agree to receive targeted offers.</strong>&#8220;</p></blockquote>
<p>TransUnion then encourages consumers who are persuaded to use the &#8220;free&#8221; service to subscribe to &#8220;premium&#8221; services for a monthly fee with a perpetual auto-renewal.</p>
<p>In short, TransUnion&#8217;s credit lock service (and a similarly named service from Experian) doesn&#8217;t prevent potential creditors from accessing your files, and these dubious services allow the credit bureaus to keep selling your credit history to lenders (or identity thieves) as they see fit.</p>
<p>As I wrote in <a href="https://krebsonsecurity.com/2017/09/the-equifax-breach-what-you-should-know/" target="_blank">a Sept. 11 Q&amp;A about the Equifax breach</a>, I take strong exception to the credit bureaus’ increasing use of the term “credit lock” to divert people away from freezes. Their motives for saddling consumers with even more confusing terminology are suspect, and I would not count on a credit lock to take the place of a credit freeze, regardless of what these companies claim (consider the source).</p>
<p>Experian&#8217;s freeze Web site has performed little better since Sept. 7. Several readers pinged KrebsOnSecurity via email and Twitter to complain that while Experian&#8217;s freeze site repeatedly returned error messages stating that the freeze did not go through, <em>these readers&#8217; credit cards were nonetheless charged $15 freeze fees multiple times.</em></p>
<p>If the above facts are not enough to make your blood boil, consider that Equifax and other bureaus have been lobbying lawmakers in Congress to pass legislation that would <a href="https://medium.com/@NACAdvocate/georgia-congressman-must-withdraw-his-anti-consumer-equifax-friendly-bill-eddbb827b668" target="_blank">dramatically limit the ability of consumers to sue credit bureaus for sloppy security</a>, and cap damages in related class action lawsuits to $500,000.</p>
<p>If ever there was an industry that deserved obsolescence or at least more regulation, it is the credit bureaus. If either of those outcomes are to become reality, it is going to take much more attentive and relentless coverage on the part of the world&#8217;s top news publications. That&#8217;s because there&#8217;s a lot at stake here for an industry that lobbies heavily (and successfully) against any new laws that may restrict their businesses.</p>
<p>Here&#8217;s hoping the media can get up to speed quickly on this vitally important topic, and help lead the debate over legal and regulatory changes that are sorely needed.</p>


feed_id: https://krebsonsecurity.com/?p=40773
title: Equifax Hackers Stole 200k Credit Card Accounts in One Fell Swoop
uri: Equifax-Hackers-Stole-200k-Credit-Card-Accounts-in-One-Fell-Swoop
url:
https://krebsonsecurity.com/2017/09/equifax-hackers-stole-200k-credit-card-accounts-in-one-fell-swoop/

content:
<p><strong>Visa</strong> and <strong>MasterCard</strong> are sending confidential alerts to financial institutions across the United States this week, warning them about more than 200,000 credit cards that were stolen in the epic data breach announced last week at big-three credit bureau <strong>Equifax</strong>. At first glance, the private notices obtained by KrebsOnSecurity appear to suggest that hackers initially breached Equifax starting in November 2016. But Equifax says the accounts were all stolen at the same time &#8212; when hackers accessed the company&#8217;s systems in mid-May 2017.</p>
<p><img class="aligncenter size-medium wp-image-40776" src="media/6d78b046.equifax-hq-580x384.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/09/equifax-hq-580x384.png" alt="equifax-hq" width="580" height="384" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/09/equifax-hq-580x384.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/09/equifax-hq-768x509.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/09/equifax-hq.png 770w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>Both Visa and MasterCard frequently send alerts to card-issuing financial institutions with information about specific credit and debit cards that may have been compromised in a recent breach. But it is unusual for these alerts to state from which company the accounts were thought to have been pilfered.</p>
<p>In this case, however, Visa and MasterCard were unambiguous, referring to Equifax specifically as the source of an e-commerce card breach.</p>
<p>In a non-public alert sent this week to sources at multiple banks, Visa said the &#8220;window of exposure&#8221; for the cards stolen in the Equifax breach was between Nov. 10, 2016 and July 6, 2017. A similar alert from MasterCard included the same date range.</p>
<p>&#8220;The investigation is ongoing and this information may be amended as new details arise,&#8221; Visa said in its confidential alert, linking to the press release Equifax initially posted about the breach on Sept. 7, 2017.</p>
<p>The card giant said the data elements stolen included card account number, expiration date, and the cardholder&#8217;s name. Fraudsters can use this information to conduct e-commerce fraud at online merchants.</p>
<p>It would be tempting to conclude from these alerts that the card breach at Equifax dates back to November 2016, and that perhaps the intruders then managed to install software capable of capturing customer credit card data in real-time as it was entered on one of Equifax&#8217;s Web sites.</p>
<p>Indeed, that was my initial hunch in deciding to report out this story. But according to a statement from Equifax, the hacker(s) downloaded the data in one fell swoop in mid-May 2017.</p>
<p>“The attacker accessed a storage table that contained historical credit card transaction related information,&#8221; the company said. &#8220;The dates that you provided in your e-mail appear to be the transaction dates. We have found no evidence during our investigation to indicate the presence of card harvesting malware, or access to the table before mid-May 2017.”<span id="more-40773"></span></p>
<p>Equifax did not respond to questions about how it was storing credit card data, or why only card data collected from customers after November 2016 was stolen.</p>
<p>In its <a href="https://investor.equifax.com/news-and-events/news/2017/09-07-2017-213000628" target="_blank">initial breach disclosure</a> on Sept. 7, Equifax said it discovered the intrusion on July 29, 2017. The company said the hackers broke in through a vulnerability in the software that powers some of its Web-facing applications.</p>
<p>In <a href="https://www.equifaxsecurity2017.com/" target="_blank">an update to its breach disclosure</a> published Wednesday evening, Equifax confirmed reports that the application flaw in question was a weakness disclosed in March 2017 in a popular open-source software package called <strong>Apache Struts </strong>(<a href="https://nvd.nist.gov/vuln/detail/CVE-2017-5638" target="_blank">CVE-2017-5638</a>)<strong>. </strong></p>
<p>&#8220;Equifax has been intensely investigating the scope of the intrusion with the assistance of a leading, independent cybersecurity firm to determine what information was accessed and who has been impacted,&#8221; the company wrote. &#8220;We know that criminals exploited a U.S. website application vulnerability. The vulnerability was Apache Struts CVE-2017-5638. We continue to work with law enforcement as part of our criminal investigation, and have shared indicators of compromise with law enforcement.&#8221;</p>
<p>The Apache flaw was <a href="http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html" target="_blank">first spotted around March 7, 2017</a>, when security firms began warning that attackers were actively exploiting a &#8220;zero-day&#8221; vulnerability in Apache Struts. Zero-days refer to software or hardware flaws that hackers find and figure out how to use for commercial or personal gain before the vendor even knows about the bugs.</p>
<p>By March 8, Apache had released new versions of the software to mitigate the vulnerability. But by that time exploit code that would allow anyone to take advantage of the flaw was already published online &#8212; making it a race between companies needing to patch their Web servers and hackers trying to exploit the hole before it was closed.</p>
<p>Screen shots apparently taken on March 10, 2017 and later posted to the vulnerability tracking site xss[dot]cx indicate that the Apache Struts vulnerability <a href="http://xss.cx/2017/03/12/txt/cve-2017-5638-annualcreditreportcom-exploit-poc-content-type-http-header-example.html" target="_blank">was present at the time on annualcreditreport.com</a> &#8212; the only web site mandated by Congress where all Americans can go to obtain a free copy of their credit reports from each of the three major bureaus annually.</p>
<p>In <a href="http://xss.cx/2017/03/12/txt/cve-2017-5638-consumerexperianin-exploit-poc-content-type-http-header-example.html" target="_blank">another screen shot</a> apparently made that same day and uploaded to xss[dot]cx, we can see evidence that the Apache Struts flaw also was present in Experian&#8217;s Web properties.</p>
<p>Equifax has said the unauthorized access occurred from mid-May through July 2017, suggesting either that the company&#8217;s Web applications were still unpatched in mid-May or that the attackers broke in earlier but did not immediately abuse their access.</p>
<p>It remains unclear when exactly Equifax managed to fully eliminate the Apache Struts flaw from their various Web server applications. But one thing we do know for sure: The hacker(s) got in before Equifax closed the hole, and their presence wasn&#8217;t discovered until July 29, 2017.</p>
<p><strong>Update, Sept. 15, 12:31 p.m. ET:</strong> Visa has updated their advisory about these 200,000+ credit cards stolen in the Equifax breach. Visa now says it believes the records also included the cardholder&#8217;s Social Security number and address, suggesting that (ironically enough) the accounts were stolen from people who were signing up for credit monitoring services through Equifax.</p>
<p>Equifax also clarified the breach timeline to note that it patched the Apache Struts flaw in its Web applications only after taking the hacked system(s) offline on July 30, 2017. Which means Equifax left its systems unpatched for more than four months after a patch (and exploit code to attack the flaw) was publicly available.</p>


feed_id: https://krebsonsecurity.com/?p=41189
title: What You Should Know About the ‘KRACK’ WiFi Security Weakness
uri: What-You-Should-Know-About-the-KRACK-WiFi-Security-Weakness
url: https://krebsonsecurity.com/2017/10/what-you-should-know-about-the-krack-wifi-security-weakness/
content:
<p>Researchers this week published information about a newfound, serious weakness in <strong>WPA2</strong> &#8212; the security standard that protects all modern Wi-Fi networks. What follows is a short rundown on what exactly is at stake here, who&#8217;s most at-risk from this vulnerability, and what organizations and individuals can do about it.</p>
<p><img class="alignright size-medium wp-image-3361" src="media/7f9e637c.wifi-289x300.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2010/06/wifi-289x300.jpg" alt="wifi" width="289" height="300" /></p>
<p>Short for <strong>Wi-Fi Protected Access II</strong>, WPA2 is the security protocol used by most wireless networks today. Researchers have discovered and published a flaw in WPA2 that allows anyone to break this security model and steal data flowing between your wireless device and the targeted Wi-Fi network, such as passwords, chat messages and photos.</p>
<p>&#8220;The attack works against all modern protected Wi-Fi networks,&#8221; the researchers <a href="https://www.krackattacks.com/" target="_blank">wrote of their exploit</a> dubbed &#8220;KRACK,&#8221; short for &#8220;Key Reinstallation AttaCK.&#8221;</p>
<p>&#8220;Depending on the network configuration, it is also possible to inject and manipulate data,&#8221; the researchers continued. &#8220;For example, an attacker might be able to inject ransomware or other malware into websites. The weaknesses are in the Wi-Fi standard itself, and not in individual products or implementations. Therefore, any correct implementation of WPA2 is likely affected.&#8221;</p>
<p>What that means is the vulnerability potentially impacts a wide range of devices including those running operating systems from Android, Apple, Linux, OpenBSD and Windows.</p>
<p>As scary as this attack sounds, there are several mitigating factors at work here. First off, this is not an attack that can be pulled off remotely: An attacker would have to be within range of the wireless signal between your device and a nearby wireless access point.</p>
<p>More importantly, most sensitive communications that might be intercepted these days, such as interactions with your financial institution or browsing email, are likely already protected end-to-end with <strong>Secure Sockets Layer</strong> (SSL) encryption that is separate from any encryption added by WPA2 &#8212; i.e., any connection in your browser that starts with &#8220;https://&#8221;.</p>
<p>Also, the public announcement about this security weakness was held for weeks in order to give Wi-Fi hardware vendors a chance to produce security updates. The <strong>Computer Emergency Readiness Team</strong> has <a href="http://www.kb.cert.org/vuls/byvendor?searchview&amp;Query=FIELD+Reference=228519&amp;SearchOrder=4" target="_blank">a running list of hardware vendors</a> that are known to be affected by this, as well as links to available advisories and patches.</p>
<p>&#8220;There is no evidence that the vulnerability has been exploited maliciously, and <strong>Wi-Fi Alliance</strong> has taken immediate steps to ensure users can continue to count on Wi-Fi to deliver strong security protections,&#8221; reads <a href="https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-security-update" target="_blank">a statement</a> published today by a Wi-Fi industry trade group. &#8220;This issue can be resolved through straightforward software updates, and the Wi-Fi industry, including major platform providers, has already started deploying patches to Wi-Fi users. Users can expect all their Wi-Fi devices, whether patched or unpatched, to continue working well together.&#8221;</p>
<p>Sounds great, but in practice a great many products on the CERT list are currently designated &#8220;unknown&#8221; as to whether they are vulnerable to this flaw. I would expect this list to be updated in the coming days and weeks as more information comes in.</p>
<p>Some readers have asked if MAC address filtering will protect against this attack. Every network-capable device has a hard-coded, unique &#8220;media access control&#8221; or MAC address, and most Wi-Fi routers have a feature that lets you only allow access to your network for specified MAC addresses.</p>
<p>However, because this attack compromises the WPA2 protocol that both your wireless devices and wireless access point use, MAC filtering is not a particularly effective deterrent against this attack. Also, MAC addresses can be spoofed fairly easily.</p>
<p>To my mind, those most at risk from this vulnerability are organizations that have not done a good job separating their wireless networks from their enterprise, wired networks.<span id="more-41189"></span></p>
<p>I don&#8217;t see this becoming a major threat to most users unless and until we start seeing the availability of easy-to-use attack tools to exploit this flaw. Those tools may emerge sooner rather than later, so if you&#8217;re super concerned about this attack and updates are not yet available for your devices, perhaps the best approach in the short run is to connect any devices on your network to the router via an ethernet cable (assuming your device still has an ethernet port).</p>
<p>From reading the advisory on this flaw, it appears that the most recent versions of Windows and Apple&#8217;s iOS are either not vulnerable to this flaw or are only exposed in very specific circumstances. Android devices, on the other hand, are likely going to need some patching, and soon.</p>
<p>If you discover from browsing <a href="http://www.kb.cert.org/vuls/id/228519" target="_blank">the CERT advisory</a> that there is an update available or your computer, wireless device or access point, take care to read and understand the instructions on updating those devices before you update. Failing to do so with a wireless access point, for example can quickly leave you with an expensive, oversized paperweight.</p>
<p>Finally, consider browsing the Web with an extension or browser add-on like <a href="https://www.eff.org/https-everywhere" target="_blank">HTTPS Everywhere</a>, which forces any site that supports https:// connections to encrypt your communications with the Web site &#8212; regardless of whether this is the default for that site.</p>
<p>For those interested in a deeper dive on the technical details of this attack, check out <a href="media/0529015a.ccs2017.pdf" data-original-source="https://papers.mathyvanhoef.com/ccs2017.pdf" target="_blank">the paper</a> (PDF) released by the researchers who discovered the bug.</p>


feed_id: https://krebsonsecurity.com/?p=41172
title: Krebs Given ISSA’s ‘President’s Award’
uri: Krebs-Given-ISSA-s-President-s-Award
url: https://krebsonsecurity.com/2017/10/krebs-given-issas-presidents-award/
content:
<p>KrebsOnSecurity was honored this month with the <strong>2017 President&#8217;s Award for Public Service</strong> from the <strong>Information Systems Security Association</strong>, a nonprofit organization for cybersecurity professionals. The award recognizes an individual&#8217;s contribution to the information security profession in the area of public service.</p>
<p><img class="alignright size-full wp-image-41178" src="media/3998c2c5.issalogo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/issalogo.png" alt="issalogo" width="316" height="79" /></p>
<p>It&#8217;s hugely gratifying to have received this award, mainly because of the company I now keep.</p>
<p>Past ISSA President&#8217;s Award winners include former White House cybersecurity advisers <a href="https://en.wikipedia.org/wiki/Richard_A._Clarke" target="_blank" rel="noopener">Richard A. Clarke</a> (2003) and the late <a href="https://en.wikipedia.org/wiki/Howard_Schmidt" target="_blank" rel="noopener">Howard Schmidt</a> (2016); <a href="https://www.defcon.org/html/defcon-25/dc-25-index.html" target="_blank">DEF CON</a> and <a href="https://en.wikipedia.org/wiki/Black_Hat_Briefings" target="_blank">Black Hat</a> founder <a href="https://en.wikipedia.org/wiki/Jeff_Moss_(hacker)" target="_blank" rel="noopener">Jeff Moss</a> (2011); <a href="http://www.hackingexposed.com/" target="_blank"><em>Hacking Exposed</em></a> authors <a href="https://www.linkedin.com/in/georgekurtz/" target="_blank" rel="noopener">George Kurtz</a>, <a href="https://www.linkedin.com/in/mcclurestuart/" target="_blank">Stuart McClure</a> and <a href="https://www.linkedin.com/in/joelscambray/" target="_blank">Joel Scambray</a> (2015); as well as <a href="https://www.linkedin.com/in/liamomurchu/" target="_blank">Liam O&#8217;Murchu</a>, <a href="https://www.linkedin.com/in/eric-chien-66b4b258/" target="_blank">Eric Chien</a>, and <a href="https://www.linkedin.com/in/nfalliere/" target="_blank">Nicolas Falliere</a>, the team at <strong>Symantec</strong> credited for their groundbreaking analysis of the <a href="https://en.wikipedia.org/wiki/Stuxnet" target="_blank" rel="noopener">Stuxnet Worm</a> (2012).</p>
<p>&#8220;[Krebs&#8217;] analysis of the bad actors and the dark web shines a light on the criminals and their methods that attack information security,&#8221; the ISSA said in explaining the award. &#8220;The information that he exposes to the light of day makes the jobs of white hats and blue teamers easier.&#8221;</p>
<p>I&#8217;m very grateful to the ISSA for this award, and wish a hearty congratulations to <a href="http://www.issa.org/?page=Awards" target="_blank">the other ISSA 2017 award recipients</a>.</p>


feed_id: https://krebsonsecurity.com/?p=41153
title: Equifax Credit Assistance Site Served Spyware
uri: Equifax-Credit-Assistance-Site-Served-Spyware
url: https://krebsonsecurity.com/2017/10/equifax-credit-assistance-site-served-spyware/
content:
<p>Big-three consumer credit bureau <strong>Equifax</strong> says it has removed third-party code from its credit report assistance Web site that prompted visitors to download spyware disguised as an update for <strong>Adobe&#8217;s Flash Player</strong> software.</p>
<div id="attachment_41154" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-41154" src="media/0122c1e8.eq-flash-adware-580x271.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/eq-flash-adware-580x271.png" alt="Image: Randy-abrams.blogspot.com" width="580" height="271" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/10/eq-flash-adware-580x271.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/10/eq-flash-adware-768x359.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/10/eq-flash-adware-940x440.png 940w, https://krebsonsecurity.com/wp-content/uploads/2017/10/eq-flash-adware.png 987w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Image: Randy-abrams.blogspot.com</p></div>
<p>On Wednesday, security expert and blogger <strong>Randy Abrams</strong> <a href="https://randy-abrams.blogspot.com/2017/10/new-equifax-website-compromise.html" target="_blank">documented</a> how browsing a page at Equifax&#8217;s <a href="http://www.equifax.com/CreditReportAssistance/?/CreditReportAssistance" target="_blank">consumer information services portal</a> caused his browser to be served with a message urging him to download Adobe Flash Player.</p>
<p>&#8220;As I tried to find my credit report on the Equifax website I clicked on an Equifax link and was redirected to a malicious URL,&#8221; Abrahms wrote. &#8220;The URL brought up one of the ubiquitous fake Flash Player Update screens. &#8221;</p>
<p>Ars Technica&#8217;s <strong>Dan Goodin</strong> was the first <a href="https://arstechnica.com/information-technology/2017/10/equifax-website-hacked-again-this-time-to-redirect-to-fake-flash-update/" target="_blank">to cover the discovery</a>, and said the phony Flash Player installer was detected by several antivirus tools as &#8220;<a href="https://blog.malwarebytes.com/puppum/2016/08/pup-friday-adware-family-eorezo/" target="_blank">Adware.Eorezo</a>,&#8221; an intrusive program that displays advertisements in Internet Explorer and may install browser toolbars and other unwanted programs.</p>
<p>Several hours after Goodin&#8217;s piece went live, Equifax disabled the page in question, saying it was doing so out of &#8220;an abundance of caution&#8221; while it investigated the claims.</p>
<p>In a follow-up statement shared with KrebsOnSecurity this afternoon, however, Equifax said the problem stemmed from a &#8220;third-party vendor that Equifax uses to collect website performance data,&#8221; and that &#8220;the vendor&#8217;s code running on an Equifax Web site was serving malicious content.&#8221; Equifax did not say who the third party vendor was.<span id="more-41153"></span></p>
<p>&#8220;Since we learned of the issue, the vendor&#8217;s code was removed from the webpage and we have taken the webpage offline to conduct further analysis,&#8221; reads the statement. &#8220;Despite early media reports, Equifax can confirm that its systems were <strong><span style="text-decoration: underline;">not</span></strong> compromised and that the reported issue did <span style="text-decoration: underline;"><strong>not</strong></span> affect our consumer online dispute portal.&#8221;</p>
<p>That closing line of Equifax&#8217;s statement may do little to assuage a public that has grown increasingly weary of Equifax&#8217;s various security and <a href="https://krebsonsecurity.com/2017/09/equifax-breach-response-turns-dumpster-fire/" target="_blank">public relations failures</a> since it <a href="https://krebsonsecurity.com/2017/09/breach-at-equifax-may-impact-143m-americans/" target="_blank">announced on Sept. 7, 2017</a> that hackers broke into the company&#8217;s servers and stole Social Security numbers and other sensitive data on more than 145 million Americans.</p>
<p>On Sunday, KrebsOnSecurity <a href="https://krebsonsecurity.com/2017/10/equifax-breach-fallout-your-salary-history/" target="_blank">published a story</a> warning that Equifax&#8217;s payroll and tax administration site made it simple to access detailed salary and employment history on a large portion of Americans using little more than someone’s Social Security number and date of birth — both data elements that were stolen in the recent breach at Equifax. Equifax disabled that service just hours after the story ran, replacing it with <a href="https://www.talx.com/maintenance.asp" target="_blank">a message</a> stating the site was under maintenance. Four days later, that site remains offline.</p>


feed_id: https://krebsonsecurity.com/?p=41144
title: Hyatt Hotels Suffers 2nd Card Breach in 2 Years
uri: Hyatt-Hotels-Suffers-2nd-Card-Breach-in-2-Years
url: https://krebsonsecurity.com/2017/10/hyatt-hotels-suffers-2nd-card-breach-in-2-years/
content:
<p><strong>Hyatt Corp.</strong> is alerting customers about another credit card breach at some hotels, the second major incident with the hospitality chain in as many years.</p>
<p><img class="alignright size-full wp-image-33392" src="media/6a6baa91.hyatt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/12/hyatt.png" alt="hyatt" width="237" height="231" />Hyatt said its cyber security team discovered signs of unauthorized access to payment card information from cards manually entered or swiped at the front desk of certain Hyatt-managed locations between March 18, 2017 and July 2, 2017.</p>
<p>&#8220;Upon discovery, we launched a comprehensive investigation to understand what happened and how this occurred, which included engaging leading third-party experts, payment card networks and authorities,&#8221; the company said in a statement. &#8220;Hyatt’s layers of defense and other cybersecurity measures helped to identify and resolve the issue. While this incident affects a small percentage of total payment cards used at the affected hotels during the at-risk dates.</p>
<p>The hotel chain said the incident affected payment card information – cardholder name, card number, expiration date and internal verification code – from cards manually entered or swiped at the front desk of certain Hyatt-managed locations. It added there is no indication that any other information was involved.</p>
<p>In late 2015, Hyatt <a href="http://krebsonsecurity.com/2015/12/malware-driven-card-breach-at-hyatt-hotels/" target="_blank">announced</a> that for about four months that year hackers had <a href="https://krebsonsecurity.com/2016/01/hyatt-card-breach-hit-250-hotels-in-50-nations/" target="_blank">gained access to credit card systems at 250 properties in 50 different countries</a>. This time, the breach appears to have impacted 41 properties across 11 countries. Only five of the Hyatt properties affected in this most recent breach included U.S. locations, including three resorts in Hawaii and one each in Guam and Puerto Rico.<span id="more-41144"></span></p>
<p>The nation with the largest number of Hyatt properties impacted was China (18). The company has published a list of the affected hotels <a href="https://www.hyatt.com/notice/protectingourcustomers/hotellist/" target="_blank" rel="noopener">here</a>.</p>
<p>Each time one of these breach stories breaks, I hear from a number of readers who say they believe their cards were impacted based on some fraudulent activity on their cards. One thing I try to stress to those readers is that there are so many merchants both online and offline that are compromised by card-stealing malicious software that it is very likely that their card numbers were stolen from multiple victim companies.</p>
<p>The most important thing to bear in mind with all these card breaches is that consumers are not liable for fraudulent charges, it still usually falls to you the consumer to spot and report any suspicious charges. So keep a close eye on your statements, and consider signing up for text message notifications of new charges if your card issuer offers this service. Most of these services also can be set to alert you if you&#8217;re about to miss an upcoming payment, so they can also be handy for avoiding late fees and other costly charges.</p>
<p>For anyone curious about why the hotel industry has been so heavily targeted over the past few years, check out some of the <a href="https://www.trustwave.com/Resources/SpiderLabs-Blog/New-Carbanak-/-Anunak-Attack-Methodology/" target="_blank">case</a> <a href="https://www.trustwave.com/Resources/Trustwave-Blog/What-to-Do-About-Social-Engineering-and-POS-attacks-in-the-Hotel-Industry/" target="_blank">studies</a> published by <strong>Trustwave Spiderlabs</strong>. Organized crime groups (most notably the <a href="https://krebsonsecurity.com/?s=carbanak&amp;x=0&amp;y=0" target="_blank">Carbanak gang</a>) have been targeting customer service and reservations specialists at various hospitality chains with tailored social engineering attacks that involve well-aged fake companies and custom malware.</p>


feed_id: https://krebsonsecurity.com/?p=41130
title: Microsoft’s October Patch Batch Fixes 62 Flaws
uri: Microsoft-s-October-Patch-Batch-Fixes-62-Flaws
url: https://krebsonsecurity.com/2017/10/microsofts-october-patch-batch-fixes-62-flaws/
content:
<p><strong>Microsoft</strong> on Tuesday released software updates to fix at least 62 security vulnerabilities in <strong>Windows</strong>, <strong>Office</strong> and other software. Two of those flaws were detailed publicly before yesterday&#8217;s patches were released, and one of them is already being exploited in active attacks, so attackers already have a head start.</p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="229" height="240" />Roughly half of the flaws Microsoft addressed this week are in the code that makes up various versions of Windows, and 28 of them were labeled &#8220;critical&#8221; &#8212; meaning malware or malicious attackers could use the weaknesses to break into Windows computers remotely with no help from users.</p>
<p>One of the publicly disclosed Windows flaws (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8703" target="_blank" rel="noopener">CVE-2017-8703</a>) fixed in this batch is a problem with a feature only present in Windows 10 known as the <a href="https://blogs.windows.com/buildingapps/2017/08/08/windows-subsystem-linux-windows-server/" target="_blank" rel="noopener">Windows Subsystem for Linux</a>, which allows Windows 10 users to run unmodified Linux binary files. Researchers at <strong>CheckPoint</strong> recently released <a href="https://research.checkpoint.com/beware-bashware-new-method-malware-bypass-security-solutions/" target="_blank" rel="noopener">some interesting research</a> worth reading about how attackers might soon use this capability to bypass antivirus and other security solutions on Windows.<span id="more-41130"></span></p>
<p>The bug quashed this week that&#8217;s being actively exploited resides in Microsoft Office (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11826" target="_blank" rel="noopener">CVE-2017-11826</a>), and Redmond says attackers could seize control over a vulnerable system just by convincing someone to open a booby-trapped Word file. Another Office vulnerability, (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11776" target="_blank" rel="noopener">CVE-2017-11776</a>), involves a flaw in <strong>Outlook&#8217;</strong>s ability to encrypt messages;<strong> SEC-Consult</strong> <a href="https://www.sec-consult.com/en/blog/2017/10/fake-crypto-microsoft-outlook-smime-cleartext-disclosure-cve-2017-11776/index.html" target="_blank" rel="noopener">has more details</a> on this bug.</p>
<p>Another critical flaw (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11779" target="_blank">CVE-2017-11779</a>) addresses a scary vulnerability in the domain name system (DNS) component of <strong>Windows 8</strong> and <strong>Windows Server 2012</strong>. According to <a href="https://www.bishopfox.com/blog/2017/10/a-bug-has-no-name-multiple-heap-buffer-overflows-in-the-windows-dns-client/" target="_blank" rel="noopener">research</a> from <strong>Bishop Fox</strong>, the security firm credited with finding and reporting the bug, this flaw could be exploited quite easily to gain complete control over vulnerable systems if the attacker controls or compromises a local network (think Wi-Fi hotspot).</p>
<p>Normally, Adobe uses Microsoft&#8217;s Patch Tuesday (the second Tuesday of each month) to release its own fixes for <strong>Flash Player</strong>, <strong>Reader</strong> and other products. However, this time around the company has no security updates available. Adobe did release a new version of Flash that includes bug fixes (<em>v. 27.0.0.159</em>), but generally speaking only even-numbered Flash releases include security fixes.</p>
<p>For additional commentary on October&#8217;s bundle of updates from Microsoft, see these blogs from security vendors <a href="https://www.ivanti.com/blog/october-patch-tuesday-2017/" target="_blank">Ivanti</a> and <a href="https://blog.qualys.com/laws-of-vulnerabilities/2017/10/10/october-patch-tuesday-28-critical-microsoft-vulnerabilities" target="_blank">Qualys</a>. For those looking for a straight-up list of which patches deserve priority, check out the <a href="https://isc.sans.edu/forums/diary/October+2017+Security+Updates/22916/" target="_blank">always useful roundup</a> from the <strong>SANS Internet Storm Center</strong>.</p>


feed_id: https://krebsonsecurity.com/?p=41105
title: Equifax Hackers Stole Info on 693,665 UK Residents
uri: Equifax-Hackers-Stole-Info-on-693-665-UK-Residents
url: https://krebsonsecurity.com/2017/10/equifax-hackers-stole-info-on-693665-uk-residents/
content:
<p><strong>Equifax Inc.</strong> said today an investigation into information stolen in the epic data breach the company disclosed on Sept. 7 revealed that intruders took a file containing 15.2 million UK records. The company says it is now working to inform 693,665 U.K. consumers whose data was stolen in the attack.</p>
<p><img src="media/1e5fd68d.equihax.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/09/equihax.png" alt="equihax" width="249" height="232" class="alignright size-full wp-image-40756" />Previously, Equifax said the breach impacted approximately 400,000 U.K. residents. But in a statement released Tuesday, Equifax said it would notify 693,665 U.K. consumers by mail that their personal information was jeopardized in the breach. This includes:</p>
<p>-12,086 consumers who had an email address associated with their Equifax.co.uk account in 2014 accessed.<br />
-14,961 consumers who had portions of their Equifax.co.uk membership details &#8212; such as username, password, secret questions and answers, as well as partial credit card details &#8212; accessed<br />
-29,188 consumers who had their drivers license numbers accessed<br />
-637,430 consumers who had their phone numbers accessed</p>
<p>The numbers include data that Equifax held on U.K. consumers as far back as 2011, the company said. Equifax did not say whether any of the above-mentioned data was encrypted.</p>
<p>Meanwhile, the U.K.&#8217;s <strong>National Cyber Security Centre</strong> is warning residents to be on their guard against phishing attacks made to look like communications from Equifax about the breach.</p>
<p>&#8220;Another risk to UK citizens affected by this data breach is that they could be on the receiving end of more targeted and realistic phishing messages,&#8221; the NCSC <a href="https://www.ncsc.gov.uk/news/statement-equifax-cyber-incident" rel="noopener" target="_blank">wrote</a>. &#8220;Fraudsters can use the data to make their phishing messages look much more credible, including using real names and statements such as: &#8216;To show this is not a phishing email, we have included the month of your birth and the last 3 digits of your phone number&#8217;. These phishing messages may be unrelated to Equifax and may use more well known brands. It is unlikely that any organisations will ask their customers to reset security information or passwords as a result of the Equifax breach, but this may be a tactic employed by criminals.&#8221;</p>
<h4>ANALYSIS</h4>
<p>Equifax has been widely criticized for <a href="https://krebsonsecurity.com/2017/09/equifax-breach-response-turns-dumpster-fire/" rel="noopener" target="_blank">continuously bungling their public response</a> to this still-unfolding data disaster, and today&#8217;s update about the extent of the breach in the U.K. was no exception. The Equifax Web site that hosts today&#8217;s press release serves &#8220;mixed content,&#8221; meaning it includes elements that are served over both encrypted and unencrypted pages. The practical effect of this varies depending on which browser you&#8217;re using, but some browsers will display a security warning when this happens.</p>
<p>That mixed content error may have something to do with a missing image in the press release. <a href="https://www.equifax.co.uk/about-equifax/press-releases/en_gb/-/blogs/equifax-ltd-uk-update-regarding-the-ongoing-investigation-into-us-cyber-security-incident" rel="noopener" target="_blank">That press release</a> was supposed to include an image that breaks down what exactly was stolen from U.K. residents &#8212; as detailed in the bulleted list above &#8212; but apparently the graphic was either removed or moved pre- or post-publication. Here&#8217;s what the press release looks like in Firefox (Equifax still hasn&#8217;t fixed this):<span id="more-41105"></span></p>
<p><img class="aligncenter size-medium wp-image-41109" src="media/7dc981db.eq-uk-ff-580x443.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/eq-uk-ff-580x443.png" alt="eq-uk-ff" width="580" height="443" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/10/eq-uk-ff-580x443.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/10/eq-uk-ff-768x586.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/10/eq-uk-ff-940x717.png 940w, https://krebsonsecurity.com/wp-content/uploads/2017/10/eq-uk-ff.png 1004w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>In Chrome:</p>
<p><img class="aligncenter size-medium wp-image-41108" src="media/cddf7651.eq-uk-chrome-580x83.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/eq-uk-chrome-580x83.png" alt="eq-uk-chrome" width="580" height="83" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/10/eq-uk-chrome-580x83.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/10/eq-uk-chrome-768x109.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/10/eq-uk-chrome.png 935w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>In Internet Explorer:</p>
<p><img class="aligncenter size-medium wp-image-41107" src="media/4b5b3875.eq-uk-ie-580x77.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/eq-uk-ie-580x77.png" alt="eq-uk-ie" width="580" height="77" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/10/eq-uk-ie-580x77.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/10/eq-uk-ie-768x102.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/10/eq-uk-ie.png 923w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>It&#8217;s fairly terrifying when you realize that a company which can&#8217;t even issue a press release without managing to omit the most important piece of information in it wields so much power over consumers. Nothing says &#8216;we care about your security and privacy&#8217; like a message which warns &#8220;you got hacked!&#8221; and then fails to tell you what that actually means.</p>
<p>I&#8217;ve been spending quite a bit of time looking at Equifax&#8217;s various Web properties over the past few weeks and I have to say it gets scarier the more I look. First it was the discovery that Equifax&#8217;s consumer dispute portal in Argentina was <a href="https://krebsonsecurity.com/2017/09/ayuda-help-equifax-has-my-data/" rel="noopener" target="_blank">protected by nothing more than the username and password &#8220;admin/admin.&#8221;</a> It&#8217;s worth noting that, as mentioned <a href="https://krebsonsecurity.com/2017/10/fear-not-you-too-are-a-cybercrime-victim/" rel="noopener" target="_blank">countless times by Equifax&#8217;s former CEO in front of several congressional committees last week</a>, the breach of sensitive data on 145.5 million Americans began with lax security at just such a dispute portal (the company declined to say which).</p>
<p>Earlier this week I pointed out that the company&#8217;s TALX Web site <a href="https://krebsonsecurity.com/2017/10/equifax-breach-fallout-your-salary-history/" rel="noopener" target="_blank">made it trivial to find the salary history of large chunk of the American population</a>, armed with nothing more than someone&#8217;s date of birth and Social Security number (both data points, by the way, that were stolen on 145.5 million Americans, thanks to Equifax). The company responded by taking the site offline a few hours after that story ran on Sunday. That site is still &#8220;under maintenance,&#8221; according to Equifax.</p>
<p>While Equifax has stressed that it will offer free credit monitoring services to victims of its own breach, it is still using the entire incident to drive traffic to areas of its consumer business that make the company oodles of money, such as &#8220;FREE* credit report &amp; score&#8221; services for only £14.95 per month. It&#8217;s impossible to understand how Equifax could fail to notice the atrocious optics here, unless of course it really doesn&#8217;t care.</p>
<div id="attachment_41112" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/65abfadc.equk.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/equk.png"> <img class="wp-image-39807 size-medium" src="media/680679ff.equk-580x306.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/equk-580x306.png" alt=" " width="580" height="306" /></a><p class="wp-caption-text">Equifax.co.uk</p></div>
<p>By the way, if you&#8217;re somehow just tuning in to news about this breach, don&#8217;t sweat it: <a href="https://krebsonsecurity.com/2017/09/the-equifax-breach-what-you-should-know/" rel="noopener" target="_blank">Here&#8217;s a Q&#038;A</a> that explains what&#8217;s at stake and what you should do.</p>


feed_id: https://krebsonsecurity.com/?p=41048
title: Equifax Breach Fallout: Your Salary History
uri: Equifax-Breach-Fallout-Your-Salary-History
url: https://krebsonsecurity.com/2017/10/equifax-breach-fallout-your-salary-history/
content:
<p>In May, KrebsOnSecurity <a href="https://krebsonsecurity.com/2017/05/fraudsters-exploited-lax-security-at-equifaxs-talx-payroll-division/" target="_blank" rel="noopener">broke a story about lax security at a payroll division</a> of big-three credit bureau <strong>Equifax</strong> that let identity thieves access personal and financial data on an unknown number of Americans. Incredibly, this same division makes it simple to access detailed salary and employment history on a large portion of Americans using little more than someone&#8217;s Social Security number and date of birth &#8212; both data elements that were stolen in <a href="https://krebsonsecurity.com/2017/09/breach-at-equifax-may-impact-143m-americans/" target="_blank" rel="noopener">the recent breach at Equifax</a>.</p>
<p><img class="aligncenter size-medium wp-image-41054" src="media/d6228fd8.twn-580x226.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/twn-580x226.png" alt="twn" width="580" height="226" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/10/twn-580x226.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/10/twn-768x300.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/10/twn.png 864w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>At issue is a service provided by Equifax&#8217;s <a href="https://krebsonsecurity.com/?s=talx&amp;x=0&amp;y=0" target="_blank" rel="noopener">TALX division</a> called <a href="https://www.theworknumber.com/Employees/index.asp" target="_blank" rel="noopener">The Work Number</a>. The service is designed to provide automated employment and income verification for prospective employers, and tens of thousands of companies report employee salary data to it. The Work Number also allows anyone whose employer uses the service to provide proof of their income when purchasing a home or applying for a loan.</p>
<p>The homepage for this Equifax service wants to assure visitors that &#8220;Your personal information is protected.&#8221;</p>
<p>&#8220;With your consent your personal data can be retrieved only by credentialed verifiers,&#8221; Equifax assures us, referring mainly to banks and other entities that request salary data for purposes of setting credit limits.</p>
<p>Sadly, this isn&#8217;t anywhere near true because most employers who contribute data to The Work Number &#8212; including Fortune 100 firms, government agencies and universities &#8212; rely on horribly weak authentication for access to the information.</p>
<p>To find out how easy it is to view your detailed salary history, you&#8217;ll need your employer&#8217;s name or employer code. Helpfully, <a href="https://secure.theworknumber.talx.com/popups/findEmployer.aspx?searchcriteria=" target="_blank" rel="noopener">this page</a> lets you look that up quite easily (although if you opt to list employers alphabetically by the first letter of the company name, there are so many entries for each letter that I found Equifax&#8217;s database simply crashes half the time instead of rendering the entire list).</p>
<p><img class="aligncenter size-medium wp-image-41055" src="media/0381e955.findemployercode-580x147.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/findemployercode-580x147.png" alt="findemployercode" width="580" height="147" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/10/findemployercode-580x147.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/10/findemployercode-768x194.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/10/findemployercode-940x238.png 940w, https://krebsonsecurity.com/wp-content/uploads/2017/10/findemployercode.png 1150w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>What&#8217;s needed to access your salary and employment history? <a href="https://secure.theworknumber.talx.com/twneeer/PreAuthenticated/EnterEmployerSearchCriteria.ascx?ReturnUrl=%2ftwneeer%2femployee%2fpostauthenticated%2fapplicationsequenceerror.ascx" target="_blank" rel="noopener">Go here</a>, and enter the employer name or employer code. After that, it asks for a &#8220;user ID.&#8221; This might sound like privileged information, but in most cases this is just the employees&#8217;s Social Security number (or a portion of it).</p>
<p>At the next step, the site asks visitors to &#8220;enter your PIN,&#8221; short for Personal Identification Number. However, in the vast majority of cases this appears to be little more than someone&#8217;s eight-digit date of birth. The formats differ by employer, but it&#8217;s usually either yyyy/mm/dd or mm/dd/yyyy, without the slashes.</p>
<p>Successful validation to the system produces two sets of data: An employee&#8217;s salary and employment history going back at least a decade, and a report listing all of the entities (ostensibly, the aforementioned &#8220;credentialed verifiers&#8221;) that have previously requested and viewed this information.</p>
<p>Once you&#8217;re successfully &#8220;authenticated,&#8221; the system asks you to change your PIN to something more secret than your birthday. When the default PIN is changed, The Work Number prompts users to select a series of six challenge/response questions, which Equifax claims will &#8220;improve the security of your data and create an extra layer of protection on your account.&#8221;</p>
<p><em>Unfortunately, consumers whose employee history is stored by this service effectively have no privacy or security unless they possess both the awareness that this service exists and the forethought to access their account online before identity thieves or others do it first.</em><span id="more-41048"></span></p>
<p><img class="aligncenter size-medium wp-image-41056" src="media/56211ae8.newpin-580x645.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/newpin-580x645.png" alt="newpin" width="580" height="645" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/10/newpin-580x645.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/10/newpin.png 646w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>The Work Number does allow employers to opt for TALX&#8217;s &#8220;enhanced authentication&#8221; feature, wherein after logging in with your employer ID and PIN (often the last four digits of an SSN plus the birth year), the system is designed to require the requester to respond to an email at a work address or a phone call to a work number to validate the login.</p>
<p>However, I did not find this to be the case in several instances involving readers whose employers supposedly used this enhanced authentication method. In cases where corporate human resources departments fail to populate employee email addresses and phone numbers, the system defaults to asking visitors to enter <em>any email address and phone number</em> to complete the validation. This is <a href="media/60cc7d0a.RSA_enroll_employee.pdf" data-original-source="http://www.theworknumber.com/Authentication/HelpTWNEEER/docs/RSA_enroll_employee.pdf" target="_blank" rel="noopener">detailed here</a> (PDF), wherein The Work Number states &#8220;if you do not have the required phone and e-mail information on file, you will be prompted to update/add your phone numbers/email addresses.&#8221;</p>
<p><img class="aligncenter size-full wp-image-41072" src="media/7918a379.squestionsa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/squestionsa.png" alt="squestionsa" width="575" height="456" /></p>
<p>Worse yet, while companies that use this service tend to vary their approaches to what&#8217;s required in terms of user IDs and PINs, a great many employers publish online detailed instructions on how to fill out these various forms. For example, the <strong>State of California</strong>&#8216;s process is listed <a href="media/cd5ebd3a.empinfo_howto_wrknumber_STD500.pdf" data-original-source="http://www.sco.ca.gov/Files-PPSD/empinfo_howto_wrknumber_STD500.pdf" target="_blank" rel="noopener">here</a> (PDF); instructions for the <strong>Health Resources &amp; Services Administration</strong> (HRSA) are <a href="https://www.hrsa.gov/hr/talx/" target="_blank" rel="noopener">here</a>; employees at the <strong>National Institutes of Health</strong> (NIH) can learn the steps by consulting <a href="media/5046f671.salary_key_508.pdf" data-original-source="https://www.niehs.nih.gov/about/assets/docs/salary_key_508.pdf" target="_blank" rel="noopener">this document</a> (PDF). The process for getting this information on current and former <strong>UCLA</strong> employees is spelled out <a href="https://www.finance.ucla.edu/payroll/news-events/employment-income-verification-through-the-work-number" target="_blank" rel="noopener">here</a>. There are countless other examples that are easy to find with a simple Internet search.</p>
<p>Many readers probably consider their current and former salaries to be very private information, but as we can see this data is easily available on a broad spectrum of the working population in America today. The information needed to obtain it has been widely compromised in thousands of data breaches over the past few years, and the SSN and DOB on most Americans is for sale in a variety of places online. In short, if you can get these details from Equifax&#8217;s online service, so can anyone else.</p>
<p>Fortunately, you can reduce the likelihood that an acquaintance, co-worker, stalker or anyone else can do this by claiming your own account, changing the PIN and selecting a half-dozen security questions and answers. As always, it&#8217;s best not to answer these questions truthfully, but to input answers that only you will know and that can&#8217;t be found using social networking sites or other public data sources.</p>
<p>I could see this service potentially helping to create a toxic workplace environment because it offers a relatively simple method for employees to glean data about the salaries of their co-workers and bosses. While some people believe that companies should be more transparent about employee salaries, this data in the wrong hands very often generates a great deal of resentment and hostility among co-workers.</p>
<p>Employers who use The Work Number should strongly consider changing as many defaults as possible, and truly implementing the service&#8217;s enhanced authentication features.</p>
<p>October is <strong>National Cybersecurity Awareness Month</strong>, and as such KrebsOnSecurity will continue pointing readers to similar services that let anyone access your personal data armed with little more than static identifiers about you that should no longer be considered private. Although some readers may take issue with my pointing these out &#8212; reasoning that I&#8217;m only making it easier for bad people to do bad things &#8212; it&#8217;s important to understand that knowledge is half the battle: Planting your flag before someone else does is usually the only way to keep others from abusing such services to expose your personal information.</p>
<p><strong>Update, Oct. 9, 10:00 a.m. ET:</strong> The Work Number site is currently down for maintenance. <a href="https://status.equifaxworkforce.com/" rel="noopener" target="_blank">A notice on the site</a> says the company took the portal down a few hours after my story was published yesterday, without the usual advance warning the company offers for scheduled maintenance. The notice reads: </p>
<p>&#8220;Equifax Workforce Solutions is currently performing maintenance activities that will affect the following applications:</p>
<p>The Work Number EDR&#8221;</p>
<p>&#8220;We apologize for any inconvenience this may cause, but it is necessary to ensure<br />
that Equifax Workforce Solutions continues to provide you the industry-leading services you<br />
have come to expect.&#8221;</p>
<p>Also, several readers pointed out that when they tried the service Sunday evening before Equifax took it down they were asked to answer knowledge-based authentication questions before being able to authenticate to the portal to view their salary history. While this is a welcome additional step, regular readers here know how easy it is for ID thieves to bypass these multiple-guess questions (as the answers usually are available using sites like Zillow and Spokeo, to say nothing of social networking profiles).</p>
<p>Related reading:</p>
<p>&#8211;<a href="https://krebsonsecurity.com/2017/10/usps-informed-delivery-is-stalkers-dream/" target="_blank" rel="noopener">USPS &#8216;Informed Delivery&#8217; is Stalker&#8217;s Dream</a><br />
&#8211;<a href="https://krebsonsecurity.com/2017/03/student-aid-tool-held-key-for-tax-fraudsters/" target="_blank" rel="noopener">Student Aid Tool Held Key for Tax Fraudsters</a><br />
&#8211;<a href="https://krebsonsecurity.com/2015/03/sign-up-at-irs-gov-before-crooks-do-it-for-you/" target="_blank" rel="noopener">Sign Up at IRS.gov Before Crooks Do It For You</a><br />
&#8211;<a href="https://krebsonsecurity.com/2013/09/crooks-hijack-retirement-funds-via-ssa-portal/" target="_blank" rel="noopener">Crooks Hijack Retirement Funds via SSA Portal</a><br />
&#8211;<a href="https://krebsonsecurity.com/2016/08/social-security-administration-now-requires-two-factor-authentication/" target="_blank" rel="noopener">Social Security Administration Now Requires Two-Factor Authentication</a><br />
&#8211;<a href="https://krebsonsecurity.com/2016/08/ssa-ixnay-on-txt-msg-reqmnt-4-e-acct-sry/" target="_blank" rel="noopener">SSA: Ixnay on txt msg reqmnt 4 e-acct, sry</a></p>


feed_id: https://krebsonsecurity.com/?p=41218
title: Reaper: Calm Before the IoT Security Storm?
uri: Reaper-Calm-Before-the-IoT-Security-Storm
url: https://krebsonsecurity.com/2017/10/reaper-calm-before-the-iot-security-storm/
content:
<p>It&#8217;s been just over a year since the world witnessed some of the world&#8217;s top online Web sites being taken down for much of the day by &#8220;<strong>Mirai</strong>,&#8221; a zombie malware strain that enslaved &#8220;Internet of Things&#8221; (IoT) devices such as wireless routers, security cameras and digital video recorders for use in large-scale online attacks.</p>
<p>Now, experts are sounding the alarm about the emergence of what appears to be a far more powerful strain of IoT attack malware &#8212; variously named &#8220;<strong>Reaper</strong>&#8221; and &#8220;<strong>IoTroop</strong>&#8221; &#8212; that spreads via security holes in IoT software and hardware. And there are indications that over a million organizations may be affected already.</p>
<p>Reaper isn&#8217;t attacking anyone yet. For the moment it is apparently content to gather gloom to itself from the darkest reaches of the Internet. But if history is any teacher, we are likely enjoying a period of false calm before another humbling IoT attack wave breaks.</p>
<p><img class="aligncenter size-medium wp-image-36655" src="media/639b8700.networktechnicians-580x384.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians-580x384.png" alt="" width="580" height="384" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians-580x384.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians-940x622.png 940w, https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians.png 1212w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>On Oct. 19, 2017, researchers from Israeli security firm <strong>CheckPoint</strong> <a href="https://research.checkpoint.com/new-iot-botnet-storm-coming/">announced</a> they&#8217;ve been tracking the development of a massive new IoT botnet &#8220;forming to create a cyber-storm that could take down the Internet.&#8221; CheckPoint said the malware, which it called &#8220;IoTroop,&#8221; had already infected an estimated one million organizations.</p>
<p>The discovery came almost a year to the day after the Internet witnessed <a href="https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-reddit/" target="_blank" rel="noopener">one of the most impactful cyberattacks ever</a> &#8212; against online infrastructure firm <strong>Dyn</strong> at the hands of &#8220;<a href="https://krebsonsecurity.com/?s=mirai&amp;x=0&amp;y=0" target="_blank" rel="noopener">Mirai</a>,&#8221; an IoT malware strain that first surfaced in the summer of 2016. According to CheckPoint, however, this new IoT malware strain is &#8220;evolving and recruiting IoT devices at a far greater pace and with more potential damage than the Mirai botnet of 2016.&#8221;</p>
<p>Unlike Mirai &#8212; which wriggles into vulnerable IoT devices using factory-default or hard-coded usernames and passwords &#8212; this newest IoT threat leverages at least nine known security vulnerabilities across nearly a dozen different device makers, including <a href="https://github.com/Trietptm-on-Security/AVTECH">AVTECH</a>, <a href="https://blogs.securiteam.com/index.php/archives/3364">D-Link</a>, <a href="https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html">GoAhead</a>, <a href="https://blogs.securiteam.com/index.php/archives/3409">Netgear</a>, and <a href="http://www.s3cur1ty.de/m1adv2013-004">Linksys</a>, among others (click each vendor&#8217;s link to view security advisories for the flaws).</p>
<div id="attachment_41225" style="width: 584px" class="wp-caption aligncenter"><img class=" wp-image-41225" src="media/7bcd073d.trendofattackingips-reaper.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/trendofattackingips-reaper.png" alt="" width="574" height="314" /><p class="wp-caption-text">This graphic from CheckPoint charts a steep, recent rise in the number of Internet addresses trying to spread the new IoT malware variant, which CheckPoint calls &#8220;IoTroop.&#8221;</p></div>
<p>Both Mirai and IoTroop are computer worms; they are built to spread automatically from one infected device to another. Researchers can&#8217;t say for certain what IoTroop will be used for but it is based at least in part on Mirai, which was made to launch distributed denial of service (DDoS) attacks.</p>
<p>While DDoS attacks target a single Web site or Internet host, they often result in widespread collateral Internet disruption. IoT malware spreads by scanning the Internet for other vulnerable devices, and sometimes this scanning activity is so aggressive that it constitutes an unintended DDoS on the very home routers, Web cameras and DVRs that the bot code is trying to subvert and recruit into the botnet.</p>
<p>However, according to <a href="http://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/">research released Oct. 20</a> by Chinese security firm <strong>Netlab 360</strong>, the scanning performed by the new IoT malware strain (Netlab calls it the more memorable &#8220;Reaper&#8221;) is not very aggressive, and is intended to spread much more deliberately than Mirai. Netlab&#8217;s researchers say Reaper partially borrows some Mirai source code, but is significantly different from Mirai in several key behaviors, including an evolution that allows Reaper to more stealthily enlist new recruits and more easily fly under the radar of security tools looking for suspicious activity on the local network.<span id="more-41218"></span></p>
<h4>WARNING SIGNS, AND AN EVOLUTION</h4>
<p>Few knew or realized it at the time, but even before the Mirai attacks commenced in August 2016 there were ample warning signs that something big was brewing. Much like the seawater sometimes recedes hundreds of feet from its normal coastline just before a deadly tsunami rushes ashore, cybercriminals spent the summer of 2016 using their state-of-the-art and new Mirai malware to siphon control over poorly-secured IoT devices from other hackers who were using inferior IoT malware strains.</p>
<p><img class="aligncenter size-full wp-image-36433" src="media/ec45f675.iotstuf.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/09/iotstuf.jpg" alt="" width="500" height="282" /></p>
<p>Mirai was designed to wrest control over systems infected with variants of an early IoT malware contagion known as &#8220;<strong>Qbot</strong>&#8221; &#8212; and it did so with gusto immediately following its injection into the Internet in late July 2016. As documented in great detail in &#8220;<a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/">Who Is Anna Senpai, the Mirai Worm Author?</a>&#8220;, the apparent authors of Mirai <a href="media/c1166f13.botcount-580x253.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/01/botcount-580x253.png" target="_blank" rel="noopener">taunted the many Qbot botmasters in hacker forum postings</a>, promising they had just unleashed a new digital disease that would replace all Qbot infected devices with Mirai.</p>
<p>Mirai&#8217;s architects were true to their word: their creation mercilessly seized control over hundreds of thousands of IoT devices, spreading the disease globally and causing total extinction of Qbot variants. Mirai had evolved, and Qbot went the way of the dinosaurs.</p>
<p>On Sept. 20, 2016, KrebsOnSecurity.com was <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank" rel="noopener">hit with a monster denial-of-service attack</a> from the botnet powered by the first known copy of Mirai. That attack, which clocked in at 620 Gbps, was almost twice the size that my DDoS mitigation firm at the time <strong>Akamai</strong> had ever mitigated before. They&#8217;d been providing my site free protection for years, but when the Mirai attackers didn&#8217;t go away and turned up the heat, Akamai said the attack on this site was causing troubles for its paying customers, and <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank" rel="noopener">it was time to go</a>.</p>
<p>Thankfully, several days later <strong>Google</strong> <a href="https://krebsonsecurity.com/2017/02/how-google-took-on-mirai-krebsonsecurity/" target="_blank" rel="noopener">brought KrebsOnSecurity into the stable of journalist and activist Web sites</a> that qualify for its Project Shield program, which offers DDoS protection to newsrooms and Web sites facing various forms of online censorship.</p>
<p>The same original Mirai botnet would be used to launch a huge attack &#8212; over one terabit of data per second &#8212; against French hosting firm <strong>OVH</strong>. After the media attention paid to this site&#8217;s attack and the OVH assault, the Mirai authors <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank" rel="noopener">released the source code for their creation</a>, spawning dozens of copycat Mirai clones that all competed for the right to infest a finite pool of vulnerable IoT devices.</p>
<p>Probably the largest Mirai clone to rise out of the source code spill was used in <a href="https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-reddit/">a highly disruptive attack on Oct. 20, 2016</a> against Internet infrastructure giant <strong>Dyn</strong> (now part of <strong>Oracle</strong>). Some of the Internet&#8217;s biggest destinations &#8212; including <strong>Twitter</strong>, <strong>SoundCloud</strong>, <strong>Spotify</strong> and <strong>Reddit</strong> &#8212; were unreachable for large chunks of time that day because Mirai targeted a critical service that Dyn provides these companies.</p>
<div id="attachment_36755" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36755" src="media/ba1a1d04.l3outage-580x330.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/10/l3outage-580x330.png" alt="" width="580" height="330" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/10/l3outage-580x330.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/10/l3outage-768x437.png 768w, https://krebsonsecurity.com/wp-content/uploads/2016/10/l3outage.png 778w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A depiction of the outages caused by the Mirai attacks on Dyn, an Internet infrastructure company. Source: Downdetector.com.</p></div>
<p>[AUTHOR&#8217;S NOTE: Some people believe that the Dyn attack was in retribution for <a href="https://www.youtube.com/watch?v=LFJzu0AFDpU" target="_blank" rel="noopener">information presented publicly</a> hours before the attack by Dyn researcher <strong>Doug Madory. </strong>The talk was about research we had worked on together for <a href="https://krebsonsecurity.com/2016/09/ddos-mitigation-firm-has-history-of-hijacks/">a story exploring the rather sketchy history of a DDoS mitigation firm</a> that had a talent for annexing Internet address space from its neighbors in a personal grudge match between that mitigation firm and the original Mirai authors and botmasters.]</p>
<p>It&#8217;s a safe bet that whoever is responsible for building this new Reaper IoT botnet will have more than enough firepower capable of executing Dyn-like attacks at Internet pressure points. Attacks like these can cause widespread Internet disruption because they target virtual gateways where third-party infrastructure providers communicate with hordes of customer Web sites, which in turn feed the online habits of countless Internet users.</p>
<p>It&#8217;s critical to observe that Reaper may not have been built for launching DDoS attacks: A global network of millions of hacked IoT devices can be used for a variety of purposes &#8212; such as serving as a sort of <a href="https://krebsonsecurity.com/2016/10/iot-devices-as-proxies-for-cybercrime/" target="_blank" rel="noopener">distributed proxy or anonymity network</a> &#8212; or building a pool of infected devices that can serve as jumping-off points for exploring and exploiting other devices within compromised corporate networks.</p>
<p>&#8220;While some technical aspects lead us to suspect a possible connection to the Mirai botnet, this is an entirely new campaign rapidly spreading throughout the globe,&#8221; CheckPoint warns. &#8220;It is too early to assess the intentions of the threat actors behind it, but it is vital to have the proper preparations and defense mechanisms in place before an attack strikes.&#8221;</p>
<h4>AND THE GOOD NEWS IS?</h4>
<p>There have been positive developments on the IoT security front: <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank" rel="noopener">Two possible authors of Mirai have been identified</a> (if not yet charged), and <a href="https://krebsonsecurity.com/2017/07/who-is-the-govrat-author-and-mirai-botmaster-bestbuy/" target="_blank" rel="noopener">some of Mirai&#8217;s biggest botmasters</a> have been arrested and <a href="https://krebsonsecurity.com/2017/07/suspended-sentence-for-mirai-botmaster-daniel-kaye/" target="_blank" rel="noopener">sentenced</a>.</p>
<p>Some of the most deadly DDoS attack-for-hire services on the Internet were either run out of business by Mirai or have been forcibly shuttered in the past year, including <a href="http://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank" rel="noopener">vDOS &#8212; one of the Internet&#8217;s longest-running attack services</a>. The alleged providers of vDOS &#8212; two Israeli men <a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank" rel="noopener">first outed by KrebsOnSecurity</a> after their service was massively hacked last year &#8212; were <a href="https://krebsonsecurity.com/2017/08/alleged-vdos-operators-arrested-charged/" target="_blank" rel="noopener">later arrested</a> and are currently <a href="https://krebsonsecurity.com/2017/03/alleged-vdos-owners-poised-to-stand-trial/" target="_blank" rel="noopener">awaiting trial</a> in Israeli for related cybercrime charges.</p>
<p>Using <a href="https://krebsonsecurity.com/2016/12/operation-tarpit-targets-customers-of-online-attack-for-hire-services/" target="_blank" rel="noopener">a combination of arrests and interviews</a>, the <strong>FBI</strong> and its counterparts in Europe have made it clear that patronizing or selling DDoS-for-hire services &#8212; often known as &#8220;booters&#8221; or &#8220;stressers&#8221; &#8212; is <a href="https://www.ic3.gov/media/2017/171017-2.aspx" target="_blank" rel="noopener">illegal activity that can land violators in jail</a>.</p>
<div id="attachment_38757" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-38757" src="media/89c663a5.vdos-front-580x392.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/03/vdos-front-580x392.png" alt="" width="580" height="392" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/03/vdos-front-580x392.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/03/vdos-front.png 619w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The front page of vDOS, when it was still online last year. vDOS was powered by an IoT botnet similar to Mirai and Reaper.</p></div>
<p>Public awareness of IoT security is on the rise, with lawmakers in Washington <a href="https://krebsonsecurity.com/2017/08/new-bill-seeks-basic-iot-security-standards/">promising legislative action</a> if the tech industry continues to churn out junky IoT hardware that is the Internet-equivalent of toxic waste.</p>
<p>Nevertheless, IoT device makers continue to ship products with either little to no security turned on by default or with ill-advised features which can be used to subvert any built-in security.</p>
<h4>WHAT YOU CAN DO</h4>
<p>According to Netlab, about half of the security vulnerabilities exploited by Reaper were first detailed in just the past few months, suggesting there may be a great number of unpatched and vulnerable systems in real danger from this new IoT malware strain.</p>
<p>Check to make sure your network isn&#8217;t part of the problem: <a href="http://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/" target="_blank" rel="noopener">Netlab&#8217;s advisory</a> links to specific patches available by vendor, as well as indicators of compromise and the location of various Reaper control networks. <a href="https://research.checkpoint.com/new-iot-botnet-storm-coming/" target="_blank" rel="noopener">CheckPoint&#8217;s post</a> breaks down affected devices by version number but doesn&#8217;t appear to include links to security advisories or patches.</p>
<p><em>Please note that many of the affected devices are cameras or DVRs, but there also are quite a few consumer wired/wireless routers listed here (particularly for <a href="http://www.s3cur1ty.de/m1adv2013-003" target="_blank" rel="noopener">D-Link</a> and <a href="http://www.s3cur1ty.de/m1adv2013-004" target="_blank" rel="noopener">Linksys devices</a>).</em></p>
<div id="attachment_41232" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/bfc24145.netlabvuln.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/netlabvuln.png" target="_blank" rel="noopener"><img class="wp-image-41232" src="media/bfc24145.netlabvuln.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/netlabvuln.png" alt="" width="594" height="404" /></a><p class="wp-caption-text">A listing of known IoT device vulnerabilities targeted by Reaper. Source: Netlab 360 blog.</p></div>
<p>One incessant problem with popular IoT devices is the inclusion of peer-to-peer (<strong>P2P</strong>) networking capability inside countless security cameras, DVRs and other gear. <strong>Jake Reynolds</strong>, a partner and consultant at Kansas City, Mo.-based <strong>Depth Security</strong>, published earlier this month <a href="https://depthsecurity.com/blog/unauthorized-flir-cloud-access" target="_blank" rel="noopener">research on a serious P2P weakness</a> built into many <strong>FLIR/Lorex</strong> DVRs and security cameras that could let attackers remotely locate and gain access to vulnerable systems that otherwise are not directly connected to the Internet (FLIR&#8217;s updated advisory and patches are <a href="http://www.flir.com/securityinfo/" target="_blank" rel="noopener">here</a>).</p>
<p>In Feb. 2016, KrebsOnSecurity <a href="https://krebsonsecurity.com/2016/02/this-is-why-people-fear-the-internet-of-things/" target="_blank" rel="noopener">warned about a similar weakness</a> powering the P2P component embedded in countless security cameras made by <strong>Foscam</strong>. That story noted that while the P2P component was turned on by default, disabling it in the security settings of the device did nothing to actually turn off P2P communications. Being able to do that was only possible after applying a firmware patch Foscam made available after users started complaining. My advice is to stay away from products that advertise P2P functionality.</p>
<p>Another reason IoT devices are ripe for exploitation by worms like Reaper and Mirai is that vendors infrequently release security updates for their firmware, and when they do there&#8217;s often no easy method available to notify users. Also, these updates are notoriously hard to do and easy to screw up, often leaving the unwary and unlearned with an oversized paperweight after a botched firmware update. So if it&#8217;s time to update your device, do it slowly and carefully.</p>
<p>What&#8217;s interesting about Reaper is that it is currently built to live harmoniously with Mirai. It&#8217;s not immediately clear whether the two IoT malware strains compete for any of the same devices, although some overlaps are bound to occur &#8212; particularly as the Reaper authors add new functionality and spreading mechanisms (both Netlab and Checkpoint say the Reaper code appears to be a work-in-progress).</p>
<p>That new Reaper functionality could well include the ability to seek out and supplant Mirai infections (much like Mirai did with Qbot), which would help Reaper to grow to even more terrifying numbers.</p>
<p>No matter what innovation Reaper brings, I&#8217;m hopeful that the knowledge being shared within the security community about how to defend against the Mirai attacks today will prove useful in ultimately helping to blunt any attacks from Reaper tomorrow. &lt;Fingers crossed&gt;</p>
<p>Speaking of calms before storms, KrebsOnSecurity.com soon will get its first major facelift since its inception in Dec. 2009. The changes are more structural than cosmetic; we&#8217;re striving to make the site more friendly to mobile devices, while maintaining the simple, almost minimalist look and feel of this site. I&#8217;ll make another announcement as we get closer to the switch (just so everyone doesn&#8217;t freak out and report the site&#8217;s been hacked).</p>


feed_id: https://krebsonsecurity.com/?p=41267
title: Dell Lost Control of Key Customer Support Domain for a Month in 2017
uri: Dell-Lost-Control-of-Key-Customer-Support-Domain-for-a-Month-in-2017
url:
https://krebsonsecurity.com/2017/10/dell-lost-control-of-key-customer-support-domain-for-a-month-in-2017/

content:
<p>A Web site set up by PC maker <b>Dell Inc.</b> to help customers recover from malicious software and other computer maladies may have been hijacked for a few weeks this summer by people who specialize in deploying said malware, KrebsOnSecurity has learned.</p>
<p>There is a program installed on virtually all Dell computers called &#8220;Dell Backup and Recovery Application.&#8221; It&#8217;s designed to help customers restore their data and computers to their pristine, factory default state should a problem occur with the device. That backup and recovery program periodically checks a rather catchy domain name &#8212; <strong>DellBackupandRecoveryCloudStorage.com </strong>&#8212; which until recently was central to PC maker Dell&#8217;s customer data backup, recovery and cloud storage solutions.</p>
<p>Sometime this summer, DellBackupandRecoveryCloudStorage.com was suddenly snatched away from a longtime Dell contractor for a month and exposed to some questionable content. More worryingly, there are signs the domain may have been pushing malware before Dell&#8217;s contractor regained control over it.</p>
<div id="attachment_33929" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-33929" src="media/5c5ae67f.dellwiki-580x429.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/02/dellwiki-580x429.png" alt="" width="580" height="429" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/02/dellwiki-580x429.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/02/dellwiki.png 716w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Image: Wikipedia</p></div>
<p>The purpose of DellBackupandRecoveryCloudStorage.com is inscribed in the hearts of countless PCs that Dell shipped customers over the past few years. The domain periodically gets checked by the &#8220;Dell Backup and Recovery application,&#8221;<em> </em>which &#8220;enables the user to backup and restore their data with just a few clicks.&#8221;</p>
<p>This program comes in two versions: Basic and Premium, explains &#8220;<strong>Jesse L</strong>,&#8221; a Dell customer liaison and a blogger on the company&#8217;s site.</p>
<p>&#8220;The Basic version comes pre-installed on all systems and allows the user to create the system recovery media and take a backup of the factory installed applications and drivers,&#8221;Jesse L <a href="http://en.community.dell.com/support-forums/software-os/f/4677/t/19471699" target="_blank" rel="noopener">writes</a>. &#8220;It also helps the user to restore the computer to the factory image in case of an OS issue.&#8221;</p>
<div id="attachment_41277" style="width: 608px" class="wp-caption aligncenter"><img class=" wp-image-41277" src="media/8a35938d.dellbackup.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/dellbackup.png" alt="" width="598" height="557" /><p class="wp-caption-text">Dell customer liaison Jesse L. talks about how the program in question is by default installed on all Dell PCs.</p></div>
<p>In other words: If DellBackupandRecoveryCloudStorage.com were to fall into the wrong hands it could be used to foist malicious software on Dell users seeking solace and refuge from just such nonsense!</p>
<p>It&#8217;s not yet clear how or why DellBackupandRecoveryCloudStorage.com got away from <a href="http://softthinks.com/" target="_blank" rel="noopener">SoftThinks.com</a> &#8212;  an Austin, Tex.-based software backup and imaging solutions provider that originally registered the domain back in mid-2013 and has controlled it for most of the time since. But someone at SoftThinks apparently forgot to renew the domain in mid-June 2017.</p>
<p>SoftThinks lists Dell among some of its &#8220;great partners&#8221; (see screenshot below). It hasn&#8217;t responded to requests for comment. Some of its other partners include <strong>Best Buy</strong> and <strong>Radio Shack</strong>.</p>
<div id="attachment_41271" style="width: 605px" class="wp-caption aligncenter"><img class=" wp-image-41271" src="media/73ecffad.softthinks-partners.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/softthinks-partners.png" alt="" width="595" height="211" /><p class="wp-caption-text">Some of SoftThinks&#8217; partners. Source: SoftThinks.com</p></div>
<p>From early June to early July 2017, DellBackupandRecoveryCloudStorage.com was the property of <strong>Dmitrii Vassilev </strong>of<em>  </em>&#8220;<strong>TeamInternet.com</strong>,&#8221; a company listed in Germany that specializes in selling what appears to be typosquatting traffic. Team Internet also appears to be tied to a domain monetization business called <strong>ParkingCrew</strong>.</p>
<p>If you&#8217;re not sure what typosquatting is, think of what sometimes happens when you&#8217;re typing out a URL in the browser&#8217;s address field and you fat-finger a single character and suddenly get redirected to the kind of content that makes you look around quickly to see if anyone saw you looking at it. For more on Team Internet, see <a href="https://dyn.com/blog/ne-body-out-there/" target="_blank" rel="noopener">this enlightening Aug. 2017 post </a>from <b>Chris Baker </b>at internet infrastructure firm <strong>Dyn. </strong><span id="more-41267"></span></p>
<p>It could be that Team Internet did nothing untoward with the domain name, and that it just resold it or leased it to someone who did. But <span class="pullquote pqLeft">approximately two weeks after Dell&#8217;s contractor lost control over the domain, the server it was hosted on started showing up in malware alerts.</span></p>
<p>That&#8217;s according to <strong>Celedonio Albarran</strong>, assistant vice president of IT infrastructure and security at <a href="https://www.equityapartments.com" target="_blank" rel="noopener">Equity Residential</a>, a real estate investment trust that invests in apartments.</p>
<p>Albarran said Equity is responsible for thousands of computers, and that several of those machines in late June tried to reach out to DellBackupandRecoveryCloudStorage.com but were prevented from doing so because the Internet address tied to the domain was new and because that address had been flagged by two security firms as pushing malicious software.</p>
<p>On that particular day, anyone visiting DellBackupandRecoveryCloudStorage.com simultaneously would have been heading to the Internet address<strong> 54-72-9-51</strong> (I&#8217;ve replaced the dots with dashes for safety reasons). Albarran said the first alert came on June 28 from a security tool from <strong>Rapid7</strong> that flagged a malware detection on that Internet address.</p>
<p>Another anti-malware product Equity Residential uses is <a href="https://krebsonsecurity.com/?s=carbon+black&amp;x=0&amp;y=0" target="_blank" rel="noopener"><strong>Carbon Black</strong></a>, which on June 28 detected a reason why a Dell computer within the company shouldn&#8217;t be able to visit dellbackupandrecoverycloudstorage.com. According to Albarran, that second alert was generated by <strong>Abuse.ch</strong>, a Swiss infrastructure security company and active anti-abuse advocate.</p>
<div id="attachment_41289" style="width: 609px" class="wp-caption aligncenter"><img class=" wp-image-41289" src="media/62d68b7b.cb-dbr.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/cb-dbr.png" alt="" width="599" height="406" /><p class="wp-caption-text">This Carbon Black log shows dellbackupandrecoverycloudstorage.com reaching out to a nasty Internet address on June 28, 2017.</p></div>
<p>The domain&#8217;s host appears to have been flagged by Abuse.ch&#8217;s <a href="https://ransomwaretracker.abuse.ch/" target="_blank" rel="noopener">Ransomware Tracker</a>, which is a running list of Internet addresses and domains that have a history of foisting ransomware &#8212; a threat that encrypts your files with tough-to-crack encryption, and then makes you pay for a key to unlock the files.</p>
<p>Albarran told KrebsOnSecurity that his company was never able to find any evidence that computers on its networks that were beaconing home to DellBackupandRecoveryCloudStorage.com had any malware installed as a result of the traffic. But he said his systems were blocked from visiting the domains on June 28, 2017, and that his employer immediately notified Dell of the problem.</p>
<p>&#8220;A few weeks after that they confirmed they fixed the issue,&#8221; Albarran said. &#8220;They just acknowledged the issue and said it was fixed, but they didn&#8217;t offer any comment besides that.&#8221;</p>
<p><strong>AlienVault</strong>&#8216;s <strong>Open Threat Exchange</strong> <a href="https://otx.alienvault.com/indicator/ip/54.72.9.51/" target="_blank" rel="noopener">says the Internet address</a> that was assigned to DellBackupandRecoveryCloudStorage.com in late June is an Amazon server which is &#8220;actively malicious&#8221; (even today), categorizing it as an address known for spamming.</p>
<p>Reached for comment about the domain snafu, Dell spokesperson <strong>Ellen Murphy</strong> shared the following statement:</p>
<blockquote><p>&#8220;A domain as part of the cloud backup feature for the Dell Backup and Recovery (DBAR) application, <a href="http://www.dellbackupandrecoverycloudstorage.com/" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=http://www.dellbackupandrecoverycloudstorage.com&amp;source=gmail&amp;ust=1508977190947000&amp;usg=AFQjCNFSr8rfdBEpJug7rcGODMQ_zJgYYg">www.dellbackupandrecoverycloudstorage.com</a>, expired on June 1, 2017 and was subsequently purchased by a third party. The domain reference in the DBAR application was not updated, so DBAR continued to reach out to the domain after it expired. Dell was alerted of this error and it was addressed. Dell discontinued the Dell Backup and Recovery application in 2016.&#8221;</p></blockquote>
<p>I have asked Dell for more information about this incident, such as whether the company knows if any customers were harmed as a result of this rather serious oversight. I&#8217;ll update this story in the event that I hear back from Dell.</p>
<p>This is not the first time the failure to register a domain name caused a security concern for a company that should be very concerned about security. Earlier this month, experts noticed that the Web sites for credit bureaus <strong>Trans Union</strong> and <strong>Equifax</strong> were <a href="https://krebsonsecurity.com/2017/10/equifax-credit-assistance-site-served-spyware/" target="_blank" rel="noopener">both redirecting browsers to popup ads</a> that tried to disguise adware and spyware as an update for Adobe Flash Player.</p>
<p>The spyware episodes at Equifax&#8217;s and Trans Union&#8217;s Web sites were made possible because both companies outsourced e-commerce and digital marketing to <strong>Fireclick</strong>, a now-defunct digital marketing product run by <strong>Digital River</strong>. Fireclick in turn invoked a domain called <strong>Netflame.cc</strong>. But according to <a href="https://www.wsj.com/articles/equifaxs-latest-security-foil-a-defunct-web-service-1507937742" target="_blank" rel="noopener">an Oct. 13 story</a> in <em>The Wall Street Journal</em>, Netflame&#8217;s registration &#8220;was released in October 2016, three months after Digital River ended support for Fireclick as part of an &#8216;ongoing domain cleanup.'&#8221;</p>
<p>The problem with the Dell customer support domain name comes as Dell customers continue to complain of being called by scammers pretending to be Dell tech support specialists. In many cases, the callers will try to make their scams sound more convincing by reading off the unique Dell “service tag” code printed on each Dell customer’s PC or laptop.</p>
<p>How can scammers have all this data if Dell&#8217;s service and support system isn&#8217;t compromised, many Dell customers have asked? And still ask: I&#8217;ve had three readers quiz me about these Dell service tag scams in the past week alone. Dell continues to be silent on what may be going on with the service tag scams, and has <a href="https://krebsonsecurity.com/2016/02/dell-to-customers-report-service-tag-scams/" target="_blank" rel="noopener">urged Dell customers targeted by such scams to report them to the company</a>.</p>


feed_id: https://krebsonsecurity.com/?p=41321
title: Fear the Reaper, or Reaper Madness?
uri: Fear-the-Reaper-or-Reaper-Madness
url: https://krebsonsecurity.com/2017/10/fear-the-reaper-or-reaper-madness/
content:
<p>Last week we looked at <a href="https://krebsonsecurity.com/2017/10/reaper-calm-before-the-iot-security-storm/" target="_blank" rel="noopener">reports from China and Israel</a> about a new &#8220;Internet of Things&#8221; malware strain called &#8220;<strong>Reaper</strong>&#8221; that researchers said infected more than a million organizations by targeting newfound security weaknesses in countless Internet routers, security cameras and digital video recorders (DVRs). Now some botnet experts are calling on people to stop the &#8220;Reaper Madness,&#8221; saying the actual number of IoT devices infected with Reaper right now is much smaller.</p>
<p><strong><img class="aligncenter size-full wp-image-41329" src="media/9e363dbc.reapermadness.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/reapermadness.png" alt="" width="483" height="311" />Arbor Networks</strong> said it believes the size of the Reaper botnet currently fluctuates between 10,000 and 20,000 bots total. Arbor notes that this can change any time.</p>
<p>Reaper was based in part on &#8220;<a href="https://krebsonsecurity.com/?s=Mirai&amp;x=0&amp;y=0" target="_blank" rel="noopener">Mirai</a>,&#8221; IoT malware code designed to knock Web sites offline in high-powered data floods, and an IoT malware strain that powered most of the largest cyberattacks of the past year. So it&#8217;s worrisome to think someone may have just built an army of a million IoT drones that could be used in crippling, coordinated assaults capable of wiping most networks offline.</p>
<p>If criminals haven&#8217;t yet built a million-strong botnet using the current pool of vulnerable devices, they certainly have the capacity to do so.</p>
<p>&#8220;An additional 2 million hosts have been identified by the botnet scanners as potential Reaper nodes, but have not been subsumed into the botnet,&#8221; Arbor&#8217;s ASERT team wrote, explaining that the coders may have intentionally slowed the how quickly the malware can spread to keep it quiet and under the radar.</p>
<p>Arbor says Reaper is likely being built to serve as the machine powering a giant attack-for-hire service known as a &#8220;<a href="https://krebsonsecurity.com/?s=booter&amp;x=0&amp;y=0" target="_blank" rel="noopener">booter</a>&#8221; or &#8220;<a href="https://krebsonsecurity.com/?s=stresser&amp;x=0&amp;y=0" target="_blank" rel="noopener">stresser</a>&#8221; service.</p>
<p>&#8220;Our current assessment of Reaper is that it is likely intended for use as a booter/stresser service primarily serving the intra-China DDoS-for-hire market,&#8221; Arbor wrote. &#8220;Reaper appears to be a product of the Chinese criminal underground; some of the general Reaper code is based on the <a href="https://www.arbornetworks.com/blog/asert/mirai-iot-botnet-description-ddos-attack-mitigation/" data-ss1509127502="1">Mirai</a> IoT malware, but it is not an outright Mirai clone.&#8221;<span id="more-41321"></span></p>
<p>On Thursday I asked Israeli cybersecurity firm <strong>Check Point</strong> &#8212; the source of the one-million Reaper clones claim &#8212; about how they came up with the number of a million infected organizations.</p>
<p>Check Point said it knows of over 30,000 infected devices that scanned for additional vulnerable devices.</p>
<p>&#8220;We had a prism into these attacks from a data set that only contains a few hundreds of networks, out of which 60% were being scanned,&#8221; said <strong>Maya Horowitz</strong>, a group manager in the threat intelligence division of Check Point. &#8220;Thus we assume that the numbers globally are much higher, in at least 1 order of magnitude.&#8221;</p>
<p>Reaper borrows programming code from Mirai. But unlike Mirai, which infects systems after trying dozens of factory-default username and password combinations, Reaper targets nine security holes across a range of consumer and commercial products. <a href="http://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/" target="_blank" rel="noopener">About half of those vulnerabilities</a> were discovered only in the past few months, and so a great many devices likely remain unpatched against Reaper.</p>
<p>Chinese cybersecurity firm <strong>Netlab 360</strong>, which <a href="http://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/" target="_blank" rel="noopener">published its own alert on Reaper</a> shortly after Check Point&#8217;s advisory, <a href="http://blog.netlab.360.com/iot_reaper-a-few-updates-en/" target="_blank" rel="noopener">issued a revised post on Oct. 25</a> stating that the largest gathering of Reaper systems it has seen by a single malware server is 28,000. Netlab&#8217;s <a href="http://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/" target="_blank" rel="noopener">original blog post</a> has links to patches for the nine security flaws exploited by Reaper.</p>


feed_id: https://krebsonsecurity.com/?p=41208
title: Equifax Reopens Salary Lookup Service
uri: Equifax-Reopens-Salary-Lookup-Service
url: https://krebsonsecurity.com/2017/11/equifax-reopens-salary-lookup-service/
content:
<p><strong>Equifax</strong> has re-opened a Web site that lets anyone look up the salary history of a large portion of the American workforce using little more than a person&#8217;s Social Security number and their date of birth. The big-three credit bureau took the site down just hours after <a href="https://krebsonsecurity.com/2017/10/equifax-breach-fallout-your-salary-history/" target="_blank" rel="noopener">I wrote about it on Oct. 8</a>, and began restoring the site eight days later saying it had added unspecified &#8220;security enhancements.&#8221;</p>
<div id="attachment_41054" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-41054" src="media/d6228fd8.twn-580x226.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/twn-580x226.png" alt="" width="580" height="226" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/10/twn-580x226.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/10/twn-768x300.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/10/twn.png 864w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The Work Number, Equifax&#8217;s salary and employment history portal.</p></div>
<p>At issue is a service provided by Equifax’s <a href="https://krebsonsecurity.com/?s=talx&amp;x=0&amp;y=0" target="_blank" rel="noopener">TALX division</a> called <a href="https://www.theworknumber.com/Employees/index.asp" target="_blank" rel="noopener">The Work Number</a>. The service is designed to provide automated employment and income verification for prospective employers, and tens of thousands of companies report employee salary data to it. The Work Number also allows anyone whose employer uses the service to provide proof of their income when purchasing a home or applying for a loan.</p>
<p>What’s needed to access your salary and employment history? <a href="https://secure.theworknumber.talx.com/twneeer/PreAuthenticated/EnterEmployerSearchCriteria.ascx?ReturnUrl=%2ftwneeer%2femployee%2fpostauthenticated%2fapplicationsequenceerror.ascx" target="_blank" rel="noopener">Go here</a>, and enter the employer name or employer code. After that, it asks for a “user ID.” This might sound like privileged information, but in most cases this is just the employees’s Social Security number (or a portion of it).</p>
<p>At the next step, the site asks visitors to “enter your PIN,” short for Personal Identification Number. However, in the vast majority of cases this appears to be little more than someone’s eight-digit date of birth. The formats differ by employer, but it’s usually either yyyy/mm/dd or mm/dd/yyyy, without the slashes.</p>
<p>Successful validation to the system produces two sets of data: An employee’s salary and employment history going back at least a decade, and a report listing all of the entities (ostensibly, the aforementioned “credentialed verifiers”) that have previously requested and viewed this information.</p>
<p>In <a href="https://www.nationalmortgagenews.com/news/equifax-restoring-the-work-number-portal-with-beefed-up-security" target="_blank" rel="noopener">a story</a> in the financial industry publication <em>National Mortgage News</em>, Equifax said:  &#8220;As access to the employee portal is restored, individuals must be re-authenticated and establish a unique PIN. Therefore, the data exposed in the cyber incident will not be sufficient to access The Work Number.&#8221;<span id="more-41208"></span></p>
<p>The publication said Equifax declined to answer questions about whether the timing of the portal maintenance or the decision to add new security features were in response to the original Oct. 8 report here, quoting an Equifax spokesman saying the company opted to move up and expand a planned service outage.</p>
<p>&#8220;At that time, we also decided to accelerate the implementation of select security enhancements to our platforms which extended the service outage timeframe,&#8221; the spokesman said.</p>
<p>I walked through the newer, allegedly more secure portal with a friend and source who worked at a major firm that used The Work Number at some point previously, and at first we couldn&#8217;t figure out how to enter his default PIN. A quick search for his employer&#8217;s name and &#8220;The Work Number&#8221; turned up a PDF with instructions stating that the PIN consisted of the last two digits of the employee&#8217;s birth year, and the fourth and fifth digit of their SSN.</p>
<div id="attachment_41353" style="width: 609px" class="wp-caption aligncenter"><img class=" wp-image-41353" src="media/4f3500ed.TWN-staticprompt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/TWN-staticprompt.png" alt="" width="599" height="542" /><p class="wp-caption-text">Part of the new and improved security at The Work Number.</p></div>
<p>After passing that screen, the only &#8220;security enhancements&#8221; I saw that my source encountered was a prompt to enter his full name, date of birth, Social Security number, address, phone number and email, followed by the usual retinue of four multiple-guess &#8220;knowledge-based authentication&#8221; (KBA) questions. I&#8217;ve long been a critic of these KBA questions, because the answers usually are available using sites like <a href="https://www.zillow.com" target="_blank" rel="noopener">Zillow</a> and <a href="https://www.spokeo.com" target="_blank" rel="noopener">Spokeo</a>, to say nothing of social networking profiles.</p>
<p>Fortunately, you can reduce the likelihood that an acquaintance, co-worker, stalker or anyone else can glean your salary history by claiming your own account, changing the PIN and selecting a half-dozen security questions and answers. As always, it’s best not to answer these questions truthfully, but to input answers that only you will know and that can’t be found using social networking sites or other public data sources.</p>
<p>I used to think that if you had <a href="https://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank" rel="noopener">a security freeze on your credit file</a> at a credit bureau that the bureau would then be unable to ask these KBA questions. I&#8217;ve recently worked with several sources who had freezes on their files and yet were still asked these KBA questions. Those individuals may not have all been approved to continue whatever transaction was in progress after answering those questions, but in most cases it shocks folks who have freezes when they even get asked those KBA questions.</p>
<p>However, it seems that each of the cases I&#8217;ve seen in which the person had a freeze on their credit file, the applicant was asked only non-financial questions. In other words, they were given questions that one did not necessarily need access to one&#8217;s credit card or mortgage statements to answer successfully &#8212; such as the names of previous streets resided on or the names of lenders used in the past.</p>
<p>What&#8217;s interesting is that these types of questions tend to be easier to answer than, say, &#8216;What was the amount of your most recent car loan payment?&#8217; That suggests that ID thieves could find people with credit freezes an easier target of services like this one because they face far easier KBA questions after they provide all of the target&#8217;s static information (DOB, SSN, etc).</p>
<p>If that sounds ironic or sad, remember that we&#8217;re talking about a company whose breach more severely impacted consumers who paid Equifax whatever fees the company is allowed to charge under state laws to freeze the consumer&#8217;s credit file.</p>
<p>We all sort of assumed this was the case when Equifax initially disclosed on Sept. 7 that the breach resulted in the theft of SSNs and other data on 143+million people, as well as<a href="https://krebsonsecurity.com/2017/09/equifax-hackers-stole-200k-credit-card-accounts-in-one-fell-swoop/" target="_blank" rel="noopener"> some 209,000 credit and debit card numbers</a>. But in written notifications recently mailed to victims of the breach, Equifax made it crystal clear that their credit card data was stolen because they once used it at Equifax to request a credit freeze or copy of their credit report.</p>
<div id="attachment_41357" style="width: 610px" class="wp-caption aligncenter"><img class=" wp-image-41357" src="media/2b9fd9ae.whatinfo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/11/whatinfo.png" alt="" width="600" height="139" /><p class="wp-caption-text">Part of the notice Equifax mailed this week to a U.S. breach victim.</p></div>
<p>Does your current or former employer share your salary data with Equifax? If so, were you able to access your salary history via <a href="https://secure.theworknumber.talx.com/twneeer/PreAuthenticated/EnterEmployerSearchCriteria.ascx?ReturnUrl=%2ftwneeer%2femployee%2fpostauthenticated%2fapplicationsequenceerror.ascx" target="_blank" rel="noopener">The Work Number site</a>? Sound off in the comments below about any &#8220;security enhancements&#8221; you encountered along the way.</p>
<p>If you&#8217;re still unsure what you should be doing in the wake of the breach at Equifax, see <a href="https://krebsonsecurity.com/2017/09/the-equifax-breach-what-you-should-know/" target="_blank" rel="noopener">this Q&amp;A</a>.</p>


